Blue Teams next tool: Social Engineering (Psychology and Sociology at Work)

besides DC would like to thank all of our sponsors and a special thank you to all of our speakers volunteers and organizers for making 2018 Red Team activity to information for potentially the good side and how to convince or helping people to good security decisions I want to talk a little bit about me just to give you some background very technical geek introvert but through all the work I've done that points have this interest in how humans languages people interact with their technology most are so evil that was taking Computer Engineering and doing electronic circuits good programming I also have always made sure to take time to do like people in social issues in the

Union or sociology because I was felt that it was important to understand how people deal with computers and how people deal with technology because don't kind of look at that aspect of it we're kind of going we're always going to fail at how we develop technology you know now we've got UX developers and we've got a lot of specialists that are looking at how we can make the technology work for them but we also need to do a lot more with that the security space as well and one aspect of that is you know actually talking about teams to get them to do security things so what talk a little bit about how attackers new social yeah we know the

techies you social engineering to manipulate how people respond to things they look at how can they talk someone into divulging a piece of information or how can they craft an email that convinces someone to click on a link tissues like social engineering is really just another aspect of sales so when you're when you're looking at these social engineers they're not doing stuff that hasn't we have a new cool term for social engineering but we've been doing social engineering for pretty much as long as humans have interacted with each other and it's just a matter of how we use those exact same tool that red team is now leveraging for you know doing testing into ballistas actors are using

to gain access to your systems but it's all about how you interact with those people and really can when you get down to it how do you sell something to two people so if you find a really good sales person that's a great personal learn from for social engineering because they're going to use the exact same kind of tools and techniques I'm going to talk about in this talk they just kind of either naturally came across it or as they've learned how to make that sale how to talk someone to find something that they didn't necessarily need or even finding out what that person needs to buy so that they are happier person come back and later these are all just

social engineering techniques they're just in the leverage in a different way instead of being leveraged as an attacker they may be leveraged and for defense it's all about breaking down those barriers adversaries it's all about gaining false trust for a defender it's about gaining true trust so the idea is that you're trying to make these people to understand that you are trying to help them so if you're a blue team and you're trying to get teams to patch something or you're trying to get teams to make that choice that maybe is a more expensive or more expensive pathetic or requires delaying the gratification of making this big win you need to get them to trust you just the same way as an

attacker needs to figure out a way to get you to trust their email or trust them walking in the door with or trust that whatever they're telling you over the phone to gain access to your could you reset my account or something it's all about figuring out a way to gain that trust with those people so when you're looking at this it's again the defensive side is the exact same teach techniques that we're going to use for gaining unauthorized access to gain that authorized access with people it's all about working through finding out what they know what they need what relations you have with them how to leverage those relations and part of that and this is

one of the kind of fundamental building blocks you see this both in attack of social engineering red teaming social engineering is learning how to interact with my crystal science within organizations so one of the things you need to do when you're trying to work with trying to interact with another so in my role I'm primarily security consultant within our company so a lot of time I have to go out there and try to interact with varying technical teams or maybe business teams or you know it can be a range of different levels of technology versus business knowledge if I just walk into those not knowing what I want into I'm going to be an outsider

I'm not going to speak their language I'm not going to their 12 terms I'm not going to be one of them so our involves some distrust with them so going back to that building the trust before you interact with people you have to understand that they formed micro societies so this might be looking at what terms did they use within their group you know other technical terms they use their shorthand terms that they use when you look at like a malicious social engineer for example you know if you read almost them what Kevin Denning stuff you know when he was attacking the phone companies he spent a lot of time learning what was the language the phone

company reps use what were the terms that they use to you know if they need to get a phone number did they say and a phone number and there's a hand the digit of this relay station or something like that he learned the language that they used within their group when your blue team and you're going out trying to interact with other organization the organization you need to do the same that you need to learn these other languages that they use because you establish that common language with them you become more trustworthy not just something walking in there going hey do this you're walking in and saying hey you know that someone stole of your

