Access Denied: Sausage Farmers, Nans, And Security's People Problem - Jemma Davis

Hello. So, uh, yes, my name is Gemma. I am the founder of a company called Culture. We are the world's only fully inclusive security awareness training platform and um, ethical fishing simulation tool. Um, and so yeah, as as was said, welcome to my talk, Access Denied, which is cleverly the same title as my book. um sausage farmers nanners and security problem people. So firstly, thank you for having me because I think that's really lovely. And when I was looking at the schedule, I realized that there's a load of people stuff and not a lot of tech stuff on the schedule, which I'm assuming is saying to my lovely friend Hazel. >> No. >> Okay. Just coincidence. Um and

we what we probably all know is that um a lot of cyber incidents are down to the human action. Um yet we continue to invest in a lot of tech. Um so I'm a big advocate for uh for doing what's right for the people. In my my day job, I specialize in security, behavior, and culture change. Working with people to get them to understand their own risk and um make informed choices about their own digital safety, working with organizations of all sizes to make sure that their their people understand that. So, um thanks for coming. I mean, that was all sounded banging. If I have known that was on, I would have gone to that.

That sounded great. But thanks for joining me here. Um, let's work our way through. Who's seen one of these before? Yeah. Who's clicked on one of those saying visit anyway? >> Did you do it cuz you don't care? >> Doesn't care. Did anyone else not care alone? >> Accept all challenges. >> Exactly. Right. So, we don't do it because we don't care. We do it because security is hard and we've made it really hard for people which is not a great thing to do but then we berate them for doing things like clicking it but we will all click that because we want to do the thing that we are trying to do and security is getting in the

way. There's lots of things in security that we do that that make things really really difficult for people. Um, for example, turning off audio multiffactor authentication for people because maybe that's a less secure option. We just want the two numbers to come up on Microsoft. What that means is that you could have somebody with visual impairment that relies on that audio description to tell them what the number is to make them secure and you've turned it off. So now they can't do it. So they won't use one factor authentication. So it makes your business less secure when you do things like that. The other thing is patch Tuesday. Patch. Who loves patch Tuesday? Was patch

Tuesday a great idea? >> Matt's doing heart months. Who hates patch Tuesday? Lots of people. Yay. My issue with patch Tuesday is what we do is we patch a load of stuff, but we haven't necessarily understood what that means for individuals within an organization. So if If I've got employees who are using a screen reader, for example, and they they use that to be able to do their job securely and safely, and they they're there to get paid and get their salary at the end of the week, and I roll out a patch that knocks out their screen reader. What I'm doing is forcing them to download shadow it or make a risky decision because they're not

considering what right actions of patching without testing that roll out will do to individuals within the organization. So, there's lots of things that um that we do in security that impact real people, which is not an ideal situation. So, here are some of my average people. This one's living the dream. There's uh Snow White getting loads of help around the house. If anyone knows a cleaner grill, send them around to my house. Um I look more like the one on on the other side. At any one time, 50% of people are dealing with something significant. And that could be illness, disability, loss, anything. And that's half of your employees, half of your friends, half of

your colleagues. And they won't tell you about it. And the reason that they won't tell you about it is they fear some sort of retribution, that they won't have access to opportunities, training, promotion. they they silently go about themselves. And so when you forget about the people that might be going through something, 50% of all people at any one time will be going through something significant. When you forget about them and you push out a security challenge that makes life difficult for them, you're not designing for people and you're alienating 50% of all the people. So accessibility isn't a side issue. It is the main event. When you lock people out, you you make your

organization less secure without even realizing that you're doing it. Here's where we get to the sausage farmers, which is I know you're all here for. And I am aware that sausages are not far. It's It's just a thing that I thought was funny. >> We don't grow sausages now. >> Stuart's learning about agriculture, don't we? >> I thought the next pastor the pasta trees. >> That's tomorrow. >> So, I'm going to introduce you to some people. Let's uh let's assume this is man. Man's much more stylish than this. She wears better clothes than I do and she wouldn't have a cat. But let's assume that's man. Let's assume that man's local post office is finished

