2024 Security BSides // Michael Castro

all right so it's great to be back here I was here last year and I realized last year my talk was at the end of the day and I had the dread of the end now I have the dread of the last one before lunch so I'm going to ensure Ure that I keep you on track because uh there's some great food here for those who haven't been here um thank you all for being here today as we can see um I'm going to change the tact a bit we're going to talk a little less technical I know we had a couple of technical talks and more talk about a leadership level and how we as leaders and as Executives

really uh cover the challenge of telling what we need to tell much of our job has to do with um giving information providing advice asking for money um but there are a lot of challenges to that and so I'm hoping with this session today that we're going to learn a couple techniques that going to help us it's all about storytelling so of course a lot of what I'm going to talk talk about today has to do with stories so like every good Story Once Upon a Time so once upon a time for me uh for those who remember once upon a time I wasn't in cyber I was actually a street paramedic I'm from Canada uh in

Toronto particularly I spent 10 years uh on the streets of Toronto as a paramedic I spent four years as a flight paramedic flying around uh all over North America uh and uh for whatever reason I don't know what it was I ended up out of that field and into cyber security so 25 years uh more or less I I kind of started counting because it when I did it I started at one point talking about how I started cyber in the last century and that really didn't go well with my with my age topic so a lot of major corporations that I've worked for and as mentioned the last uh many years I have been uh founder and CEO of risk aware

providing services to organizations related to risk so how did we get here well um you know we are we are in a world where um a lot has changed I I honestly can tell you in the years that I have been uh engaged in cyber security A A lot has changed uh the world has become far more difficult and we're hearing that already today you probably all know that but we have new technologies we have new threat actors uh we have new methodologies we have things we never thought of before that are being being used against us to Target us and it becomes a challenge and as someone in cyber security as we know our job is to be protecting that and we

do it as best we can but there's always the new piece that emerges which is how do we tell our bosses how do we tell our leaders how do we tell our companies what cyber secur is all about and how do we get what we need we are being asked more and more by our senior leaders and by our boards on what is happening what are we doing how are we stopping it how safe are we and they always friendly but Stern could this happen to us um all of them are pieces that if you don't tell the right story um we you may run into CH into challenges either with uh conveying the right message

getting the right support uh getting the resourcing and the funding that you need and the Cayman are not immune to all of this by no means right we've seen enough we heard about and we know that uh attacks are here like they are everywhere else I don't think there's a corner of the world that has internet connection that isn't safe from the world of cyber security but we know that um it is part of our day-to-day tasks now early on very very early on in career my first story for you has to do with one of my first uh instances and how I kind of got into cyber security I went from from being a paramedic into uh into straight

it before I went into cyber security I worked for a small financial company and um we had some dbaas we ran a very large uh database with all customer information in one day they they showed it to me said Michael come over and take a look and they showed me on the screen all these accounts and how much money each of the customers had big no no we would say and they showed me how easy it would be hypothetically to change any value in this database to any number that they wanted because they had the power I found it quite fascinating I went to my boss one day I mentioned that I said we really need to do something about that

she says well do you know how I'm like uh no not really but I'm you know I'm sure we can figure that out and next thing you know I was in cyber security so that that's that's how some of us back in the day entered into this wonderful field um but um more importantly though once I got into cyber security uh I started to work for some of these large organizations and even then so we're talking about the early 2000s uh cyber security Internet Security whatever we called it back then really was not uh anywhere as sophisticated it as it is today in fact I sat in a little corner had a team of two or sorry I was part of a team of two

uh and access management password password control uh content filtering for web traffic was big and I remember having a meeting with my director of it reported into it at the time and I wanted to show him and talk about antivirus and start to talk about the stats and talk about out how we were doing with patch so I had my slides all together I started talking about it you Aus had a lot uh and then when I finished he said Michael that's great but you didn't tell me what I needed to know and I said well what was that he said how many people in the business are surfing porn that to him was the function of my

job was to tell him regularly how many people now it was an oil company there a lot of people up in up in the plants and like he didn't care about security he just wanted to have his porno report that's what he called it and so from then on every month slide two in my presentation was the top 20 people surfing porn suffice to say that is not the best story of course on how we do this but it really emphasizes kind of how we need to adjust what we do to accommodate uh the audience that we need to talk to so we know the why we already talked about it the why I want everyone to understand uh

the messaging the piece how do we get there well we first have to ask ourselves a couple questions so how do we set the scene right we need to understand what are the pain points and what is it that we want to solve and when we have these conversations how do we spark organization wide action now this one is tough because we know cyber security can be a tough cell not only up the chain but down the chain as well and how can we as Leaders transform uh abstract cyber risk to something tangible and something that's meaningful and the answer to that is storytelling so what I want want to take us through here is The Art of

