HG - Failing Upwards: How to Rise in Cybersecurity by finding (and exploiting) your weaknesses

hi everyone so thank you for coming to this particular talk on this particular day um we're going to talk about failing upwards today and the fun part about it is um this is I think still the only presentation of its sort um I did a weird amount of research on the subject and when I did this weird amount of research on the subject I realized there are no other presentations on it so um here you are so how to rise in cyber secur by finding and exploiting your weakness let's dive in shall we first Who Am that's a really good question random person so my name is Wes hi oh I got waves oh my God thank you okay so I am currently living in Canada I am not Canadian um I I move around a lot though uh previously in the Netherlands Japan China USA Belgium New Zealand um I keep moving around um I don't have a good reason for this I just keep doing it um so there's that what I do uh so I'm currently the Chief Information and intelligence officer it's a really long set of words I gave myself I have to type this in every time I do a survey all those words it's terrible um I'm also a data privacy Advocate I'm a hacker professionally and personally I also am a runner a gamer I walk around the world sometimes and I'm also I need to talk near the microphone and uh and I'm also a hacker in my free time what's that oh don't don't don't encourage me don't encourage me I'm going to walk around and it's just going to be awkward for everybody thank you though um but why am I like this that's a good question also so I I like Puzzles and I seek novelty I think we all can relate to this that's pretty much me also anxiety lots of that um but before we start before we kick into this for real um just want to start off with some some basic level setting we're going to start with the formatting today we're going to talk about failing upwards we're going to clarify what that means and then I'm going to tell you my story it's going to be story time I'm really sorry about that we have to suffer that pitch here's my pitch um um and we're going to set some scenery we're going to like understand like what the situation needs to be and then we're going to go through the steps on how to actually fail upwards uh when we're done with all that I'm going to give you some final advice and uh hopefully we're all going to be failures very soon um some assumptions to before we begin I'm assuming that if you're here you want to get ahead you want a better job a higher paying job a higher more responsibility something to that effect um I'm also assuming that you know what kind of job want to have and you currently don't I'm also going to assume that you have some basic understanding of what that job actually is like you're not trying to break into rocket science for argument sake um I'm also assuming that you're willing to get weird about it you're willing to get awkward about it get uncomfortable with it because that's kind of how it works um and some disclaimers before I begin any of these words um your mileage may your mileage will vary uh because your journey is going to be different from mine it's just going to be weird for you it's going to like it was weird for for me uh but how it's weird is up to you um and also I see my privilege I understand that I am CIS male certain height certain build that's going to affect how I succeeded or failed in this context um however the reason why I'm talking about this because I have several friends in uh gender and ethnic minority Spa spaces that have done this too so I've seen it work for others which is why it's not just my story it's actually just my example and um that said little bit of warning this looks easy and is hard it is actually really tricky to stick the landing on this however however ideally it's also fun because if you treat it like a game then it's going to then it's going to be fun it's going to give you that Charisma and confidence to do it correctly and that's what's going to sell it so it's going to be hard fun if that makes sense yeah okay cool now I'm not touching cables but I'm going to push the button there we go let's start with failing upwards what does that even mean if you if you just Google the term failing upwards what you're going to get is variations of to advance in one's career despite failure um that's that's not failing upwards that's career resilience that's different I mean that's important too don't going be wrong but it's not what we're talking about today what failing upwards is is different um but why what why would you fail upwards I mean like first I'm failing upwards in this context is um have you ever just had like a really really mediocre boss like a guy is like how did you get here you're you're you're almost bad at this you're you're you're forgettable best yeah that's what we're going to do today we're going to get you in that space where you are that guy you are that person um congratulations you're all about to be very mediocre very successful so but why would you do that why would you choose this path instead of just working hard well that's the bad news and the good news um you may want to advance your career just because you want more money want more want more responsibility maybe maybe more ownership these are all good reasons but why you would do it just in general good employees don't usually get promoted they just don't I mean maybe a pay raise maybe some benefits extra PTO you're not going to get a promotion out of good work you just won't there's no reason for that we're going to get to why um and also uh if you're looking to like get a manager's job for argument sake um look up a job description for a manager can anyone tell me what a manager does like practically like I am one but like I'm just curious what what do you guys think what does a manager actually do skills what are emails emails emails good what else meetings emails meetings what else yeah yeah there's a lot of things that you could do like in this room right now and be a manager it's like literally the there's no technical skills to this there's no there's no degree for this you know there's I it's like it's like Ken and and his job is Beach you know it's like that so that so how do you become a manager you fail at it and that's how you succeed at it anyway how does it work how does the actual mechanics of it work we're we go into the details of how it works mechanically but here's just an overview we're going to talk about counter signaling uh we're talk about bias for Action we're going to talk about cronyism that's the exploit in this context is the cronyism