CG - How Embracing Social Media Helped Me Stop the Hackers, Save the World and Get the Girl! - Javva

all right ladies and gentlemen I'm going to go ahead and get a start this is Bob Malik and he is super freaking [ __ ] off of them so excited you get into bham I know you don't know me from Adam but that's okay and this is top social media control yes and so he's gonna give us an awesome presentation I'm very excited couple rolls do not throw things at speak or see you don't throw things you don't throw things over there either we don't do things back these are things that you we saw the cool things like teacher to grantham feather flag look I'm really lucky it thrilling but redistribute so we don't throw things we

also don't have the speakers because they go through a whole lot to get you know brave enough to stand in front of us so we do not handle them to save that for QA later and we do not take pictures if you take pictures and you are not the press pass guy and we get story about so please do not do that you know he is awesome we want to take pictures with him we do not do that so when all you do let me go ahead and divide yeah thank you for that now I have got some sound dish video clips in here and we don't have breaks down so I'm going to lean

over and play to the microphone er see if we can get into work that way a quick disclaimer before I do start

okay a quickly disclaimer before I do start and the talk is entitled erm how associate embracing social media helped me to stop the hacker save the world and get the girl this is not constituting of professional advice please do results may vary from person to person please seek professional advice before embarking on any social media activity and do not undertake the effectivity while under the influence of alcohol can be like really limiting so without further ado I'm going to try to save this job works please come in sit down make yourself comfortable you are in the right place

welcome to this presentation we hope you enjoy it if you have a pair of the talks I met explain for the main

[Applause]

cool so I think that kind of work video is kind of my thing so I so lucky could because everywhere I everything like do this is quite like a fun talk please interact at any time how cool interact that's cool I try to answer any questions and otherwise i'll ignore you and say IPL but will do at the end or it's covered at some point later on this is quite a personal journey of mine so a lot of the surface is directly related to me but then I've taken a lot of the stuff and I've generalized it's so that maybe others can can apply some of these learnings and say that's cool or these [ __ ] so social media has actually

really changed my life it's been one of these tools eight it's like a nation gaming a WMD they suddenly become one of the big boys and that's what social media done for me I spent a long time in information security I mean this basically all overworked him and it is changed me greatly so so today you probably you know if you ever swallowed me I naive and I remember me to assume the hall if you follow me but if you were doing if you probably see me in places like this on on my work world tours like trying to be a badass looking more like Brokeback Mountain I think but I was a very different person many years

ago maybe not externally but on the inside I was so let's start with a with a bit of history it all started when I was a little lad I've been working in security for six years or so and I had a lot of questions I've been through a very confused phase in my life I used to think well you know why am I not progressing up the career ladder why are people who are [ __ ] appearing on CNN okay magazine why is it that you know I've hit this glass ceiling no one knows me my boss really doesn't care about me and we talked a lot about this this problem that affects women in IT quite quite a

lot that oh they under-represented ear they don't get ahead they don't do this hey I was one of those guys who was in that same situation I'm sure there are other guys like that and you know not everyone's like you know that gift did not know everyone's a confident not everyone's that their outgoing and great that they can they can jump jump through all these things so so i was a bit a bit for dilemma i wasn't that clever that i could create my own operating system on linux distro or something like that and make my mark on that on the infosec world but you know surely there was something I could do so I went and I

looked at others who are not in information security because we have this tendency to focus only within information security and which where I fix all our problem and reinvent the wheel time and time again so witness a sir okay how people done it externally because this isn't a problem related just to our industry so I mother Teresa she she wasn't the only person on the planet doing good charity work yeah you know she is one of the evening the most well known and what was well respected people in that sort film okay I mean I tried to make the talk more us friendly that's why I put in my cmp so i might be wrong and some of your American facts in

which case you have to forgive me we don't really look after the colonies that much anymore so you know JFK is like a really popular you know the Kennedy family and everything they're very popular really really really famous you know and there's all these other presidents in between her and it's surprising when I was doing the surgery JFK you can't really find a bad photo of him anywhere on the internet which is interesting you look at other people Oprah Winfrey what was she a weather girl I think many years ago and then she grew up in to this this big sort of like chat show host and a brand in her own right so what was different what did she do

differently from any other of the other weather girls than any of the local TV stations and I thought if I understand what she done differently than what could what could an average IT security person do differently to make themselves into a brand or make themselves more better known and get their own chat show and the famous the Dalai Lama he's famous for whatever reason he's famous for Jamie Oliver he's not the only Essex white boy who knows how to cook a little bit but you know what he's been talking on terror knees but we need to eat healthy miyajima and that's all good but you know he's not the only person that's ever said that in the world yet he's