and there is no cash point in her village. And that's accurate. Actually, that is exactly where Milan lives. She lives in a tiny village in Glost. No post office, no cash machine. So now she has to do online banking. So that's fun for me now. She loves that. This is me sausage farmer. He probably lives quite close to my n cuz she lives in the middle of nowhere. But the sausage farmer wants to grow sausages or whatever they do in sausage farms. And um unfortunately that means he has to use tech cuz the government made us do making tax digital and things like that. So if he wants to get paid he's got to use some tech. But he's not

in the business of tech. He's in the business of making sausages. And this is your average person at work getting paid going through some stuff just going through the motions to pay their rent bills etc every month. and I'm going to dive into them and you'll notice a great big banners and don't read that because I'm going to don't don't pay attention to that. Pay attention to me. I'll just keep talking. So, who here gets a call from their parents, grandparents, relatives asking them to change the time on the microwave twice a year? [Music] I don't change the time on my microwave. It's right at some point in the year. So, that's what we worry about in my

house. My n if she's been forced into online banking, she's now at risk of online banking scams and other things that are out in the world. Yet, she can't change the time on a microwave. And the reason I said don't read this is because I looked at NCSC's latest guidance on what you should do when you get an email and that's what it says. All of that nonsense. And by now can't change the time on a microwave. And does she understand any of that? Probably not. What does it say? Beware wary of attachments, especially unexpected files. Those ended in unusual extensions. I know not a clue what an extension is or why there would be

files. Um, I don't think she knows what a fish is. Um, well, she probably does, but she'll have it for lunch on a Friday. Got absolutely not a clue about MFA. doesn't know what a domain is and doesn't know what a safe zone is. In reality, my nan is actually really cyber savvy because I'm her granddaughter. So, she rings me up and says, "I've seen a scary thing. What should I do about it?" But the average nan who's getting you to come around and change the time on the microwave, this means absolutely nothing to any of them. So, the post office is gone, the bank branch is gone, and she's forced online. But what if we designed for my app? What

if there was one action in plain English with a single button that was a safe way to ask for help? That's got to be a better way. And when we think about this, the average person is going through this every time they've got an email. Why have we not made it better for them? This is unacceptable in my eyes. This makes security unusable and it increases the risk. So if we just made it a bit better by thinking about my then we would reduce risk for everyone because if it doesn't work for my now it doesn't work for anybody. [Music] And quite often when someone at our work clicks on a fish email, we eye roll and we're done.

We have to go and speak to them. Probably put them through some training. That's annoying and that's annoying for them and it's annoying for us. But if we just made that better, we wouldn't have to do any of this. I communicate with people on a daily basis on what to do. And I could not tell a whole company how to report a fishing email because depending on which email client I'm using, Outlook, Outlook for Mac, Gmail, they're all in different places and there isn't a button that says this is a fish. What there is is a menu and a drop down and report something and it's a really convoluted process. So, let's just stop doing shitty things.

Here's me sausage farmer. Don't read any of that. That's a lot of words. Um, this sausage farmer is a small business owner. I own a small business. And there is a hell of a lot of admin that I have to do as a small business owner. Got to buy returns and send invoices and buy it things and do do I need to this antivirus stuff? And I know what that means, but does the average person know? Probably not. So this sausage farmer, like I said, he has to send invoices. He used to go used to go with a little paper book and he could get paid and now he can't cuz he's got to send invoices digital.

He's got to take car payments probably and balance his books. Has to have an online presence. Probably got a website, Sausage Farmers RS or whatever it is. Um, and he's got to keep his audience happy. Stuart's just lost himself there. >> I'm I'm not that creative to come up with a new sausage farmer's name. But no, he's probably got some social media. He's managing that on a daily basis. Probably doesn't know that he's sending pictures of his, I don't know, his wife's credit card on the table or whatever is going on. So what I did was I went to AI and this is why I said don't read it cuz it's nonsense but I told I asked AI what is

the most secure login workflow for a sausage fire and that's why it gave me pre-authorization bots and risks primary signric secondary factors I can't remember what that says now it's hidden um contextual steps recovery accessibility privacy guard and I was operational hiding. He fell off the page and this is the steps that he gave me for a sausage borrower. So yeah, so we wonder why the sausage farmer doesn't know how to do it, right? Cuz that's a maze of nonsense. I couldn't even work it out and I was supposed to know about this stuff. This is multi-step login and session windows that expire and captures that you can't read and it just chaos and which of

these is a bus and all that stuff and I I know what a bus looks like and I still get it wrong all the time. So imagine this sausage farmer selling to Hazel's not here. I don't know if anyone has saw me talk at Infosite Uni Sausage, which is my brand of shop that sells school uniform sausages. You were there, you remember Uni Sausage. And so Uni Sausages terms and conditions for anybody else who didn't realize. So, um, Uni Sausage says that all of my suppliers have to have ISO 27,01 and they must have endless policies and they haven't worked out that this guy just wants to make sausages and sell sausages. So he's got to write train.