worse yeah we need to do this to it so that it accomplishes this and it's all spoken in the language that they understand and it seems really simple and it seems there's something very basic but that is social engineering that is one of those first steps of it is learning the terminology and the language of your target so that you can become part of that group you can join that micro society and you become more trustworthy so this goes into more of the know your audience and understand the target you know anytime a red team organization it is a red team or as a way to block this red teamers and they're kind of friends of mine but

this really is the same thing as the malicious attackers review some social engineering when they never a point even start an operation against someone they're gonna go in and they're going to do lots of research they want to find out everything so it's not just the language that they're doing so that there's more like the micro society they're trying to get to but they're using things like they're trying to find out all the tools they use they're trying to find out that work structure they're trying now you know even to the point of where they go on vacation and what kind of you know side things and what are their hobbies they want to know every little

bit because all of that information helps give them more leverage than ever they start interacting as people know what they do who they are and why they do it are important aspects of what we want to try to do our blue team's our solution here it's the same thing it's knowing all these little aspects so that when you get into conversations with them and I'll talk a little bit about another kind of tool that leverages some of this information but when you go in there and you have five minutes before meeting starts there's small talk that's small runs more smoothly when you know stuff about them and you can talk to them and you start doing things that

I'm going to talk about later like pre loading and framing the conversation where you're setting up before you even really get into the meat of the discussion again you're setting up for success by getting into the heads more or less of these individuals in a way that they become comfortable with it so one of the kind of more psychological type things is we look at what's called communication modeling so again this is more the prep work that you do beforehand it's taking a look at the very components of how you are communicating with the people you're going to communicate and it doesn't matter whether this is a via email or a presentation or your meeting you know an

in-person discussion our phone call these components always are consistent in all of them you have a source or sender ie you you have a channel how it's being communicated the message what is being communicated receiver the person that you want to send this to or get make them receive the message and feedback I what is the result after these people receive that message each one of these play on the other and play an important part of how you're going to be communicating with them when you're prepping for a meeting or you are preparing to even craft an email to ask of something you can use this model to kind of build out a more successful

communication so you can start by looking at your feedback which really you can think of as what is the goal what are you trying to get that person to do what do you want them to do so you start off thinking okay this is what my goal is you know who am i sending this to so is this going to a VP or is this going to assist admin thinking of who that language is going to have to speak to then figuring out the message based on who that's going to so is it going to be a very technical message is it going to me a more high-level message the channel figuring out how an individual

best communicates so this isn't how you necessarily best communicates with someone but how someone else best communicates so sending an email to someone who never checks their email is not going to do you much good but if they love doing text messages and sending them a carefully crafted text message is going to set you up for a much higher chance of success so understanding what channel you are going to use is going to be very important and then of course the source sender it's making sure that you are representing what you want to be represented if you want to be representing yourself as a technical person make sure you understand that technical side of it if

you are representing at a higher level make sure you understand that you don't want to false repens and false representation unlike red team attackers or our malicious attackers as a blue team err we don't get the option of doing our attack and then never having to deal with that person ever again you are going to have to post actually talk to that person again so we never want to do something that is going to set us up for future failure we don't get to lie we don't get to fib we have to stick to the facts we have to represent ourselves accurately so making sure that you as a source or sender are accurately representing your

capabilities is very important and this is more not just for success for this initial communication but also making sure that you haven't handicapped yourself at later communications so another tool that the that's available to us is elicitation this is all about how we get information from people this is about being natural and informed so when you go into a conversation you don't want to be you don't want to seem like you are trying to get something you want to be someone who's trying to work with them or you want to have a relaxed this is all part of us all working together you don't want to just walk in and go hey we got to do this you don't

have any choice let's get it done now even if they are required to do something you start a conversation like that and they will find ways to slow down the entire process so in the end you may get what you want but it may not be when you want and again you've probably already set yourself up for future problems as you've already kind of framed your future interaction with them and a negative light so being natural informed helps you walk in confident but not in a forceful kind of way pre-loading which I kind of talked about a little bit earlier is how do you get them prepared for those conversations a little earlier so maybe