built his all ran about it and you know my mother's cooking far better and far more healthy than his bite she's not up on Ted so I thought about this and I'd like to say that in one of those Isaac Newton moments where the applicant me on the head or similar to that bar either yeah playing area this is why I think we spend our career like this we start our career somewhere around here with little to no knowledge of our subject matter and over the years we work our way across now that that's probably super puma genius level we have a lot of enthusiasm around here and then the tour the middle we can like reach me delayed

we get married have kids maybe or we adopt kittens and Dawson we kind of like you know by six and want to get fitter and drink CrossFit and all that other kind of stuff that you see the Middle Ages sort of crew on on on Twitter doing so we sort of hover around there but that's all we do we work our way up and we say okay if I'm the most knowledgeable person in this particular field of security if I know how to do lobs management better than anyone else if I know how to do pentesting better than anyone else maybe that way i can i can become the man or the woman but it

doesn't quite work like that because there's an element missing to this and the the second dimension to it is it's the communications reach or same index or you know whatever you want to call it how good are we at communicating what we do with people to be doing okay this is it you know you might see there that's not really a profound statement we all know that you know security we've already crap communicating and you know is there a translator in between you can communicate business speak into techno speak but you look at the basics of it and you see okay a few weeks ago ours on Twitter and I said okay if you had to

put together a crap come on those security team who would you put it there yeah who would you put it there so you know make you know names came up chris nicholson ETA October and I'll God want him on my open source intelligence yeah that kind of stuff came out and these little vial or josh collins name came up a couple of times then you know these are all guys who we know and would respect that's a good name that's a good name that's a good name i thought yeah i probably have all of those in my team then I said well you know what I've never actually worked with any of these people I really don't really know how

they like to work with but I've got this impression of this imagery wife in my mind that i'll be just over cool there there comes the way they portray their skill so and how they explain it so we have to like these different levels of communications so as you go up up the chart you communicate initially within the echo chamber we talk amongst ourselves we talk about just just a security people offer of a free period of time we we may be excel and people stop talking within the industry so the wider IT or the business industry as a whole and some people have reached that and the people that reach the height of that become public figures

they they they get invited to speak on very public forum so maybe something like Ted which is a very public forum to talk or a mainstream sort of like news outlet or something like that so that's generally had worked and this is where it gets really interesting so once I and map this out I thought okay where am I on this chart and where do I want to be and this varies for everyone I'm not saying everyone really needs to get really cool our communications and get into the public space because that's going to solve the problems no it is a very individual thing you know for some people it's about increasing their knowledge and that's what brings them

satisfaction for others it's like it they want to not really focus on that as much as that I knew I'd reached a peak probably in like how much I was really going to learn on how much I was willing to learn in terms of like really minor and fine details on on the subject matter but then there was other skills I wanted to develop I wanted to develop better speaking skills better writing skills better communication skills so I wanted to move up a bit so so I thought working whatever little knowledge I have if I can share that more effectively I'll be more happy with that I you know it's not listening about knowing great

deal we're not doing is about being more effective with the manager dude her and then I looked at a few people you might know this person is Andy he's known his handles integral on Twitter and I often before I use this month on here so he's probably good luck with it but okay where would I put him I look at him and I think well maybe he's one of those middle of the new iphones deliberately big so you can say there's a range where he could fit into it because i didn't want to police say how good was that he was but ok his knowledge is pretty decent and he pretty you know well embedded within the echo chamber of

security by the way the edge of gender isn't a derogatory term i'm not saying it's a bad thing it's a very good thing we should be communicating with some people are very much on the line they work in security for like 20 years and not even anyone in the echo chamber knows i'm outside their immediate team HD Moore is her fledgling more yeah what do you think he is on the on the sky where would you put him any one industry yeah so he's probably in the industry and knowledge would you say is more knowledgeable than integral or less which can be we on the right yeah break up into the right pieces I think that's

where I crappie reckon he is like you know every now and then you'll pop up above the public thing but there's a whole whole whole thing behind that obviously he's now let's go rapid seven and they bought PR machine and he even will go so i think it's not just about Hey look I done this research and I found someone of interested upnp it's all about okay here's the raw data here's a me differently white paper here's a really cool blog hears me talking to all the journalists one hour time to explain this [ __ ] and boom it suddenly explodes as security research is typically off I found a bug move on next one I found it five documented move

on and they don't want to spend time doing that so that's work with the different slice Kevin reconsiders can rig it so yeah my man over there I'd say he probably you know he tees up an older version of that that's probably the typical career pot you know most people end up taking they they start their they get a bit of knowledge a bit more sort of much variety and you know that that's like you know over the course of five ten years what have you brush nyah dinosaur of information security he wrote a really cool cryptography book like 500 years ago and that was way ahead of its fight and it was cool and