Storytelling where you become the chief Storyteller officer so there are a lot of great things about storytelling and actually there's there's a lot to learn behind this there's science behind the aspect of Storytelling is a very very powerful tool that we use to engage we use to inspire and we can use to motivate uh the audience that we have the science behind it is that the scientists in their lab coats will tell you that uh the brain sensory cortex allows listeners when they're listening to a story to experience that story in a more powerful way in a more memorable way than if you just talked dollars and cents statistics data or metrics and advertisers as we know today

excuse me adver iers today have already started using storytelling in a lot of ways in how they get brand recognition out so we look at the likes of Nike Adidas Apple you look at the commercials on TV they don't put up a shoe they don't show you uh a a new iPhone they tell you the story behind the product that they want to sell and that resonates very well so I want to show uh show a a quick video here uh one of the classics um as an example of the storytelling and its impact that it had this is from Apple um if you remember back in the 80s Apple was trying to to to launch themselves become a little

more mainstream before then Apple and anybody that had an Apple computer kind of sheltered in the geek world of of um Computing um but everything changed in the super bowl of 1984 if we can show that clip today we celebrate the first glorious anniversary of the information fortification directives we have created time in Old history a garden of pure ideology where each work secure from the [Music] of yours is more powerful a weapon than any fle ory on Earth We Are One people with one will one res one cause our enemies shall T themselves to death and we them with their own [Applause] compion we shall profa on January 24th Apple computer will introduce Mac

and you'll see why 1984 won't be like 1984 so if you don't recognize that that was a they were playing on the George Orwell novel 1984 which was all about control uh this commercial played during the Super Bowl of that year uh within a hundred days uh Apple sold I just capture the 72,000 computers now this is an era where people did not have computers in their homes and this commercial this branding launched Apple into mainstream as we have today so just like last year every time I give a talk I always use a stepen cvy quote and the quote for today's presentation is begin with the end in the mind uh sorry begin with the end in mind

my apologies so how we resonate that to where we're talking about is we're storytelling and one of the key successes that I've always used when I tell stories is always start at the end and what I mean by that is you have to have a goal you have to have that ask that is at the end of your conversation what is it decide what that's going to be and then work backwards because that is going to help you paint the picture on where you want to go so what I want to share with you today all is what I kind of come up with is the storytelling framework for leaders today and most ReSound within the Cyber um

space there really are four pieces that I want us to focus on the first one is understand your audience so know who you're talking to and why and what the goal is um will lead you to some effective storytelling the second point is to be authentic now um being authentic means being the person that is truly you and sharing the good or the bad with what you want to tell them uh but saying it in an honest and truthful way not hiding and not avoiding the third one and we probably do it already today is use data and metrics but what we're going to talk about is how to use data and metrics um because a good

Storyteller uh has their pictures and has their their um points to show but we all know that we have to use it propriately and effectively if we want to get our message of caros and the last of the four points is on nurturing continuous culture and this is leveraging a shift uh through communication uh through adaptation and through uh understanding so let's dive into these so first off understanding your audience so in order to make cyber security really effective and in your stories that you're starting hopefully starting to think of is you have to be engaging and relevant to your audience it's no point going into a room of salespeople and talking nothing but cyber security stats your message will

just not get conveyed across so it's important to understand um the perspective of what you want to talk about the perspective and the the reality of the group that you're speaking to because ultimately you want to motivate them your message whether it is about um talking about what's happening or what could happen if it's about motivating them to do training or education you have to find a way to get through and one of those ways is understanding all about them so I want you to focus on uh their areas of Interest so know what really gets them riled up so use the example of Finance people what rils Finance people up well if we start talking dollars and cents