you know that you're gonna be having a meeting later on with these individuals on some requests for some kind of you know I they need to deploy a new tool because the current tool they have has an exploit in it so you know it's gonna be a lot of work on them so beforehand earlier in that day you might reach out and say hey how many systems do you think something like this is going to affect what are your current loads like what are you currently working on you start getting them thinking about what the work is without actually making the request of the work how can you basically smooth that later conversation by already getting them in that that pre

position of doing the work it's like okay they've already started thinking about doing this work they already know they're going to you know these are the things they're going to have to do and now you also because of these conversations have gathered additional Intel on your target that you can then apply when you're having those discussions later on with them and have that face-to-face meeting so you're not going into a blind meeting you're going into it with the target already pre-loaded thinking about the issues as well as already having gathered information to help feed your own conversation with them and then there's managed questions so this is the idea of how you best used open-ended

closed-ended leading an assumptive questions so when you go in there if you are looking if you don't know necessarily what you're trying to find out you want to leverage open-ended questions so these are questions that leave the individual a lot of room to kind of ramble their answer to you in the hopes that you may gather more additional information you can then follow up those open-ended questions with what's a closed-ended question which is something where you ask for a very specific you're asking to get a very specific answer you have an idea of what you want and you're going to ask them a question doesn't give them a la leeway about what how they answer it

leading an assumptive questions are very similar where we kind of already know what the answer is but we want to confirm the answer so we kind of lead them to the answer that we're waiting to hear from them and it helps us verify information that we believe we have again these are all techniques that you know if if you're you know if if you're a malicious actor you're going to be using these questions to help gather your Intel and your aim form a and hopefully work through you know getting whatever additional access that you need that you don't necessarily normally have but we can use them again from a blue team perspective of leading through the process of getting people to

do what they may not necessarily normally want to do they may need to know that they need to do it but this will at least make them more confident in what you're asking them to do so then we get into a few more psychological discussions so this the ideas of modes of thinking and the senses so modes of thinking is very closely tied to the senses of humans so we've got sight hearing touch smell taste two of those sentences sight and hearing are very important when we talk about modes of thinking of how people think about stuff for example so a visual thinker is someone who likes to have an image in their head or when they see something

that reminds them of something later on this might be some someone that when you're in a conversation and they go hey I see what you mean or yeah I got I got a picture of what you're trying to describe they're going to use words and they're going to use memory techniques they're associated with visual clues you have then the hearing or the auditory thinkers who are going to be the people who kind of say you know when you tell them something they'll say I hear what you are saying or does this sound clear to you these are people who are going to associate different thoughts and memories with what they're hearing and what their ears are helping them process

and then you've got kind of a mismatch of those other senses that touch smell taste and also you can think of it like brain the cadets kinesthetic or feeling mode of thinking these are people who they associate some kind of touch or emotion or or something tangible with their mode of thinking so they might say do you feel this works they might be someone who when they're wearing their conversations they'll you know give you a tap on your arm going do you understand this or do you get this their way of interacting and thinking of things is to attach you know a feel to it now these are important because when you're interacting with people people

are going to fall into these categories and if you want to be more successful in how you're having that conversation with them or how you're communicating with them you want to understand what mode of thinking that individual is now part of figuring that out is listening to how they talk so again when you're kind of going into a meeting and it's a little bit early you might be able to have some conversations with them again you've done some background research on them so you already know some of the things that they're already dealing with but then they're their division or their office so you might say you know talk about well yeah I've heard you've had some

challenges rolling this out you know talk a little bit on that you know kind of you know buddy-buddy kind of conversations listening to how they describe the situation they're dealing with are they saying you know yeah we're just just not feeling this is rolling out correctly or you know we've had a really hard time trying to visualize the architecture of this you can listen for those key words and then those are once you kind of have a better idea of whether they are a visual auditory or a feeling thinker you can then tailor your mode of communication so if you walked in with a whole bunch of slides that have lots and lots of pictures but