he knew his stuff has he kept his knowledge up to the industry as times gone on my personal opinion I don't thinks i think is 120 wishy-washy and trust society man we need trust models and like whatever US patent wondering that voice way you're gonna work but he's yep so I quit he went there he was in the top right for a while and now he's kind of like for that but the residual of his communication has lasted so whether whether his knowledge house or hazard is residual sort of like communications at last day so if Bruce should I say something if he posted an opinion on blog post whether we agree or disagree with it we're talking amongst

their we're disagreeing with in the echo chamber nobody gives a flying flip about that he's up that last one on here before I move on well as number one half

we could leave him where he is I'm not his comms rage is probably greater than Bruce Schneier his knowledge is in the negative and that's and I think that's very telling in that what differentiates a charlatan from someone that's actually respectable it's its knowledge in other words talk about what you know you're talking about and even if you know very little if you communicate well you get some level of respect and attention and you won't try to get lynched by the echo chamber over here you know one really pays attention to outsiders the echo chamber so that would one thing are very conscious stuff I don't wanna end up like like Gregory Amma's I don't want to

get up here and say hey I've got a really technical talk I want to give you guys a day because you guys would rip the [ __ ] out of me and you know looking even worse than I did so this was my my my my p discovery if you don't take anything away from there remember that that's like the new magic quadrant for information security professionals trade wat you can talk to me about licensing afterwards what it was now to is messaging you have a message we all have a message and you know some of us rant about a sum of a brave about it some of us like get get our panties in a right

bunch about it but you know we have a quite regular web apps they're not secure risk management's not done properly but it needs to be underpinned by great delivery we deliver it in a way that people actually understand it otherwise it's just that crazy lunatic in the corner you know with the sound we bored or something the word of the world is near or what have you and you know we have to step out of that we have to say okay there's something and even if we're really passionate I I don't if you went to find a blues talk early today and she spoke about the the b-side san fran incident she was very much real fact

about it and it's a very emotional thing it boils in that situation i'll be getting up jumping up and down get your pitchforks let's go and kill some other people whatever and you know that youth matter of fact this is what happened this what happened okay i'm really upset about it but I can hear has how we address the issue and very matter-of-fact about it that's great delivering the great message that great delivery he actually you know appeals for the intellect it's even when it's an emotional issue so understanding this set me off on this road this road where I went from being a nobody to slightly less of a nobody and where I was never

getting calls back from recruiters I was never getting like my corporal hey presentations accepted because I look at the name for the hell is that I don't even have chromatic tonight they still don't but they'll accept me and not only that I get invited to come and say hey would you come along and speak why because we think you know your stuff don't but ok you're going I'm going to be I was going to talk about this kind of different places that I've gone and spoken and done by instead I put together a really good one Tosh because everything's easier with a month I'd isn't it

[Music]

so yeah that might quick one tied in how it actually has changed my life and you can see by the photos photos can never be photoshopped and there are completely true reflections so I find myself in this in the upper echelons of the security elite rubbing shoulders with the likes of mccurdy / none who you saw on there who actually came up to me it's a higher javon I love your videos holy [ __ ] yeah okay yay other guises also you know people who I couldn't imagine speaking to before they actually come up to me and say hey I love your work or you know you could do this a bit better or worse or whatever it's great it's

something so it means that the the delivery mechanism is working that the hybrid optics through YouTube and it's not about secret handshake that's not that who you know okay what caveat there if you're a conference not called besides if you give people money they might give you a platform to speak places like besides we don't work like that it's about better content and voting and hopefully but aside from that you know putting those sponsored talks and sponsored articles and all that kind of stuff aside you know people people who are looking for good content and they're looking for great delivery of that good content you could have the best material in the world but if you

can't present it or delivering in a meaningful what manner you might as well just sit up there and and read the dictionary on say some people might say it causes a bit of an ego issue hello you look you're out there speaking everywhere you're putting up Mont idea how great you are surely you must get to your head sometimes it doesn't I won't lie but it's a byproduct it's like would like a lot don't you don't okay it's similar to how people at steve jobs in other very successful and wealthy people say money is the byproduct of what they they follow their passion and money comes as a by-product similarly I'm out there trying to

deliver on my message of security and fame or ego or recognition is a byproduct of that and that's really largely down to the delivery mechanism I've chosen which is primarily using videos I could just as easily behind different mediums that if it just Rick said you could use a hand or you know synonym or something and you know you don't fall into that ego truck if you think that you won't be able to handle that rock stardom that comes along with it okay so that's my story now the probably the question the burning question is where do you start what where do you start so there's so much social media is so many different channels you can go