and then we're going to talk about this the three out of the six principles of influence any social engineers in the room of course you wouldn't raise your hands oh there's one there's one okay there's always one it's always it's usually one usually the one who's more or less fashion there we go um but anyway these are all like psychological and social situations that we literally can't escape we are all subject to this whether we like it or not that's how we're wired so that's how we're going to make it work for us but first how realistic is this actually well here's some examples 10 years apart um failing upwards is not just a really common side effect of the business of the business world but it's also just like it's been around since the Industrial Age it's probably been around since since time and memorial for kings and queens um so suffice to say everyone's looking for a solution because they keep having these mediocre managers um but why not why not make it work for you instead of working instead of having work against you right so yeah it's real but here's the here's the here's the part I'm going to try to get through pretty quickly because frankly this is not why you're here at least I hope it's not because it's a very dull life but let's talk about how I got into this space and they'll kind of give you context and maybe some examples you can draw back to so first real buzz buzz through what who I am as a child um geek stuff I basically was the AV person in my house I wired VCRs and broke TVs um and game Genies game Sharks any fans of breaking games yeah there's a few of those in the room uh teenagers martial arts more geek stuff and also Robotics and social engineering I picked up I I competed with robotics and and uh you seeing some patterns here that I didn't see by the way cuz in the College Years I couldn't quite figure out what to do but so I was jail breaking phones and writing cyberpunk novels uh very successful clearly um and then early career I was just I was doing basic retail and Hospitality as we all kind of have right and and then every job I had it's like hey Wes can probably fix that um and yeah I did but I never once figured out that I probably should pick up Tech as a as a field like it never occurred to me for some reason um yeah so then you actually get to the point where I actually do realize I want to do this stuff so I moved to China pick up technical pre-sales job kind of got my first kind of technical job um and I go back and forth from in Japan a lot and um I was Shadow it at every company I was that guy right so um but at a certain point at a certain point that's actually I I started to make that an actual job and so I picked up a basic it job and a pattern you're going to if you if you've known me for like five minutes you're going to recognize this and that is that um that that feeling like you you have these things that are wrong around you and you have to know no one else is fixing it so clearly you fix it right like you can't just let this be a bad situation you got to like manage that so course as an IT person I don't hold still I pick up systems Administration I pick up risk management I pick up data center management um D Center Administration project management I did all these crazy ass part my language um and then I burnt out learn out learn lesson from that is um just bit of advice if you are about to burn out it's because you're still holding on to too many things so just let some of it go that should help doesn't solve it but it helps so it's the the pattern here is basically going to be that I keep doing all this work that isn't actually my job and then I keep getting tired that's going to be the pattern here so I do that again only this time I do it in the United States for a while uh Cloud systems administrator site reliability work um a little bit of infect work and here's where it actually here's where I actually got into security is this job right here I was basically just really tired and also mediocre I I was like I am unexceptional as a man as an engineer I'm like truly like a beige pants suit of a man of an engineer you can like walk right past me and not know what I did and so but I'm also like tired and doing all these things I don't I'm not supposed to so they're like hey you know what why don't you just you look tired you look tired why don't you just go do that web application firewall for us cuz no one wants that why you just do that and so that's how I got my start in security is doing the the thing that I was I was supposed to do so um because I was not great at the main job so that's how kind of I broke into security um so that said here's the actual pivot that we're going to talk about today this is the actual important part so so I start off with doing some plat so I moved to the Netherlands in 2016 no particular reason 2016 was a good year to move away from the United States no specific reason at all um and and uh yeah then at that point I'm like that's my actual first named role is in security engineer and while I'm doing this job uh I realize that there is no Security State to engineer on there is no platform there's no tooling there's no Services there's nothing so it became my job because again why would it be someone else's job when you know it could just be mine so I build an infrastructure out of it I build a service state out of it I you know I organize the tools I set things up I have a lot of help because I'm a mediocre engineer right so um I organize all the policies I organize all the governance and all I I I build like an entire thing and I was really happy and then uh the new ceso comes in is like hey you look tired would you like a you like a slightly easier job where you just write the policies and do the governance on its own and so that's how I broke into an information security officer role is again doing work I wasn't supposed to and and apparently I was better at that than the job I was actually doing so there's a pattern here right and then from from there it gets really boring this is basically once you're management you're management you just go to another job it's just just ask and you'll get another one it's it's it's that's that's less interesting but I but at that point I'm like I keep getting tired and doing the work of someone else and then wind up doing that job instead and then getting a job out of that job and so I did that like three more times I'm not a CSO anymore actually I think it's a different title now but anyway um and then I moved to Canada long story short so that's the journey let's talk about the actual subject matter though there's this there's a story