Managing The Minefield of Cyber Explosions: Understanding what to say & when to say it - Peter Jones

My name's Peter Jones. I'm going to talk to you about managing cyber explosions. Quite frankly, for the tape, my fuckups. Let's [snorts] get it straight out of the way. Just give me a bit of swearing. I care on myself. You're going to see a couple of very technical talks over the next couple of days. Some well researched information, some stuff that people have gone out because they're passionate. Mine's about cockups, things I've got wrong, [snorts] things that I have really had to battle across to get to the position I am today. And be it that when I say I started messing around with computers in the 80s. >> Yeah, this [laughter] don't let this beautiful complexion fool you. Uh, my

first computer was off 64. First machine I ever built was a 386. Um, for the people in the room, OS2. >> Yes. Thank you very much. Um, however, part of my career and the reason I'm talking to you today is actually why you went to into digital forensics. I never thought I'd be a digital forensics person. I thought I was going to be an IT B. So, in 2009, a digital forensics company took a punt on me. Punt, that's not my swear word. [snorts] The reason it took a punt on me is because I got interested in mobile phones. I used to work for a mobile phone company back in the day. And as part of that baptism of fire, I got my

first cyber explosion, those who had digital forensic qualifications and degrees sneered at me. Anytime I wanted help, they would not help me. They would let me suffer. And when you work in an industry where you're only as good as your last investigation, your last audit, they set you up to fail. What particularly annoyed me about those two, if you're watching this, you know who you are. They had a podcast where they would also publicly ridicule people without certification. That doesn't help the industry. And that's why we're talking today. A cyber explosion is what you're seeing on the screen. It's a bomb your bum disposal officer. You're doing everything right, but the outcome is not what you expected. So

what you put into the machine, the formula you put into the machine, the time and effort you spent, and somebody's told you it's not wrong, just don't care. That is upsetting. That is degrading. And you feel like you're running free from your own credibility, which is very, very frustrating. So, I've thrown some bombs in already. Who am I? Why do I need to talk to you about this? Well, like as I mentioned earlier, do the maths. I've been doing this for a while. um few degrees, got three degrees, two technical degrees, one non technical degree. Uh done many of books, part many societies, done plenty of mentoring. So I'm not exactly a stranger in a strange

land. However, every one of these have had a cyber explosion. Not because I've done something wrong, it's just that translation is what we're going to start digging into. However, being the fact I'm a keynote today, I had to make my own sacrifices with the B-side Bristol organizers [gasps] because I set myself up to fail for my last conference when I told them what I used to do. So, I used to be a radio presenter as well. I was a t I've been TV host. I've launched book launchers and I had to do a lot about learning about communication. So, I thought, okay, I would keep it in today. The only thing that really disturbed me

by the organizers because I told him about my heavy metal tendencies. It's a lovely luscious long hair like he does. Not anymore. Um, they said talk about goat sacrifice. This is the news I got today. So, this is my friend who's going to be helping me, my demonic goat. So, as you can see, kind of a man on the edge dealing with things, dealing with rock stars. But my first piece of learning about communication, who's this? Uh, I've I've put her in on purpose. This is this is a a character called Adah. This is from B size Exit. And for those who don't know, and this is where I might get thrown out the building. I'm a B size exit. So,

>> thank you very much. [laughter] >> With you when he turns up to meetings. [laughter] >> Why? There was a reason why I put her in today. Not just text besides extra, but this great conference. Um, she was designed with this idea of curiosity, infinite dreams, trying to get there, try and get somewhere. And we turn up to Bides because we want to learn and get to that dream. So, she's going to appear in lots and lots of tabs. But this is not a sub story, nor is this a technical talk. And most certainly, I'm not going to talk about those two letters. You know what they are. I'm not going to mention them. Nothing to do

with my talk. Don't really care about them. is about that next generation and the other side of this table about cyber explosions not getting it right not being able to get through that next step I'm going to tell you all now I've been many many a disciplinary with me on the wrong side of the table which some of you probably like yeah that's not surprise me not really that's because I've been in very sensitive environments very pressured environments where nobody's helped so we come back to that forensics piece all right so there's plenty of opportunities to learn and avoid those wasted years. What does everything a seesaw looks like? Kind of try draw straight past

that. I've been a seesaw for the past 8 years by the way. Uh this is why uh through all my cyber explosions I've got to this point. So what do people think they look like? Swave sophisticated chart like Dr. Eric Call who recently passed away. We have an image of security leaders. We think they know every framework. They know every attack vector, every regulation, and every control. That's not the reality. The reality is most days we're negotiating budgets, we're translating risk, we're calming people down in some cases. Uh, and we're trying to influence decisions that we don't actually own. We're a weird type of peacekeeper negotiator. We just want to be friends. And that's one of the hardest things in an