and we start talking about uh income and bottom line they love that talk um so we as cyber people have to find a way that we're going to make that our conversation match that one and we want to tailor that format uh to the story so the audience understands that and understands our preferences uh and you know again using data and metrics as one way to do that but we definitely want to tailor the story uh so that it fits that format so let me tell you another story so part of of of uh my many rolls and hats that I've worn over the many years I was in an organization that uh felt compelled that

the organization really need to go out and seek ISO certification 270 one so for those who don't know I'm sure most of you do uh ISO certification like Saku and many others is really a measurement a certification um whereby an organization can truly show to some level um what their position is related to security within the organization now for those who've gone through an ISO prep and ultimately an ISO AIT is no fun it's a lot of work it is a lot of expense but there are reasons why organizations do it so for this particular organization I knew that they were going to B at the price and the effort because it was going to take

new processes new documentation not just writing them but but enforcing them and putting them into play uh the cost of preparing for the audit and the cost of the audit itself so when I got into the room I knew that there' be some Challenge and when I entered the room we had a few people in the room instead of seeing a room full of uh leaders and decision makers instead I saw and pictured a room of parents parents with children potentially younger children and so I I crafted my story to be about that so what did I do well I started to talk about and asking them how they either in the past or or currently or

you know in the future how would they go about to choose a daycare for their preschooler and you know they they kind of looked at me and I said well you probably go out and you're going to do your research you're going to go to the dayc carees you're going to interview the child care Educators you're going to inspect the place you're going to talk to other parents you are going to do some research and you are going to come up with a decision that's going to help you pick the best daycare for your child one that you are going to trust there's a lot of responsibility for a daycare so I said turn that around now and look at

organizations that are going to look upon us I said they want our customers are going to look to to us and we were in the the business of uh selling uh selling um information uh but it it involved a lot of the information of our customers um they're going to look to us and they're going to want to know that we our company are trustworthy and they're going to want to look to us to uh ensure that we are doing everything that we are passing good reviews that we can show we can demonstrate that we are doing what we need to do to protect their data and their information I said the way we're going to do that is we

need to go get ISO service ified and the talk and the the nodding heads allowed me to realize that people understood that analogy that I'd built and understood that hey if we as an organization have this certification that we're going to have something that's going to allow us to show and prove to our customers and sure enough The Talk change from a uh a cost center and an overcost uh to an opportunity for organization so again understand your audience as I mentioned if you're talking to the finance team it's all about dollars and cents in bottom line if you're talking to salespeople it's all about Revenue uh if you're talking to uh it hey it's all about tech and

they want to have that that technology talk um but if you're talking to the boards or you're talking to those executive leaders well it's I can tell you it's going to be a mixed bag I've been in front of many many boards um but um it's all about company value value for them and and of course for them the big Conversation Piece is all about risk so I'm a big Seinfeld fan I don't know how many how many of you watch Seinfeld I still watch it I've seen all the episodes of all the DVDs uh and it's sad that I relate many things in my life to a scene that happens in a Seinfeld episode so I

wanted to share a couple minutes I think it's four minutes long of a clip from one of the uh one of the episodes uh it was called risk management listen I got to get some reading done you mind if I do this here I uh I can't concentrate in my apartment risk management yeah Stein Brandon wants everyone in the front office to get a lecture in their area of business expertise well what makes them think you're a risk management expert I guess it's on my resume

hello please hold for Elaine benis I I can't do this I can't read books anymore books on taper ruin me cherry I need that nice voice this book has my voice I hate my voice so get this book on tape you can't it's a text book excuse me I'm sorry to bother you I I I I noticed that you have a textbook on tape may may I ask where you got that reading for the blind they can get any book on table I I tell you I am hooked on these books on table don't tell me about it these things have ruined me for [Applause] real reading for the blind I take an eye test I flunk it the next thing you know

I am swinging to the sweet sounds of risk management chapter one in order to manage risk we must first understand risk how do you spot how do you avoid risk and what makes it so risky this guy sounds understand risk we must first Define hor risk has existed virtually stop it got a big problem here Jerry the tapes are worthless kind of in the middle of something here