here and the story is not actually how I how I move around or why I'm like this the story is I keep getting tired in getting a new job so let's talk about that failing upwards how does it actually work let's talk about the psychology for a second that's probably the most interesting to me personally counter signaling so when I say counter signaling what I'm talking about is is like think of think like a humble brag right it's like it's like you're saying something negative to indicate a positive or something positive to indicate a negative that's one of the key factors on this process um we're we're going to talk about how it connects as we get to the actual steps but that's like one of the things of how it works mechanically on on failing upwards it's going to be a combination of this and bias for Action so um I'm I'm like a huge moving nerd and Bruce Willis is I'm going to say demigod level to me give or take not anymore not anymore God but like back in the ' 80s when he was like on his game by for Action he is like Bruce Willis is actively bad at at getting the job done he like Falls he breaks stuff he like messes around he like like stuff happens in this movie that's new to action movies in 1980s right bias for Action means that you're going to be happy that he's trying regardless whether he's successful or not that's what we're going to do as well um cronyism though so cronyism is a negative and it's but we're going to make it work for us cronyism in this context is the idea that it's a it's a circle that you're not a member of or that you are a member of and others are not so it's exclusive that's the point is it's exclusivity it sucks but we're going to exploit it how how it exploits is interesting basically if you treat this like a if you treat this like an attack surface then it becomes a different conversation entirely if you look at it as cronyism is a circle of trust so circles equal trust equals bias if you're inside the circle you have a natural bias for something inside the circle um example if you take your friend and you take a person next to to your friend and they're like identical in every way let's call them twins but one of them you like one of them you don't you're going to you're going to naturally trust and relate to the one you like more than the one you don't even though they are literally the same person just you know one one you know one you don't so if you consider in that sense biases are completely unconscious and we can't stop it we can't not be biased right so the exploit is this trust is an expression of time and exposure right so what you do is you just need to you just need to have a force multiplier on either the time or the exposure or both and that reduces the the amount that and that actually gets you inside that Circle that's it's a lot it's it's a little more complicated than new once but that's effectively what it boils down to but here's the part that's really interesting is the um the there's a book called uh the six principles of influence it's a very popular book for the social engineering crowd and it's actually just a good book to read in general but what they do is they cover like six six ways to Influence People reciprocity is the idea where you give get something and you'll and you'll want to give in return um so we all go grocery shopping and we walk down the store right and someone's giving away granola bars or something to that effect and you take a granola bar and uh you do not buy it you do not I mean like there there's naturally there's going to be some psychopath who like makes a conversation with this poor person who's giving out granola bars that person's weird right no one's like no one no one like sits down and has a 5minute heart-to- heart with a person giving way the granola bars but what we do even if we don't buy the granola bars we we at least say thank you we look them in the eye and we make at least a a general gesture of General gesture of thank you you know unless you're a different sort of psychopath but point is is that you can't not respond if you're given something you just can't it's just n Nate human nature and then social proof is another factor in this um so you know there's always that that that one person who like crosses the the street before everyone else does and then everyone else starts to follow them it's like that so uh there's always one of those people and that's that's what we're going to talk about here as well is the social proof is if you get if anyone approves that is the approval of all and then the last thing and I I really wish I could put more time on this because that would be its own talk entirely and that's being car that's being likable um if you're generally a dislikable person this is not going to work for you you've got to you've got to be um you've got to work on your work on your confidence and your and your charisma to make this happen um I can give tips on that but the short version is that that's a really critical part as well that all said that's how it mechanically works as a combination of these uh psychological and social factors um so that said oh by the way um I will give this presentation to anyone who wants it so don't worry about taking notes um there's a lot on the slide sorry for that that said let's set the scene so when we when I'm talking about the the circumstances in which you fail upward you're looking for two specific situations you're looking for the energies of these two people I told you I'm a movie nerd here we go we're talking about Buzz Light your first start falling with style um so Buzz Lightyear not sure who remembers 1995 uh very well I I personally don't but it's uh he like Buzz Lightyear he like Woody challenges him like you can't fly he's like yes I can and he jumps off a bed bounces on things F you know sails around on a swing and sticks the landing and he says yeah you didn't you didn't fly you fell with style that's what we're looking for we're looking for falling with style bold confident and in and B bold confident and incompetent that's the that's one of the energies we're channeling second one Peter Gibbons from Office Space um now I had to be really clear about this don't do crimes um I mean like this is a really good example just only for the first 10 minutes so if you really want to commit crimes I can't help you with that but I can tell you the first 10 minutes though actually I can help you but just I won't I um Peter Gibbons is the energy we're looking for in the first 10 minutes he basically goes through some life changes and then has a breakdown in the office stops working breaks drops his cubicle walls and they and