organization. If you're in a global or organization, it's even harder. Um, I have a a developer in another country who regularly abuses me. I regularly abuse him. Uh, and when a security tools block him, I don't really rush, put it that way. Anyway, security leaders sometimes act like organizations clairvoyance for cyber security risks. And sometimes, and this is really one of the main purposes of this talk is a lot of you might report to a CISO. You might have a customer that's a CISO. You need to understand some of the explosions that you might have in your career and some of the explosions that that person's having to deal with already today. The fact that seesaw on

average will stay with an organization 18 months to two years. It's not always about the pair packet. I've been out the same company 8 years because of this constant ability to learn. So the chap on the screen, Dr. Cole, the reason he's on there is not because he's got a wonderful smile. He's used to do a podcast called the world's greatest seesaw. And that wasn't about him showing off or anything like that. It's a great [clears throat] podcast. Um, obviously sadly we don't get to hear it more. And it was this quote that I really really enjoy and I think this gets missed with anybody at any point in their professional career cuz I hear it

so often of I don't want to become a seesaw. I don't want to become a manager. It's fine. That's what this purpose was. So one thing is trying to be the world's greatest seesaw. It's okay. It's okay to be the world's greatest engineer in it. It's fine. Nobody talks about nobody blinks an eyelid becoming a specialist engineer. We can do that in cyber. And he talks about in his book. So I re there's three recommendations of books. I've been told off from my book selling, but I don't get anything out of this. This is a great book. I read this book in 2021. Cyber crisis. So if you deal with incidents already today and you're

dealing with essentially cyber panic, read this book. This is one of certain things that talks about cyber explosions. Highly highly recommend it. So here's an example. Uh and this is something that took me a while to get used to. So when you're an engineer, for example, your value is in looking for the answer. Somebody's ask you to do something. you need to go and create something, fix something, you go away, you find it, that's the job, that's what you get paid for. From an executive's point of view or leadership point of view or whatever style equivalent role, many people are guilty of doing the same thing as the engineer. They want to know the answers. They want to solve the

problems. They want optimize systems. They want to be right. This happens with very very senior people been doing for a long time as well. Still it surprises me the mount sees the security leaders who've never never had an opportunity to speak to the board. That surprises me and this is where the explosions and the message through today hopefully will help. The difficulty is when you go in with technical answers technically accurate you complete answer and the room's glazing over you've missed a point. We've gone back to that first cyber explosion problem. It can be quite sobering. The great thing is none of this is actually wrong. So all that stuff of being an engineer knowing all these

answers and being an executive of cyber it's then understanding actually this executive common is any type of executive in an organization because they do want to ask the questions be it HR, marketing, operations and so forth. They do want to be to make decisions. And I I enjoyed this quote the other day, quite [snorts] abstract, but Steve Jobs, it doesn't make sense to hire smart people and tell them what to do. We hire smart people so they can tell us what to do. That message gets lost in cyber on a regular basis. If you're a pentester, sock analyst, you're normally doing some incredibly specialist good work. that now needs to how does that trickle up to the top? Think about those

four points that any executive would be asking. So, how's this play out from my story? And some of you would be tempted to discuss this because you're a northerner in it. Northerners don't say things properly. Possibly a little bit true. I'm the I think I'm one of two northerners in the office and there's 300 people in there. I just didn't understand what the seauite wanted. I didn't understand why the seauite didn't understand me. Not the northern accent bit, the information bit. I spent more and more time, more more details, more more imagery to demonstrate what I was trying to get across. And this might have been I needed a decision, but I missed that point

because I thought it's about being accurate, being reliable, which is all what cyber is, isn't it? We all want to be accurate and reliable. That's what our job is. Cuz if we don't do that, we could lose our jobs. So we have this toss off. It's not quite, you know, 666 level the base sort of style issues, but if nobody's listened to, it can make a job very boring very, very quickly. So this was my next book. It's a great book, actually. So Marshall Goldmith does a book called What Got You Here, What Get You There. What Got You to That Table in the First Place? what got you to your position in the first place.