you're talking to someone who's an auditory thinker you don't want to dwell on the pictures as much as you want to dwell on what you are describing to them and what how you're talking to them and have those interactive conversations because those interactive conversations of things that are going to stick in their head they'll think about later the same thing with a feeling person is you're gonna have to figure out how to make it more interactive with them how do you bring them out it's a little bit more difficult at least for me when dealing with feeling type people because I'm always being an introvert I tend not to like touching people that much or really

kind of getting in people's clothes close base but you can work with things things that are tactile for them so if you have even something as simple as a piece of paper that they can hand around and touch and hold that becomes a physical object that is now a feeling that they've seen so the picture that may be on that now becomes a physical object to them because they have felt it with their hands they have they've had a individual interaction with that you know you can often see kind of those feeling people because they're the ones that will almost always print out stuff because they work better with paper because they have something physical in

their hand that they're flipping through and it helps it stick in their head so figuring out how people think is very important and you leverage those other school tools that we talked about already to stack on to that so that you get your pre-loading and you have those early conversations and you start understanding how they think so that you can then create material thinking about your goals and your feedback and your channel and your message so that you can then tailor it to the way that they think the way that they interact their technical level their structural levels all these little tools that we're talking through all kind of start stacking and building on each other and

it's all about how we tailor our communication to get the reaction out of the people that we're interacting with they may normally have been a little bit more reserved coming up to talk about security because they know oh securities of they're gonna cause me problems they're gonna ask me to do a whole bunch of stuff I don't want to do we want to avoid that and leverage these tools so that we can work around that we start having those conversations at their level we start talking about the things they are interested in and that way we're no longer necessarily those Outsiders we've joined that micro society we're now communicating in the way that they best understand in their

brain we've now figured out how to work around that blockage so that they're not looking at us as that outsider another part of this is framing the conversations so we go back to talking about the people who enter you know when you when you first go into the meeting you need to kind of figure out ways to start the meeting off in a and a you know positive light as well as how you communicate things so that they come out as a positive light so if you go what a great example of framing would be something like if you walk into a conversation and go 25% of your systems are unpatched and this is not going to

work and we're going to have a lot of problems and I got it you gotta get on this you're not doing good 25% is unacceptable you've already set yourself up as an adversary to them but using the other side of those numbers all right you've accomplished 75% Patchett we're on a good start but we gotta get to the rest of the thing we've got to work together and figure out how to get those remaining 25% if you focus and start on that 75% on that good number that number that gives them a positive feeling you framed up a positive conversation you've got them in a position where they're more likely to want to work with you

because they're thinking positive versus negative there's a couple of different kind of standard tools that they discuss and when we're talking about framing there's bridging which is really linking kind of unrelated items there's amplification where you kind of focus on people's beliefs and their understandings there's extension which is kind of in spand escopeta knees and transformation which is usually when involved when we have to kind of rethink how we are trying to have that conversation but the one I really wanted to focus on was more of the frame extension because that's the one at least for myself I found this most helpful and kind of a blue tree team area and it said where if I go into

a conversation and I'm very focused on one specific thing the people I'm working with are dealing with a lot of other things and they start losing focus of what does this really have to do with everything else I've got to do so what I like to do is take the that that framing extension technique which is the idea of I start pulling in other stuff it's like we're dealing with this but this impacts this oh and I know you've got this business process over here by the way if we do this that's going to improve or we're going to be in a better position for that later on I know that you know in a month's time or two months time we

were planning on leveraging this technology well we're gonna have to do this for that anyway so if we take care of that now we've now set up two lower amount works later on so using framing extension I make sure that whatever I'm asking that individual to do is more relevant to all of their work and not just this one ass that I'm doing that gets them off the focus of just this one thing so they're kind of start thinking about all they at different areas that this might actually tie in and help them out and the overall process and all of these things come to developing empathy and Trust I found this one I just love