out and interact with so so so what do you choose how'd you go about doing it well when you look around then there's lots of social media channels out there and the choices well which one do i pick is one better than the other I've heard some podcasts and there are also i may be actually do a podcast or you know there's a you know so-and-so writes really good our brian krebs does i'm really fantastic like journalistic articles maybe i should write that ryan craig and then you stopped writing me realize I can't right I can't string together more than three sentences in a coherence is coherent way unless it's on Twitter so people often ask me like

what's the best mechanism what's the best rumor you should take and then you get this definition of what's the best what is the best don't wait okay if you do a search on youtube for this doesn't have sound what who's what's the best dancer in the world you'll find this clip as I found it as number one if it probably on the top view now is he the best dancer in the world really is he better than Michael Jackson is he better than Fred Astaire is the better than Justin Timberlake running out of referencing that okay oh and and the fact of the matter is Fred Astaire was the best friend Astaire dancing Justin Timberlake is a best that Justin

Timberlake dancing and michael jackson was the best grabbing his crotch so what it comes down to is you can need to find what's best for you and what the best for you is the best authentic you it's very we are in an industry which we are forced to think of individuals all the time we find our way around problems and last lap the hacker mindset or the security line set is like you know you're trying to look at things in different ways and that's really great on a technological level however when we go into a communication level or when we choose our social media channel we kind of lose that users we cannot lose that

creativity mmm we start trying to emulate others so we say oh you know exotic liability fantastic podcasts I want to podcast just like exotic liability no that's great for them maybe your style of blood casting is different is podcasting is your thing at all so you need to choose what what was the best best mechanism for you and you need to try and try and find it there's no easy way to figure out what that is you know this is my delivery platform i'll call it platform is there's a collection of things and that's sounds cool it's time at a vendor term we don't know a product we have a platform so youtube it is my is my dominant delivery channel I

use Twitter and I blogger beer yeah come up and speak and write a little bit but for youtube dominates it all and everything else supports it so it's not just one channel which like several channels and you choose what best fits for you some people love Twitter other people hate to tell me that it's just whatever works for you I don't fix in when you think the other thing I found really really useful how much are we doing on time we're halfway our course is a mentorship and it doesn't need to be a really formal thing and I put the s to the breather because you know you need to look out for people who can give

you really constructive feedback and advice and support you through this process because we it's not always an easy process and if doesn't need to be a really formal thing it can just be a group of really good trusted friends who you can give you really good feedback because people are as attempt to give you honest feedback so if I at the end side hey someone give me some good feedback or something give me some feedback on my talk I love you be really polite and can't say that was good i really enjoyed it nice to meet you but the real feedback is like that gentleman there who's walking out it's like yeah that's fine that's real

feedback right there yep so oh but you know you don't always get to hear that bad feedback so maybe you can nominate so far I tend to generally nominate someone in the audience a okay your own best friend tell me really how I have that I suck at the end of it these are some of my the board members that constitute my mentorship or DD the people in fur helped me tremendously over the years in you know what I've done and it up I it's just something that works for me maybe some people are not very good at making friends so that's cool something really cool contacting

ok so then actually how many people I've actually haven't seen a video of mine I think most if you sir so you know what I'm talking about them now so so a common question I get is like a how'd you come up with the idea or how do you execute on a video or what makes it really cool you know really engaging what other you know I see the staff some videos really go viral others you know fairly my mom doesn't even watch it so how do I go about doing it and the methodology or I follow is as follows I come up with a concept what's the idea I want to to spread in a capacity so it

might be something like compliance does not equal security yeah simple to get concept with week we generally agree what's the next step I do I undertake some research on that to actually validate that concept because one thing I found is I have a lot of concepts or I've had a lot of concepts that actually when I started researching our find to change my mind on it because it was just weird morning just a gut feeling or something like just picked up off Twitter and when I actually researched yourself well no maybe it's not not the case but ok in this case I researched it and I thought yes security and compliance are not the same things

definitely now I'll get creative and this is where sometimes I struggle you it could be a process that takes 30 seconds to three days but ok what's the analogy how can I draw an analogy how can I explain it when my daughter understand if I explain to the one talking about and so you know i might go ok in this one are said to be compliant to ride a motorbike in the UK the law says you have to wear a helmet it doesn't have to have before facing we can be open face helmet you don't need i wear and you don't need any class you don't need any protective clothing of any sort so you can wear an open face

helmet and a string vest flip-flops and shorts and you compliant to ride a motorbike is that secure no okay I'll work with that that analogy kind of stretches out that works what do i do then i create a video on the topic saying security and compliance them of the same thing i'll write a blog on the topic i'll tweet about the topic the key thing here though is the message is tailored for each individual channel and this is something a lot of people over time have not agreed with me and I always maintained that each medium is different each medium deserves a different delivery style for example I think the people in this room you're