He's got to write policies and do training and keeping the big corporates happy. Otherwise, he can't do his making tax digital and do all his online stuff. And all of that eats into a sausage Sunday time. Who thought that they would hear sausage this much at this time in the day? I didn't realize I was going to say it that much. So what we don't factor in is that productivity is always more important than being secure, right? We come to we go to work and we do our job. Even as security people, we go to work and we do our job. We No, don't worry about it. We'll do the security bit later. Um, and

I think any of you that say that you don't do that is telling me because we have to do our job to get paid. So, this guy will always find workarounds. Everyone at your work will always find a workaround. They'll share codes. They say passwords in plain text. I have got my password written down, my online banking on my desk because I keep forgetting it and it's a really boring process of changing it. But this threat actor that's coming into my house doesn't care about my online banking. He cares about licking the computer. So what's the risk profile now? So this sausage farmer is uploading files to his personal drive because it's just really complicated to do it any

other way because it's easy and he's got sausages to farm. He's not malicious. He's a real person. He's a human and he's trying to get his job done and he's trying to make money and he's trying to sustain a lifestyle. We call it non-compliance and we add more steps and we write strict to policies which makes people take riskier decisions cuz that's just frankly ridiculous. We're not understanding real people in an organization and that's where it goes terribly wrong. So how do we fix it? We give them choices that are equally secure. clear content, fewer hoops, and more accessible options and get to the grips of of what people need in your organization. And I love that Lucy from

Inclusive Change is sitting right there cuz Lucy's the one who helps me with all this stuff. Um, if you don't know Lucy, there'll be cuz she's great. >> Oh, and that's me. Anyway, to make the path safe and make it an easy path, supposed to be in a meeting. Don't tell anyone. Um, when security helps people get work, then the risk go get work done and the risk goes down. It makes everything much easier. And people will come to you. I get people knocking on my door saying, "Hey, Jenna, how do I do this securely?" My nan rings me up and asks me about something she's seen on the news. And she goes down to

hairdressers and she tells all her little old lady friends about it. and then they become more secure and we need to keep doing that and having that over narrative cuz if we don't we're not making anything better. So this is the average person. Don't read this. Just putting it there for illustration purposes, but this is your average colleague. And they look great. Look, sort of smiling a little bit. Lovely cup of tea. Looks all right. And he's working. He goes to work every day and he's getting stuff done. And he's completed his annual training. Woo! 20 minutes. He's nice and secure. But what you don't know is what's hidden. and all of this. This is what he could be going through

because as I said, 50% of people at any one time are going through things that are significant or maybe they just didn't sleep very well last night. I didn't. You didn't. You won't be offended by um but any one of these things that is on here could mean that they're not paying attention and they are likely to take more risks. They could skim read, click links, ignore warnings, any of those things. And not because they don't care, because all of us have done stuff and not because we don't care, but because that's our primary function is to earn money and support our families and get through life. Clicking on stuff happens. They're carrying way more than you can

ever understand. And all of us in this room are right now. We're all going through something that will make us make decisions in a different way to the next person. Uh environmental factors would also do that. What percentage of people do you think your organization has budget to support through any of these things right now? Any ideas? Matt Z is higher than zero. So let's go higher or lower than zero. Higher. What do we reckon? Anyone got any ideas? >> 8%. >> Not far off. Little bit higher than 8%. >> 12. >> Lower. >> 10. It's 10. Two people said 10. 10% of 10% of people are have budgeted to support through these things. Yeah. 50%

of people are going through this right now. So that's Um, and we're saying that people are the weakest link, but they're actually not. They're unsupported. They're unsupported systems, which we wouldn't allow in cyber. So, why are we allowing people to be unsupported? We say that they're the weakest link and they're risky and that they're non-compliant. Matthew, [Music] if half of us is carrying something heavy, then they're not that outliers. They're real people. That is your workforce going through all of this and more. I mean, this was just what I could fit on the slide in these lovely clothes. But the list is endless as probably Lucy over there, but don't read it anyway for the math.