George George I got to run anyway I can't believe you feel you really need a mentor I just need someone who can give me some kind of Direction I'll see you I see you so what what's your problem no problem and you're sure with your busy schedule you'd have time to take on a protege I'll make time because Abby I was once like you wideeye naive I didn't know the first thing about a subject is fundamental is uh risk management I'm not familiar with that you'll have to explain it to me I'll tell you what why don't you read this book and let's just see if you can explain it to me all right okay George castanza is your Mentor yeah

he's great I am learning so much about what how to calculate 5% of a restaurant check you know what your problem is you just have no respect for the Protegé Mentor relationship as a matter of fact I happen to have a Protegé of my own who I'm Mr Kenneth B B I'm going to Mentor this kid to the top hey Jerry Dan you I just stopped by to thank you that risk management stuff you wrote for me is killer it's gold Jerry gold I got all these gigs and even Cynthia took me back our next speaker is George castanza on the subject of risk

management oval

te have you ever had this stuff why do they call it oval

te you called it round teen you know what I'm talking about he's my Protegé so what do we what do we take from this story well first off George is a horrible storyteller um and that risk management is a really really dry subject um and George in this case doesn't understand his audience uh risk in this in this case is really the story right it's it's not always for for the seeso leader to talk about technology or talk about breaches risk has become that fundamental topic that seems to be resonating with many of our audiences so in this case you are the George um but you have to find a way to be able to break through in those

conversations the second point is on being authentic so what does this really mean well as I kind of mentioned already this is about being truthful being honest telling a story whether it's good or bad and being able to convey that type of information now fundamentally uh as talkers to cyber secur secur I can tell you there were times in my career when I spoke to leaders and I wasn't an authentic person I lived in the world of fear uncertainty and doubt the fud principle and that was where I as a leader would go to my uh Executives go to who I had to tell the story and impel fear upon them and doubt that if they didn't spend money if they

didn't provide another resource if they didn't get going on something that something bad would happen to our organization and those stories really really were the only way to get through uh it was a it was a shameful time I'll tell you in my in my career um but that's what you had to do you're messaging with with a uh lowc cost center and no Roi was on the negative approach that if you do not do something something bad will happen to us well I'll tell you that that is not the way that um we need to tell stories today we really need to focus on that authenticity uh and being truthful versus trying the scare tactics of the

past we also have to focus on um not being denial not being uh living in a world of rose-colored glasses but really talking about where we are what is happening and sometimes that involves telling stories that are good and sometimes those involve telling stories that are not so good I find as a leader a lot of it has to be with being yourself and being vulnerable even at times to show that something can happen um but the key thing and what resonates with your audience when you're telling stories is your honesty uh your relatability and having a story that says that maybe things are okay but they could be better if we go back oops did I

go the wrong way there we go if we go back to this slide um which I showed earlier we can look where any of these stories we could use that fud principle pretty well we could set a GL Doom and Gloom here on the islands on what is happening and what could be uh and tell a story and show these stories on a negative approach uh as to uh fundamentally what's happening to cyber security on the island but I would I would argue that these actually can be used uh effectively and more positively um because any one of these stories could speak to the capabilities of uh of our institutions our government and our organizations on this island we

could speak to the success stories that have been had and John mentioned that um in his talk with the with the attack earlier this year uh on the on the government infrastructure um and so we need to take the positives if we're going to use stories like this uh and share them um in a way that's going to resonate with our people exposure can be a Str for us and we really want to use that uh in uh our dialogue as we think of the thinking of the end to where we want to go in our story um I've lived through many cyber attacks through my career uh many of them have been dos attacks I know

Michelle talked about uh the huge attacks that we have uh I remember one of the attacks that I had brought down a critical web application that we had uh in our organization and we were having a really tough time in combating it we just didn't have the tools the cloud flares did not exist in the time uh and um the um CIO came over and he asked me he said you know is this going to stop soon and my answer to him wasn't of course it will or yes sir we are right on it my my answer to him my story was I don't know I don't know when this is going to stop I don't know if we can

ever get it to stop but we're trying our best we're using our tools we've engaged with our service providers the telecoms are involved we are doing everything that we can and those were the stories that made the CIO leave me alone for the next couple hours and you know luckily in this case uh the attack stopped and then we were able to put in some controls thereafter I think I missed a slide sorry yeah Okay the third piece I want to talk about is uh data metrics so as I mentioned we all use it I use data and metrics almost every single day in my career now it's great way of of telling a story um but the key to using data