this it's it's knowing exactly how you feel you know when you walk into a meeting with people and you start speaking their language talking about the stuff like I found that they liked some people it's great just to gripe at the beginning of the meeting with them about the stuff that sucks because they start understanding oh you're dealing with a lot of junk - that starts setting up trust they understand that you are not just this mechanical security person coming in to beat them down you're this person who's dealing with a lot of stupid stuff like them and we're trying to make the best job we can and get the you know the best results for whoever we work or whatever

project were on it's getting that kind of bonding moment with them of I feel your pain let's try to make this as painless as possible that common connections looking for frustrations that you all share looking for the success that you all share these are all things that we can help pull in and tie in to help bridge that gap that often happens when we as security professionals try to go in and start working with individuals and getting them to do the right thing offering to help and showing the value that you provide to them is all part of this process you know always asking what they can give you is not going to be successful in the long term they are

going to get tired of your constant ask for stuff you may still have to do it but you have to find a better way to do it so how do we deliver those requests one thing that an attacker will do is they'll go into a conversation about what they're trying to provide to the other person so before they even start asking about what they need they might go in going hey I heard you were having trouble with this is there something I can help you with or I'm from this division and I was trying to help out this other person on your team I know they're out on vacation right now you know you know I was trying to do this

for them but I've run into this issue they lead with what they're trying to help that other group we can do the same thing we're trying to help them improve security we're trying to help them avoid having you know to show up on you know the New York Times later on in the you know the year we're trying to make sure that they are set up so that you know they're not having to explain why all the systems went down because they forgot to patch some and something and someone you know exploited an easy an easy takedown a denial of service attack we are trying to help them so leading with stuff that we are offering to do

for them helps start that conversation in a positive light so this is all about going in saying hey you know I've been kind of going through I want to you know kind of sum up some materials for you I know that you've been dealing with a lot of requests coming in from a whole bunch of different people I've kind of had some conversations with them and I think we can streamline this and this should make it a lot easier for you maybe you won't have to deal with this much stuff you know look at ways that you can go into a conversation beforehand with things already kind of eased for them before you make the ask you're going to

need to make the apps because they're going to need to do whatever it is that that's the problem whether you know it's some configuration change or is curity issue or whatever that you know in your particular area is you're going to need to make that ask but you've started off with offering them something so you make that ass and then after you've made that ass and you've had that conversation of what they need to do and you've had the conversation of previously about what you're doing for them and on something that leaves them with a good feeling I maybe it's as easy as cycling back to what you had been offering to do with them and going over what what you

provided to them and how that ties in to what they're going to provide for you or maybe it's just ending on some kind of really fun thing you all were talking about before but don't leave the meeting or relieve the conversation or end the email simply with do this because all they remember is this person asked me to do something again and with something that kind of ties back to hey and remember I'll take care of that other thing for you or hey be sure to you know I'll be sure to send you that information about that you know new toy I was playing with the cool electronics thing or whatever other conversation or maybe it's just simply is thank you very

much you know I look forward to chatting with you the next time you know I'll be sure to give you an update on you know where something happened again you've left with something you're going to do for them it's not just what you've asked them to do for you it's all about kind of framing that conversation around being a team working together providing things that help them so that they can help you and keeping that positive note at the end of the conversation and again it doesn't have to be this is something that applies to both an email or text message or a presentation or any kind of one of those channels of communication can all be

kind of framed in the same way and how we discuss those things leveraging you know the model of thinking that we've developed for that individual the background knowledge the research that we found out about our target knowing our target knowing what that target cares about knowing what that targets working on knowing the language of that target building up this full profile building up the communication knowing the goal that we want to get knowing how that will come back knowing the message knowing how we represent ourselves as that sender of that message building that all into a consistent story that keeps them gauged in working with us and more interested in being part of our team as

we are part of their team working through figuring out the security issues that we've got to deal with