But we keep designing and demanding perfection, which is not. And then we punish people's failures, whether we think we're doing it or not. And that could be that they clicked on something and you go slightly too heavy-handed to ask them questions about what they did, what the process was, which is why soft skills is so vital in our teams. And then we call them soft skills, but they're essential skills, right? It's the human contact, it's the empathy, it's being able to have a conversation with someone, get to the bottom of it without being an ass, basically. So, how about instead of doing all of that, we design systems that absorb stress and flex with real life? Who's up to

have some of that? Excellent. Go away now and do it, please immediately. But that's real security cuz what we're talking about at the moment is fragile perfection cuz it doesn't work. But real security meets you where you are and it makes it easy for you to go to work, do your job without taking risks and that's real resilience. This slide doesn't change. There we are. So this isn't about being nice. It's about reducing risk. Right? Not asking you to be nice. I'm sure you all are lovely. but reducing risk. Inaccessible systems cause errors. I've given you a couple of examples. I can give you an endless list of where that might be the case. Um,

clunky systems cause workarounds. Who's got a handle of their shadow IT problem? >> One person there. >> Wouldn't shadow it if you had a handle on it. Right. How do you reckon you get a handle of your shadow IT problem? I am calling you since you got a handle on it. >> Great. >> I just delete everything every week. >> It's not a bad way to do it, but you're lucky people out there. So, I wouldn't recommend it. You've got absolutely no idea what your shadow ID problem is, and you've got no idea how to solve it, and I do. But, I'm going to give you a really easy suggestion. How about you just go into

the kitchen one day where everyone's hanging out and say what are you using? What's that? What are you doing there? >> Nowadays getting there. There is that right. I used to hang out loads in smi

shower. Take up I don't know. Don't take up smoking. Just hang out with them. But um yeah, you hang out as people are normally very chilled and they'll tell you exactly where the bodies are buried. So it is a good place to hang out. No, I mean what I'm talking about is a sort of I guess of like tell me what's going on with no repercussions. They still won't tell you cuz you side with people and you've probably been mean to them at some point. So they won't tell you about anything. But if you just have a conversation, what is it you do? what what are you using for that? And then don't be an ass about it and go away

that's not going to be approved. What you do is suggest an alternative that will that is approved um or try and understand more about them and then you get the fewer workarounds and then you don't get the shadow it quite as much. Cyber demands quite often breed resentment. And that's not what we want. What we want and we've done a really really horrible job of building relationships in cyber. Um and we we have to recover those. It's the only thing that your staff here is you've got to do 20 minutes training and why you clicked on that. That's not a good experience and you're not going to get what you need out of them. And that's how breaches

happen. What you need is an open dialogue where people will come up to you willingly and ask you questions. I've lost count of how many times someone's called me and said they've done a silly thing and I absolutely love that they call me and tell me that they've done a silly thing. And that goes across a lot of organizations that work with all around the world. Um they need a an easy way to communicate with you and to know that we're not locking them out intentionally. They need to be heard. I was at um it was cyber week um earlier this year and I was on a panel where people were talking about how you

do this and how how you find out what people need and one of the suggestions was round up all the disabled people we've got in a room and then we ask them what they need and I tell them you do not do that. That's not okay. Don't round up the disabled people. It's none of your business whether people have got needs or not. You're not allowed to ask them and you shouldn't ask them. But if you see someone in a wheelchair and say hey what do you need? Don't do that. Don't do that at all. That's a horrible idea. But if you can get together a group of people and say, "We're going to try and make things better for everyone

who wants it in." People will volunteer and be part of a focus group and part of a lunch and learn or whatever it is, and they'll tell you cuz it'll be the first time that anyone's ever asked them. So accessibility, usability, and inclusion are not side quests. They are risk controls and we need to start looking at them in that sort of way, right? It's not a nice to have. We need more than 10% of the budget. You need people like Lucy coming in and talking to you. Um cuz she'll tell you if you don't know about inclusive change, you should. She I met Lucy here last year and she was doing a talk about it. Lucy,