metrics of course is that you need it to support your narrative not to be your narrative um you need to still Create and Craft that compelling story uh and you need to inject the information and inject those samples where you can gone are the days I think of just throwing up a slide full of data points a slide of bar graphs and showing uh monthly reports month over month of of how we are doing with our patching scenarios how we are doing with training because when we show those slides at every board meeting or at every uh meeting with the executive the message will get lost very very quickly because it becomes very very hard to understand what it says and

and what it means to say so I used to have slides like that again a long career before the world of Storytelling came clear to me I once had slides and the two of the key slides that I would show was that kind of line graph with antivirus stats and you know we'd show you know what percentage of our systems were patched and then one month we we had uh a number that suddenly there was a dip and of course it caught the eye of um you know my boss and they're like why is this down does this mean that we are now ineffectively doing our job I'm well no we had a little glitch there's a little bug we

didn't report for a few days so it didn't show well you can argue that's a good thing or it's a bad thing it's bad because I'm showing bad stats but it was good because at least I got him to ask the question but the momentum was lost in terms of what I was trying to tell the next month I showed a different slide and this one was on uh antivirus and we saw a a surge in quarantined items and again my boss said what is this does this mean we're having more attacks are we in trouble now I said well no it was a really busy month and we actually saw more attacks than we

typically do this Spike on our little on our little bar grass um but I said everything's okay uh and it led to a conversation about the the highs and lows of attacks on our organization how you know following that we were able to show that the quarantine was was effective and it was kind of meeting the lines of of the the level of viruses that we had so the viruses were actually getting quarantined versus not getting quarantined and ending up on the machines but it really was uh a stat that I really didn't like showing because in its raw form it was very ineffective and it was telling the wrong story so what I suggest is

consider losing the old style of of slides of just metrics and stats and start focusing a little more on the visualization of your storytelling because those visual effects uh really can play that important role in what you're your your story that you're telling remember you want it to be part of your story not be a replacement of your story um but really can help again with the retention capabilities and the relatability relatability of it remember it's one thing to talk about metrics it's another to show them so this is not a class on good metrics versus bad metrics we could do a whole session on that but these are the type of stats that would just cringe

at now I mean we have bar graphs that you can't tell what's good and bad we have pie charts that are you know numerical versus percentages how is anybody supposed to understand that let alone want to understand what cyber security is so we need to move away from that and have compelling information for us we need them as I mentioned to complement our story they need to to assist and answer the questions that we want answered or uh at the very least the questions that we want them to ask of us uh so we want to be prepared we want to build those out and we want to show them now again this is just an an

example I'm not going to break it down but here very much metrics and slides that talk about risk talk about risk to organization talk about risk around the organization talking about maturity excuse me and to talk about stuff that for your audience depending on who they are they will get a bit better grasp than just showing the where we've been and where we need to go all of these types of conversations or sorry these type of metrics can lead to those conversations that you want to have to lead to that need for uh uh more uh resourcing or funding or approving a budget for something to do um and it's it's Paramount that again that we show

those metrics versus just standing and um talking numbers to to your organization the last point that I want to talk about is on nurturing continuous culture now culture uh has always been a part of story telling because it really um cultures have always used storytelling as a a shared sense of responsibility of accountability uh of belonging and a connection to the bigger purpose that we have it really is part of understanding the broader sense of responsibility uh that uh cyber security has in the broader case of your organization or the audience that you want to talk to you need to show that cyber security is not an island and you definitely need to show that it is not

the only island in the world that we want to talk about it's important that you understand and that you can convey that cyber security uh fits into the business at hand you have to convey as that leader that you understand what that business is and that you are part of the solution versus the the challenge that goes through there that is going to stop uh or potentially disrupt that business from doing what it has to do so you want to build your storytelling build your cyber security into um the pieces that will enable you to inject cyber security into the broader piece so what do I mean by that well when you're talking always make sure that

they understand that you understand why you're in business uh I worked for a uh a ve the largest grocery chain uh retailer in Canada and I of course talk cyber security and I remember some point in my career uh the CEO uh talked to a group of us and he said do do you know what we do everyone said well we sell groceries and we distribute food he says we sell tomatoes that is what we do we sell Tomatoes why he would say that I didn't understand but it made me through reflection understand that I needed to to resonate to the CEO be able to inject where cyber security fit in the storyline of tomatoes and that is not