getting a far richer experience for better or worse of this presentation then those watching a TV land through the recording over there why because when we face to face it's not really any room for ambiguity if you know I you know you can see me I can see you we can like smile and nod and give obscene gestures and all the fun is done and on the video he doesn't work like there and you lose a lot of that and you know will you people are going to watch it on it on a four inch screen on the laptop or something and the audio quality might not be great and what have you so what I

do I take this talk and i'll create a two and a half three minute video on Mikey bam bam bam I'll put some sound effects into it I'll make it really pretty it's almost like a trailer for a movie and I find that works far better will captivate the attention one because i'm not worried about all the detail that comes into their i'm worried about getting the concept across as long as people understand and agree with the concept they can work out the rest themselves so you know it's got me toyota tercel Steve Jobs or Apple were really good at this when they launched thank you gentlemen it's been a pleasure sir we'll be down to one person at the end

home a bit up my game so as Apple were really good at it and when they released safe side was there the ipod thousand pocket in your thousand pockets in your song a thousand songs in your pocket and that went out on there on the marketing and that went on the tweet and that was a strut line and you know and then but when he done his presentation he went into a great deal of detail the adverb the printhead words have different levels of detail and the tweets or the other meat is a different level detail so that's a good model to follow you might not get it correct every time but it's a decent model I'll find it works

that's the easy part the next part is to not Apple sharp if you don't recognize us a quote from zombieland the woody Hoffman's character and i love it feels good as well but gang all that is easy you've done all that hard well you've research you've got the concept you you put it onto your channels and that's pretty easy there's a part that follows it which is where it's very easy to lose all hope and say i'm never going to do this a day

it's a big physical change for you to remember talking to me lamenting I love the character bahama more than fat jack inertia and cigarettes and weed ways we have ways we have ways those two hours of makeup every morning nine hours two hours and hours of maker of ice cream today I eat a quart of ice cream ever again according I scream when I first directed my short film art multi facial what I use for confidence to direct that movie was a book by sending the bad cop make a movie and where I used for confidence Oh making movies by similar bet I know a book called making movies to get the confidence to direct the film

I read a book called making movies babe so those of you do recognize it that was more famous Hollywood said list of Vin Diesel he's promoting one of his movies what this shows is he went on 10 12 / how many different talk shows to promote that promote the film this is what all movie stars do it normally prompted mantra and what the clip was showing that he gave the very same answer to it was pre-scripted but is a very same answer to all the questions time and time again so what what does it mean to us what happens in security either calls up you know I I don't know how this new encryption thing works how do i use it

well you know this is how you do it this way you do it by the way if you look on the SharePoint side the documentation their next user balls up the [ __ ] documentation zhan sharepoint 30 the calls up you hang up on him straight away you go on Twitter and you say how can users don't read the manual they're idiots they're imbeciles I hate this job want to kill myself someone find me a better place on this planet go team there's a special space reserved in helping these users but definitely they can't find really yeah yeah exactly so so that's the difference between how you know we react how we generally go about

you know interacting with uses we go do we have that same level of patience do we have the same you know you see on Twitter and since I've become an analyst for [ __ ] research the races and this company the world Oh plug but only I get to deal with a lot of journalists and that kind of theorem don't get journalist press press people asking for a 10-unit and so so I had a sort of hanging around in those circles and you speak to some people I've got deep journalists so don't become asking the same question all the questions are really no offense they were journalists in the front so you know they are same

question of a stupid question asleep they don't understand the issues and I don't have time to go and explain to them why not isn't that part of your job isn't that what we're here to do aren't we here you know we can't fix every single web app on them out there on the planet there's just too many and people talk about this skills gap of course there's a [ __ ] skills gap you know you've got like you know what 50 web apps where every person on the planet you're not going to get everyone doing that what we need to do is we need to say ok this is a concept isn't it let's spread the word and let's get other

people to become self-reliant you know so at least they even if they can't fix it themselves they can idiots identify when something's wrong and they can call someone who do you know that big if I can't change the spin wheel on my car at least I've got Bishop with the breakdown services they can come and change it for me but what if I don't even know what is flat tire is I don't even know that you know how it I should be its communication pretty poor a so the next step then is why I do there's loads of steps I don't know it's like wonders Alcoholics Anonymous is it like seven step program or something is

you put your personal brand or you put your communications on steroids and that's what it's all about dropping like flies thank you fish and chips are National Diet what our I mean producer both of these are more or less the same look at minus the peas and the lemon it's fish and its chips pretty much identical nutritional quality weld I find my girlfriend that or would I take it to a restaurant there I take her there that's one wife how do I present my findings how do we present security findings to the world we say okay we found this great exploit and the codes over there is a source code and you can download it and use it yourself in the