going kind of way back to the beginning this all ties in with understanding that relation between technology security and humanity that I've always been interested in I love watching or reading up on how social engineers have manipulated people because I hear those conversations and I see those actions and I always see how that how they've just leveraged kind of these standard sales tactics or standard sociology all these things that have been studied for a long time to accomplish fit so closely and with everything I have to do on a day to day basis talking to individuals out there and figuring out how I can convince them that this needs to be a priority for them so I try to leverage

these tools to enable that connection between technology and people as well as work through kind of the preconceived notions that a lot of the teams may have about the security person coming in I think it's something that we could probably do a lot better in in blue team I think there's a lot of focus on how we do technology and all the tools that we deploy and how we deploy those tools and how our new kaz be is going to protect us in the cloud and how our new firewall will keep people out but we always are missing how we're doing that interaction with the individuals that work day to day working with these technologies and

if we use our communication schools if we skills and then we use these tools that are really well documented and there's some great books out there that talk about this and a lot more detail than I have time to do in this talk we can be more successful about understanding that human interaction with the technology so that we can better improve security as a whole so I have some time I did want to put up a couple of slides up here or links up here so there's two real big books on social engineering the art of deception by Mick Nick & SIMON and social engineering the art of human hacking by Christopher Hackney these are great books but they

are very different books the art of deception is a great book if you want to see examples and can read through a story of how someone has manipulated it I've actually called out a couple of chapters I thought were very relevant to a blue team where you can read through the story and kind of have an idea of how that might actually work if you were trying to leverage it to get someone to do something in a positive light and not just manipulating them to steal something but he did he's a great storyteller he does a great job of talking through scenario and helping you understand what he was doing and why he was doing it and how it elicited the

response he got from the it is target the social engineering the art of human hacking is a lot more of a technical book so a lot of the psychological tools and sociological tools I talked about in this he goes into a lot of detail on he also covers a lot of other things that I just don't have the time like there's a lot to be known about micro micro expressions on people's faces so trying to learn to read people's faces and and how they're reacting to the stuff you were saying and doing he has a great chapter on all those kind of things and this is something that you'll uh Gamblers actually use a lot as well how

they trying to get tells from individuals and understand where their cards may be lying but there's no way I can talk in detail on that again that book is a great book for a lot of very detailed discussion of the techniques that I've kind of done a very high high-level gloss over really the quiet the power of introverts this is another good book I I liked it because I have this big interest again in humanities and sociology and being an introvert I always like to try to figure out how I can go be and like my little quiet world such as volunteering to do presentations but it also tells you a lot about how people as

extroverts and introverts interact with the outside world and it can help give you insight on how you deal with introverts or extroverts differently because they react to different things in different ways introverts don't like being yelled at they don't necessarily like being overwhelmed with stimulus they work better with slower clear calm communication where an extrovert wants to be really engaged and really in there and wants a lot of exciting stuff all happening if you reverse those communications with those individuals it's not gonna go well there you're they're either going to gloss out or panic and I found that that book actually gave me a lot better insight into some of the ways I can interact not

just how I is an introvert interact with other people but also how I can better interact with extroverts and how I can better interact with other introverts it's a long book but it was a great I read it in a weekend because it was so good communication theory again talks a little bit more about the modes of communication professor out at Wayne State University he actually was the great little picture I had of all the people talking and looping together Jek hike is a reach red team social engineer on Twitter she has some great walkthroughs of her actual attacks on organizations highly recommend reading through those and just listening to some of the stuff that she's talking about

again you take a look at that with the understanding of some of the things I've discussed in this presentation you can see the techniques being played out and kind of understand how you might take that into your blue team scenario to convince other people to do things not in a lie a sense of lying to them but in a sense of gaining their trust their that true trust with them and then Timothy diblock actually had another talk almost titled the exact same actually changed the title of mine because I didn't want to be exactly the same as his but he actually talks more about presentation so there's all these communication models I'm talking about but there's also about how you look and