stick around so everyone knows. I >> feel like I sponsored her. I haven't. I saw Lucy talk last year and I sidled up next to her really crudely and can be best friends. She said, "Yeah, and now we are friends." Um, yeah accessibility usability inclusion reduce errors and they pro improve adoption and they they will go some way to stopping shadow IT and they make our organization safer. And I want you to do something over the next couple of days, over the next couple of weeks, is every time you're in a situation, every talk that you attend this weekend, over the next couple of weeks at work, ask yourself this question. Who am I locking out? Who are

we locking out? Cuz if you don't know the answer to this, we can't fix it. But if we can make it work for the sausage farmers, for Mina, love Mina, she's my favorite person in the world if you were um our colleagues, we can make it work for everybody because as I said, accessibility reduces error, usability reduces workarounds, and human- centered security reduces risk. So let's do it for me now cuz I love it now. I'm just conscious of time where we are 10 minutes left. >> Okay, cool. I'm going to shamelessly pitch me book for 10 minutes and you're going to have to listen to it or bring le um I'm this is me. You can LinkedIn with

me you think is that be lovely some new friends. Um and if you look for me on any social platform come for us lovely. I uh have just released a book called access deny the security risk of ignoring accessibility. And I will say this but I recommend that you you do have a look at this. It's available on um Kindle tomorrow morning, I think it is. And it's it's on one of those if you're a Kindle subscriber, you get it pushed to you and you can read it for nothing. But this book is 340 pages of how to do this, right? It's frameworks, it's checklists, it's it's not hypothetical. This will help you go to work and

actually make a difference hopefully as long as your bosses allow it. Um, but it's I mean I go with it. I think it's great. So, but you should definitely take something from it and let me know if you need to know anything and I I'll try and make it available to you as well cuz I just want everybody to have a better experience. So, that's why it's going out on Kindle free tomorrow. Everybody can have a little look at it. And being that I've got 10 minutes left, I'm going to hand over to you if you want to. questions. >> I can be loud enough. I know. >> I know. So, I have two. A, how do you feel about

password books? Uh, just cuz I like to not. And B, kind of the more serious one is I've done a lot of talks with CESOS and so many of them have a black and white thinking that we have to do it this way. >> How do we get change to start at the top? >> Password box. Yes, please. I write a password. I just said that. Um, know your risk situation. I And so if your nan's got a password, I'm fine with that. >> What I would say is don't leave it lying on your desk like I might do. Nobody knows what that's a password for. Um, and it's not actually a password. It's memorable. You know, you've got to do

that like what's the third character? And so I've got the word written down, but nobody knows what that's for. And it's literally just for those characters cuz I can't work it out in my head cuz um I've got something called a fantasia. I can't see anything in my head. So, I have to write things down and then actually count it. I also can't count cuz I can't read numbers. So, that's fun. Um, but I managed to write a book. So, >> there's no pictures. >> There's no pictures in there. >> No pictures. Sorry. Um, yeah. No, I'm in favor of password books. Um, but don't keep them under your laptop and have explicit things like, you know, this is

my password or whatever. You know, try and think about the threat profile. But as I said, realistically, if someone's breaking into your house or your office, the motivation is not to get your password. It's to steal stuff and get it down to Castburg. So, I understand that that exists. Um, and also don't write on the front of it password book. And that makes it really obvious what it is as well. Um, sorry, second question. CESO is how we going to change. >> Yeah. Not not that I'm but I I have spoken with a lot who think it's a very black and white this is the risk we can't do anything that could possibly be risky. So if I need a different way of

accessing something I do um we can't do that because that's not within our parameters. How do you get them to understand how how do you get them to kind of meet the middle? >> Yeah. It's a horrible experience and this is why people don't ask for things ask for reasonable adjustments and things like that. Um, you have a right to ask for what you need at work and as long as it's reasonable, you should get it, but yeah, not always the case. Um, it is tricky. I really want to hand over to Lucy Lucy. We'll be talking about this before. So, we'll talk about red flags and reasonable adjustments later, but it's about looking at those adjustments as