vm and it's really easy or is it easy you easy for some people in this room is it easy for everybody how's it packaged up again I'll go back to the HD Moore went beneath fine upnp that's a great example look at all the different channels in which that's not theirs is it the especially you know there's a lot more techie boards therefore for people to ask more technical questions is there's different PR people dealing with press for them more like layman's terms how do we present a stuff so I this is like a gradual metamorphosis what I went through I this will like 11 of the one of the earlier values of my website as

standard template in it looked alright and then I thought well okay now maybe I need to improve it so eventually I got a graphic designer to a proper one not not what I'm a dude who knows how to code a bit it took dudes them and it's all that looks a bit better it's cleaner highlights of fed on my videos is you know some some quirky little things there that you know i think you know work better so the same thing with with my videos when when I side on hey chopped off on the top and poor contrast and really static and you know I look back at those ago that was really crap I

mean why did anyone ever watch them why did I ever continue make and now they're a bit more cinematic and out of these filters on there my enacted it what white screen and all that kind of stuff

and we saw a really good security website you go to are still black background between matrix text on the front let's go back to fish and chips same nutritional content what's present it in a really bad way it's like it automatically puts up this barrier I'm a gauge if you're not again you're probably not welcome here we don't worry you'll find around here how do you have you change it how do you make it more accessible how do you make it more friendly there's a debating slightly bug there's a study done by car companies and you know you open the door and the interior light comes on yep everyone knows that had you close the door and

traditionally the light just boom off and what they then experimenting wasn't say they closed the door and the light dims off so it takes about a second or two second it dims and then goes off and they found that people that when they came to do a test drive or check out the car the light switch give them when top had a higher satisfaction rate guide people were like wow this something more special about this car they're like why's that so they looked at and said why it is linked to the cinema effect you know what a movie is about to stop the lights dimmed slowly and the curtains oh so it's the anticipation expectation something magicals better

hope that something special is going to happen and that's what you know that that induce that which is why I had a trailer sort of thing at the front there you know the devil you know what I'm trying to reproduce that trying to say hey man this is a movie this is kind of like a 3d movie short fat bearded like that and I kind of like you know what works in the same way feelings are important to raw data information might work for us because that's what that's the world we live in other people are looking for for a story they're looking for any motional attachment to think that they want a reason to care okay I'll tell

your name of the film I'll explain the film to you first one to two guess it gets a a drink from me daughter kidnap mangos kills people brings back daughter do take it who said that you go sir you are the winner can you drag it out into a two-hour movie that some people actually said that was pretty good enjoyable they they liked it so the concept is very small but then you expand it you make it interest in you you you at drom and you create this an attachment to the characters I wasn't attached to his daughter oh that was that and you know do we create that attachment pitfalls there are some pitfalls and this is where I offer using

social media and where you two numbers this is going to be a tough one anyone got an idea what these two numbers represent this kind of relate to social media maybe maybe is unfair 4543 is the number of words now wish my double check Wikipedia but okay apparently in the original unamended US Constitution 4543 words 14,000 what does that relate to sorry no no not the amendments good treiber sorry [Music]

that's the Facebook terms of conditions they can use a good advisor you're telling me that website used for sharing your kids pictures primarily or you can't is three and a half times more important or difficult to regulate them the in the greatest country on the nation you were sick you was are you saying that's the case watch that's a bit for that you know it just shows how complex this is social media fireman there are a lot of pitfalls so you know are you aware of what you're putting out there set some ground rules okay I'm never going to post anything on social media drunk or angry or you know I maybe you're not going to swear maybe you

going to keep it PG friendly you know yeah I mean these are some of my personal rules everyone would have their own rules depending on how they want to be portrayed but think about it it's a bit like getting a tattoo now putting anything on social media it might be funny and cool at the time but six months down the line when you're flying for your next job n your next potential boss is looking at that when you find it funny she won't procrastination flowchart how many people have ever started a blog with the best of intentions of updating it and then is not been updated for the last 36 months a year or a view yes yes I've

been there too and tony was attention early it's been three weeks since you put a video out there wasn't matter it means getting out of your comfort zone because you're getting your concept your ideas and you're putting out there to the world and you're going to get pushback you're going to get challenges it's not a comfortable experience for many people especially that cut me I mean I I still AM quite shy and non-confrontational person and give me it's this relates back to the knee goes you don't believe the hype you might put out a really good blog post and he might be to ear and he would say that was great I've really loved the work you've

done on it but that's got a very short half-life if you know that that's forgotten very quickly and you're only as good as your last post or your last bit of research of what have you done let it get to your head that's put more for me than anyone else I try to avoid negative people there are plenty of people cannot pull you down in this world we don't need any of that and there's a difference between trolling and feedback and sleep back up welcoming if any of you who eventually I am infinitely grateful to you for staying to this late when so many of your comrades are all in focus on oh but yet