how you interact with people as a person and he does a great job of kind of talking about presenting yourself making yourself fit in with those groups that you're going to be talking with I thought it was a very interesting talk so one to call that out so that's it hopefully that was all helpful to you I do want to make a small call-out so Capital One and critical stacker both here and we're hiring a lot of people so I'd love to pilot get some more coworkers Katie epic she actually up here in the front she's hanging out at the place talk to her we are hiring and this plants like to open up for

questions any questions

so it is not easy to pick up it takes a lot of research and understanding and certainly a lot of practice so with my teams a lot of it is - a lot of our communications through email or other electronics means just because we're dealing with so many people and what I'll do with certainly people who report direct to me is I'll work through it like I'll say hey craft up an email that you need to send out and share it with me first and let's walk through about what you're doing how you're doing it and I'll point out hey don't lead with this let's lead with something that maybe makes them more comfortable and oh

I know you just kind of like ended it right here saying do this for me well why don't we kind of end it with this kind of a soft landing at the end so really kind of working through my directions like how are they communicating kind of showing them how I would craft it showing them why so it's not just a matter of me going in and going oh I don't like what you wrote write it this way it's oh okay no I think you got the core stuff here but let's kind of work on how we do this because we want them to see thinking about this when they start reading this first paragraph and you got the delivery

of the technical request really great but let's finish up with you know kind of discussing with them this other thing so that they're not thinking just on that but thinking of the broader scope of it but making sure that it's not just me rewriting their communication but explaining why we are making changes and what the actual reason for that change is right and they you know they've done it a couple of times they start understanding why they're doing it that way and it gets natural more natural to them because without practice without working through this you're just not just knowing the technical bits of it again we're dealing with humans it's not like technology it's not a simple offer

on bit humans have all these little sub gray areas in between all those off-and-on bits that we have to kind of work through and start understanding because all the people that we're communicating with are all different so every time we think we've come up with one model of communication we have to develop another model of communication because that person is a visual thinker that person's an auditory thinker that person has a team of Linux experts this team has a team of business analysts they're not going to be the same communication and we have to figure out through time and repent repetition about what the right way is

[Music]

it's it's more difficult but phrasing the language that you use in those in an auditory or visual way so if you're talking to a visual person on email now understand that reading text is not necessarily the same thing as visual but describing pictures to them so they they start creating the visual image in their head is a way of starting to use visual communication with a visual thinker creating that picture letting them have the information that helps Creina if it's auditory again it's a little bit more difficult it's if you can't get on them on the phone or get them in in-person communication you have to think about how how you might tie it into auditory language ie

do you hear you know again kind of going that language do you hear what I'm trying to explain or or see if you can't get them to a phonecall point of view at some point or opportunity luckily the vast majority of people are actually visual type people I'm going to throw out unsustained statistics but I've heard somewhere like 65 percent of people are visual something like 25 percent of auditory and the rest are kind of the more the thinking feeling unfortunately I don't have good sight to source for that but I have consistently read that people tend to be more visual so you're usually that's kind of the first route you go but it certainly does you know when

we're talking about communication paths that don't have audio attached or don't have physical objects attached to it it becomes a lot more difficult to kind of figure out how to do the language just to talk to someone who's more auditory again trying to think of things of in the language that you're using that brings up hearing type connections for that individuals usually the pie the best I can I get away with is just how do I get them thinking about sound related to it you know we don't want you know like we're trying to you know patch something and we don't want the scanner to start sending awful or alarm bells or something like that I've added an

auditory concept to the conversation but it's all in text any other questions

what's that so yeah so I don't think of as playing stupid as playing to their ego so yes there can be benefit of playing up to someone's ego because it gets them in a position where they think oh I know more I need to help this person or I'm superior and I've got to educate them you have to be careful with that because sometimes they can go a little bit too much but if you're willing to filter out the too much you certainly can play that and I've done that before I've I've let someone be the expert even though I already knew all the stuff they were talking about because I still needed them to get that

done and this made them more comfortable yeah so playing the ego or playing stupid depending on which side you want if you want to frame it in a positive sense versus negative anything else okay I think this is about one supposed to end but

thank you very much