risk controls. so that people control because your people are going to do things regardless of whether or not you think it's okay. >> Can everyone hear what Lucy's saying? >> Yeah, I lied. So if you think about reasonable adjustments and those changes as risk controls and you're all about mitigating risk, cyber security, we want to mitigate risk and people are probably one of our biggest risk factors because we do strange things because that's just who we are. And reasonable adjustments are about thinking about it as risk controls and not just, oh, I need to do this cuz the Equality Act tells me so. is actually gonna make your business and the world better. >> But if you reference the equality, you

can actually change as well. >> There are laws in this country, health and safety at work, equality act. They're all written by lovely book that um I think Oh, >> can I can I ask can I ask a question about your nan? >> Yes. >> So this weekend you decide to buy your nan a brand new laptop. >> Oh, my nan doesn't have a mobile phone. Can you give three tips on how to make that laptop secure for them? >> Yes, let's give it a go. Um, I would buy her a Chromebook, I think, if I was going to do anything because that would include a lot of stuff. Um, and would be really easy. I

can't imagine handing my a laptop. But um my nan's phone still has the cord saying with the spiraly bit. Um my nan's not internet connected, but that doesn't mean that she's not getting scammed seeing her all the time. And she rings me and tells me about it. >> Um [Music] >> can I respectfully offer you a suggestion? >> You can't bank account. So the many banks will do things like put a limit on the size of transactions that aren't approved by an offspring. So >> many [Music] >> which is why I think Chromebook is the way I would go and definitely biometrics. Matt's sitting there going like he's eating Biometrics. Absolutely. Um, Windows Hello, all that

sort of stuff. So, she doesn't have to remember anything. People, everyone's got ideas. I'm going to go you there for an idea. >> Okay. Just the standard Windows admin.

>> Sorry, can you say that again? Sorry. >> Take away admin rights on a standard user.

[Music] you had an idea. >> Make sure she knows she can call me if there's anything that she's suspicious. >> My n calls me for everything. It's great. And then she goes and tells all her names, which is great. Um, which is Yeah, I always gives me grief for writing like in women's weekly and things, but I mean, Anna reads it. So, I like to do it cuz then she's in the hairdressers like with a woman's wigler. Look at my granddaughter. Um, I'm sure she just does it for bragging rights. Really? Did that answer your question though? >> Yeah. I need to know what to do. >> Okay. >> Yes. Let's have a then to it. I would just reiterate that

it can be really awkward of I know where I got a lot of my viruses and where I clicked on dodgy links when I was going in school. >> Confession is familiar. Yeah, >> I grew up with lime wire. I mean, lime wire. >> If it's your son, I think it's the same thing. But understand that at some point there will probably be a time where it's going to be a really awkward conversation and give them the out of not asking how they got it. >> Yeah. Don't ever ask how. >> Not if it's your kids. >> There's loads of hands up. Sorry. Um >> Yeah. I was going to say I gave my mom

three tips. >> Yeah. So my mom's 92. She's been using >> 92. So my mom's 92. She's had an iPad like the last 15 years. And the reason I gave her an iPad is because she can use biometrics. So it's just easy to log in and if it falls over, it's easy to fix it. Um I also while I don't like it, she has a password book. She's had a password book for years. She's not very good at remembering which password is to what account. She doesn't write down what the account is. But also changes passwords a lot and doesn't don't write those down either. But she's got a password book that makes it easy.

>> And then the last thing is if you get stuck with it, she just rings it. It's simple. Like there's no there's no judgment. If she does something wrong, like we all make mistakes. In fact, that's the best way to learn is to make mistakes. So >> So basically encouraging us to to say look at this thing, you know, it's broken or I've done this is just own up to it. Just chat about it. It's fine. >> Yeah. We need to make it okay to talk about it to everybody. >> Yeah, I agree. >> It was Yeah, we going that it's it's the trusted friend >> the trusted advisor which is where us in it need to have that role as the trusted

advisor. So it's building that trust up with our colleagues to go like I used to be sis admin people turn up I've spilled something on my on my laptop it doesn't work what was it coke okay what was it okay that's great thank you for being honest it helps them to fix the problem >> it's always telling me [Music] >> the more information you can get up front the better just be open about it and thank them for being honest >> which is the essential skills. Yeah. >> Just on a similar note but kind of thinking on a large scale lot of people giving individual tips on how do you help friends how you >> how do we do it? So it's so a large