get feedback even if it's good or bad make it make it useful even bad feedback is useful feedback but trolling is not feedback trolling is unhelpful that doesn't help tell anyone if you don't like someone you don't like someone I think fair enough this trick if other people in panic don't you know spend your time and effort spouting hatred and vitriol towards them and there's a lot of thought that goes on in our in our culture as well you know there's a lot finger-pointing is rise above it ignore it so quickly summarize some key points because I thought summarize of key point slide looks really cool and I've read the three points are are more than enough so

share with no expectation we're not here to to to really like you know become the next Neiman on the internet it's about sharing stuff with no expectation offend you return we're not first light blogging or pregnant videos other than expecting anyone to look I think because I've enjoyed it and I thought if even one person watches it and one person so it gets an idea from it that that's the difference I've made I made this video I'm done don't encrypt passwords and explain different swing encrypting and hashing and salting and yeah it got a few hits and then a few weeks later linkedin drop reached and then the sky rocket a big on linkedin everywhere and

everything so there's no expectation it just happened be consistent they're falling to the press relations the procrastination crap and feelings are important to think about how you make people feel you might be absolutely right the web developer absolutely got it wrong but if you walk in there kick their ass and walk out and they're feeling like [ __ ] what you've really achieved what they really learn you know are we you know i'm not saying let's all become like touchy Feeney everything like that but be things are important too and you see this in movies quite a lot where they'll play a movie and he could be like it's brilliant rom-coms where there's a lot of handstand in us

all right dude he cheated on me and so I'm breaking up with him and then there's a lot of this drama invention without watch me from and in the end they get together and then what do they do in the end they play something upbeat while the credits are rolling to make people feel happy so they walk out thinking that was a good floor will get feeling happy about myself so we can do that with what we do in security and I think make people feel better about themselves and more secure about themselves at this same time on that night

[Music] cool thank you very much for that I will entertain any questions and in return you should get drinks couches if you're very quick so how would you roll it into developing a security awareness program because i have like kids / developers and like many countries and we're doing like a house the bug game I don't know it's more like that's really cool to give me ideas how to make my kids like us on thank you yes so yeah absolutely these are all techniques you can use for user awareness but nothing like that said here it can't be a fight there so you're just looking at you know where your comms reach going so instead of

echo chamber and industry and property you're looking is it department or white or company-wide and then you apply the same strategies there the thing is about is it's got to be engaging it's got me interesting this will be relevant and internally it's a bit problem because you get enough pushback internally or we can't use comedy in our user awareness heaven forbid someone cracks a smile or we can't do this like that but don't be afraid to take chances and push the boat what's it worse that could happen yeah yes time and money investment time and money investment good question i've done the typical douche thing when i started out and I bought an expensive DSLR and I

got an expensive editing software and then I realize I didn't need it you don't need anything to stop just stop with and financially I say you know what you know hackers think like a curse you can find stuff that works you can record videos on your iphone you can you know edit it on I UAV or Windows Movie Maker it's not that difficult a lot of people do that kind of stuff time is an investment but we invest time and everything we do you know we it is a major of our work we spend just as much time coding stuff and trying to find bars and prepare your presentation and coming to conferences the time is there

is about you know how each other later and create it yes what if things go wrong on a public media like I mean assuming everything will go right it's a good feeling but then if something goes wrong like what like what could go wrong now you force something and you get a lot of criticism and then maybe I me I don't know how to get back not cool so you heard it through security you get a lot Kristen so there's two reasons you get criticism when you put something out there maybe there's more one is you're actually wrong okay yeah and the second one is you're right but people didn't like the way in which you presented it

or they don't like you as a person yeah the first one is ok we all make mistakes and it is all about it's like incident response isn't it mistakes happen is it exactly where it's right now what do we do now you still use your social media channel to correct that it's all it's not about running away and saying oh crap if you look at some of some of the output is false off as well about like you using social media and PR for for instant response when linkedin got reach they were really terrible where they spent ages before they actually acknowledge anything went wrong so if not leads something went wrong you know taketake ways to fix it so so maybe you

want to remove that that post or maybe you want to edit it maybe you want to work with us this where the mentors come in really handy you know if you create something now i do if i create a topic bigger on and topping that i'm not a hundred percent and expert on what i do is I've send it to someone first privately and say England you're an expert on sequel injection what do you think of this is it correct is it not also hears that the other one is people don't like your delivery style or personality and you don't have to change for that where you can take on board what elements you know