necessarily an easy thing but a lot of my conversations became about supply chain on getting tomatoes to market the ability to ensure that the distribution wasn't impacted by a Cyber attack that would prevent uh the the tomatoes from making it to the stores talked about iot attacks and distribution and Refrigeration of those tomatoes and you know those were the T the ways that my piece fit into the culture of that particular organization so the last story I want to tell you today uh is something that probably all of you are are very familiar with in the challenges of what we do our job and we've talked about it already and heard about it is on

awarness so when we talk about culture we have to be very clear that that our talk isn't always upwards our point of being a Storyteller isn't always going up the chain and convincing our leaders and our decision makers it's always going to be a two-way street and that also means downwards talking to our customers our employees and our staff and one of the ways of course that we have to do that in our jobs as uh security practitioners often is on security awareness and on uh helping the organization so with cultures of a finance company or a grocery retailer or a pharmaceutical what whatever your organization is uh you have to understand that everybody in that

organization has a job everybody has something that is why they're there why they're getting paid and they have accountability and responsibility in there and it's not easy to come in and just start talking about cyber security say hey you need to take training you know everything hinges on you you are the weakest link it's it's blah blah that they don't want want to hear so instead we have to take an approach of the concept of it takes a village to protect your organization so how I tackled that in in uh my organization and and of you subsequently is to really start to leverage where cyber security fits in everyone's job and the only way to

understand that is to go talk to people talking embedding yourself and your team and the concept of uh cyber security within those groups talking to the sales teams the distribution teams the finance teams the marketing teams whatever pieces of the organization is getting down and speaking with them getting to understand what their world is and then making it relatable to what they do so your relation to marketing is on you know where social engineering and social media you know can impact Marketing in a negative way and the importance of those teams to understand that and craft their dialogue and protect their platforms so that that can happen it's about going and talking to people uh in the

warehouses on on the need for them to even in a in a a a limited capacity of of you know dealing with email and the like they still have to be mindful that when they do do things that you know they don't have as much exposure so taking the training is more Paramount than ever because it really keys in on key things that they may not see often but they suddenly see in in the times that they work the village becomes the organization you are just that person that helps within that Village but in this case it is everyone in the organization as we talk about it takes the whole organization in order to to

deal with cyber threats we know that it just doesn't start and end with you as a practitioner um but you need everybody to be a part of that so we need to change the storylines you need to think about how you're going to convey your messages both up and down how you're going to convey your messages how are you're going to tell your next story line there's a lot of and error on it I can tell you that as I said I've had a lot of failures in my messaging through my career um but what resonates now is that ability to be be uh understanding of your audience uh to be authentic to use effective uh metrics

and data and to work uh within the continuous culture of your organization so some final thoughts so remember that when you're talking um you can't just talk about cyber security I know we need to talk about cyber security it is part of our job to be embedded in the notion of cyber security but we cannot have conversations that are only about ourselves we have to go beyond that we need to lead our stories with conviction with Clarity with unity and with inspiration we have to be able to tell that story in a way that is going to want them to listen in a way that's going to get them to understand and it's a way that you're going to get

to the end and that end being either uh an ask for something a support for something or just Clarity and and um relativity to to the people in the room as it is to your conversation humanizing all of this is very big to that again being reflective you're not Superman Wonder Woman you know you are just another piece of that Cog but your accountability is for cyber security um but it relates to every other journey within your organization and if you become effective at this and you start telling these stories well you will get heard you will start to get understood uh and you will uh start to get through to your audience and start

to see some results so key thing as you as that Storyteller of course is on trust uh we're not talking about zero trust or trusted networks we're talking about the trust as as a human um and that value that's going to resonate if your audience can trust you if they can have confidence in you if they can can relate to you and have some level of respect and understanding your messaging those neuroscientists are going to be right you are going to be able to get through and have that audience understand the message that you want to say uh Beyond just the the point fact uh deliverable that you want to have in your message so my question then

for you as we close off then is what will be your story and how will you as you take away kind of be your messaging going forward so I hope all this helped I hope it is informative thank you for listening anyone have any questions I know your tummies are growling so everyone's like if I put up my hand it's going to delay us getting to the warm food very good thanks everybody enjoy your lunch

okay just just a quick bit of administration for you thank you very much for the presentation only quibble I'll have is it's tomato not tomato just as a matter of policy fair enough