community of the large [Music] community of people that do need to be protected will be attacked by those kind of by the bad guys. I'm sure they're thinking actually I do want to target that access technology. So how do we ensure that this messaging is going out and is effective beyond like you said to start beyond those kind of watch out for these files which I have no idea what to do. So how do we achieve that? >> Yeah. No, I'm I'm completely with you. we I don't know why it's still shameful to talk about security things and we should be able to talk more openly and honestly and I would love for everybody to be shown as loudly as they can about

you know in doing it simply and that's why like when women's weekly call me and say hey can you write some words about this and I'll do it and the son calls me and I and I try and reach people where they are as much as I can in a way that they understand so I'll write for the audience of that publication and not necessarily how I speak and push it in all the time cuz I do that. Um but yeah, we need to have have those cases that mean something where you are. There's a lady um called Wendy Ganger and she writes um content for people of all ages. I think she starts at the age of

four and she goes right up to death of oldness, not premature death. Um but she's she's published a load of stories. Um I think it's called Ken Doyle which is for older people. The little kids is um Netty and Cyberland and there's a whole range. Um and they're all available on Amazon. Wendy go does the storytelling. She's great. Um and we need to use more more things like that. I'm trying to support Wendy to get voice as much as I can because it's really important. Um we've had it on yesterday about communication building trust over channels and all that sort of stuff because people can voluntarily come to you for that information on one hand if you take out street

you're basically saying come to me tell me you've done something wrong there's no repercussions that's that's the trust at some point there's got to be repercussions or some point of escalation be that either you got repeat offender There are people who are preaching if they just don't really care. Where did you draw the line or I know it's specific but where would you go back draw the line between okay you've been given enough trust now there are questions you can't be completely blame >> can I just I'm going to go to the room just quickly how many of you have dealt with a malicious insider >> how many of you dealt with accidental insiders very rarely is they malicious really um

in the grand scheme of all the in I know like this whole row here is an incident response team right what would you say yeah malicious or accidental more often >> accidental >> accidental right malicious I think there are other signs in you know insider threats and all that sort of stuff but not saying malicious doesn't happen we know that that happens um so I don't think you're right in the repercussions for malicious accidental is always a path and we need to understand why they didn't understand why they didn't Yeah. And realistically, they don't care if it's not their job, right? They got a cyber team who makes them do training and tells them that they clicked on

stuff and you w >> Yeah. One more question. >> Okay. Um I'll try and speed up the answer. Um yeah, it's not their job. And what we don't do is get people to care about being secure at work by telling them to be secure at work. We get them to care about it by telling them about their own stuff. and it's through gossip and storytelling and cannon and all that sort of stuff because they don't care. You need to get them where they where it hits them, where it matters to them. I'm all in favor of storytelling. I tell I I do like a talk on the security horror stories of stuff that's happened to my

actual people that I know. Um, and we need to keep telling those stories because that's when people start to change their behaviors and I'm behavior change specialist. So you don't do it through training and enforcing and frank. You do it through getting them to care about their own personal stuff and walking down that digital dark alley and what those risks are cuz all the women in this room will have walked down an alley with keys in but they won't do that online. So it's a much different situation. So it's about the personal side of things and that's how how it will help. It's a long question just to point I think to the last question around how

you get to how you communic that really kind of all the I guess to your audience. >> Yeah, absolutely agree. Um and that's it goes for the personal thing what matters to you. I do a whole talk about toasters um around um like if I'm in the business of making toast and I got a grill and I want to buy in from the board of getting a toaster but already got a grill. How do I make that business case? And so um I think that on my if you go on my LinkedIn it's written down somewhere as a business case for buying a toaster. Um >> what do you do? She's in charge. So if you need a business case for that,

if you free up the grill to cook your sausages, then you can also do toast and sausage at the same time.

>> Everyone's got um so be around most of the day, all of the day. >> Yeah. >> Yeah. So um if you got other follow questions uh please go find her or she might find you all. >> No chance until like just people discovered. Okay. And if you have a massive round of applause for