maybe is a good opportunity for you as long as they're not trolling yeah if they're genuinely saying I think that's terrible then this good opportunity to sort of like have conversations that I do what you like so that you know you might say a man the way you stood beside the podium and leaned against it I really hated that irritation okay well maybe that's good feedback maybe I need to stand more operating maybe my body language is prep but you know so one of the things too is you have a look at what the intent is I mean if you screw something up but your kids try to do the right thing people are usually

relatively forgiving and you know you definitely want to use your media channels but you know you want to get that network of people that will support you together I mean it takes their roommate and you know a lot of stuff that John's doing I mean look there's not a playbook for this stuff how many other people are doing video blog stuff he's way up there when you do stuff as progressive as Javad is doing there are no rules you know you want to do but his intent is the right intent in some people are very forgiving and how do you keep the balance between like you know appealing to the last people and also give you the technical stuff I mean I

don't know how much research as well

ok

excellent train my recommendation people often if I drop someone's name and I talk about a half a criminal Association excellent point now the point is are we off to fame is that the time we got fame or followers and and know what why should that be our our goal our goal should be we want people to know about security now if you create good work if you've done some good research there's no harm and sharing it with key influences yes if you created if you've done some good work you've said hey here's a really cool way to do this you said it to me for example say what do you think of this I'm not create a video

around it i'm also here here's a really cool why because it's something of value i see value in it and i'll mention you through the value of your work and that's far more so that that's what we should be aiming for creating something of value that other people can take and cheering on and that's the definition when you look at social media what what what is viable when we say something's gone viral what does it mean what it actually means it's not about getting tens of millions of hit is about when I've shared something with you and you forwarded it on to even one person without me asking or without any other reason that you want them to see that as

well because they touched you in a way that's the definition of viral it's gone out of the originator control and that's what we're trying to do with social media which want to get stuff people create content that people enjoy so much that they share it on this man

is there a tipping point for too much PR

yes it's a very yes and no so it depends on what channels you're actually pran so I could write I produce a video and then I'll tweet it I'd put it on google+ operate on my Facebook page they've different there's some overlap of audience but they're different categories and that's perfectly cool and I could then send it out to friends and connectors and what I've you say hey what do you think of this anything this what's really bad and annoying is when I tweet the same thing every hour hey in case you miss this in the west coast in case you missed this in the East Coast etiquette you know then he then you look

really needy and and I think it dilutes that the value of what you're doing you should definitely should have a release schedule and a release plan and that's nothing could have gone into but so suffering that I'm in London so I when I do publish a video I do it late in the afternoon over there so people are still waking up in the US so I capture of a large you know Elijah audience base because it's gone to my stats that's where majority of my my viewers are and english-speaking countries and you know some timing for that and then I'll do the facebook and everything all at the same time and then throughout the gif

dinner then I'll space it out and and what have you but then if an incident happens that's directly related to something I've done then I'll probably retweet something from old just say hey by the way this links into that you want not made the connection and you know there's that but it's a delicate balance at times I know some people they they go way over the top and then they get a you know I'm following on Twitter basically because they look like this suppose yes new research published to be you'll pick it up and we are completely wrong and then each other and everyone's wrong so it's a media if they take something that you published and they misinterpret it

yeah you think yeah cool so this comes down to a couple of factors so it very easy is very easy to blame the media say you got it wrong and you're idiots and sometimes that might be true because there could be a lazy journalists there could be a lazy journalists it doesn't research something or looking for the most more sensational angle more often than not it's because we probably didn't explain something clearly enough we made some assumptions that people understand the language that we speak and this is a very difficult one to get around because we socialize and interact in those circles I understand everything so when we talk about a blog when we talk about

tweets you know people who don't use twitter it's very alien to them they don't understand what what twitter is and you know and i'm not all about old people i talk about even you know younger you know pretty cool people if they don't use it they won't understand it so the onus is on us to sometimes create several versions of the same thing going back to haitian more event you vm v there's a journalist friendly version of this and there's someone there to take calls from journalism or those were happy but in the case whether it where the gene gets out the bottle it's an opportunity you're never going to completely rectify it but there's an

opportunity to engage in dialogue offer to speak to that journalist or that publisher and in a very non-confrontational manner no one likes to be told you you're a [ __ ] you've got it wrong it's about ok I think you've misunderstood it coming up a chat can we have a coffee can you know something like that it's all about building up those those relations and what would then happen next time that journalist actually gets a call or writes an article they might actually give you a course that what's your opinion on this yeah and that's when you know you're gay okay you know I've established some value there because I've taken the time to explain

and my opinion is valued to remember that now they want to ask me for my opinion get my input in there and that's when your comms reach increases exponentially

cool thank you very much for that I've really enjoyed it central Spain again

i'm heading off to black hat now because I've some work stuff to do but I will be here for the after-party Saphira wants to get one of these three drinks off me or just chat say hi I'll be more than happy to