This is not a cyber book. This is again a leadership book. It's a great book for finding out what your northern star is. What we mean by that is okay, I've got the degree, I've got the qualifications, I've got the SANS qualifications. That's not helping me move forward. What do I need? And it's a great book for resetting yourself. And actually, I read this book about 2 years ago and it definitely changed my outlook. So here's a bit the hard pill to swallow and this is really this is just an example of what we can move for move through. So as a as a security professional to become a security some sort of security leader it depends on

the size of the business. So this process can take a while but more and more you go from the left to the right. This sentence for me is the key one. Technical ability becomes less important. It does not become less valuable. That's so important. If you listen to any of that bullshittery that's on LinkedIn, I've done it again. Sorry. Coining >> on LinkedIn. The technical seesaw. No. If you're not a technical seesaw, you'll probably just been doing a long long time. You probably got a very big car. You're probably going to be retiring at some point soon. That's the reality. I've been in plenty of meeting rooms where even at my tender age of 44,

I'm probably still younger by about 10 years. Once you understand the bit about communication and technical and that that all that work you've done on writing technical reports, technical metrics, when you start recognizing the move towards leadership, you start shouting that you know freedom like a you're like a clansman. You'll be like, "No, I can free myself shackles." So, here's our fear of the dark. Policies and procedures slow down business. That is what your execs think. And our whole industry is built on policies and procedures. Who thinks that adding more and more pages to your policies makes you look better. It doesn't. If you're developing policies and procedures, you're working with an ISMS or whatever equivalent and

you're just adding paragraphs, adding paragraphs, adding extra information, you're slowing the business down. Ask yourself, are you actually talking to them? Are you talking to management? Are you talking to the process owners, the risk owners? You'd be shocked to know the theory actually works. Go and talk to these people. Don't be scared. And these are the sort of things I would regularly see, you know, activity without meaning. We've blocked 7 million messages. Yeah. >> Risk without content. Vulnerability. This vulnerability is critical. Still don't care. And so forth and so forth. If I speed up a bit because chat a lot. So our dirty laundry and there's a lot of dirty laundry. And this is what I

think it's important to think about. I reference laundry in the keynote talks. So where does this all come from? It causes fatigue in the industry and it's not just you who reads it. Other people read it, your colleagues read it. Um who are your detractors? What do we mean by detractors? Who's actually stopping you doing your job properly? Who has influence and actually scared about you? Who's scared about the information that you know about? That can also slow down your process. You need to sort of recognize who's making your life harder and this will help you through to next step. I mean the social media drama as I say it definitely feels like murder in a room

or definitely an issue and anybody who watches Bluey will know exactly what this is and if you haven't watched Blue is great I love it. Um, so don't be educateful. Work on that management layer. Get rid of the FUD and start thinking why should I care? I'm not doing the voice. If anybody's watched Blue before, NOT WHY SHOULD I CARE? There you go. Did it. Um, if the message cannot be answered, you can't answer the question you're trying to ask. Don't ask it. You've got it wrong. Or you've gone so far down a rabbit hole. You've done all this great detail. Nobody's going to listen. And that's the worst thing you can do. News flash everybody.

This might be really scary to some of you. The seauite do all know who hackers are. They have heard of hackers. This is not 2000. This is not 1990. I appreciate some of you weren't born then. Um they already know what ransomware is. They already know what fishing is. So don't tell them they got loads of attempts and loads of attacks. They know. Go back to original slide. Why do I care? Cyber's been caught somewhere in time in the in the risk register for a long long time. Who knows? Who's ever seen that risk register and cyber's just been one line and then something really boring in HR's got about five or six lines. If your business has been around for a

while, this is a very difficult discussion. Has anybody and this is really boring and I'll be honest, I don't do this very often. I try not to do it. Anybody actually picked up the Financial Times and read about what the Financial Times says about cyber? That's what your seuite's reading. And I've I've read it and I've read about those two letters. I'm not saying it. This has helped change your message. Don't bore them. Most of my messaging now, by the way, is about two lines where it went bigger, bigger, bigger, shortened down. Now let's change those questions. What should should this delay the acquisition? Uh we accept this risk. What investment are you after? That changes your setup.

For those who know me know I'm a massive Formula 1 fan and I'm, you know, I'm going to try and watch some of the Dutch Grand Prix today. [gasps] This was actually said one by David Croft earlier this season at Austria and I loved it and I put it down my notes. Pressure is a privilege and obviously talking about the 22 racing drivers and everybody else part of that process. This comes back to what I mentioned earlier. If you're part of incidents and you're part of the being a knowledge database in your organization, people come to you for answers. Congratulations, right? They do trust you. If they're coming to you to ask questions, they do trust you. That is

part of that privilege. It's about just changing that privilege. You are the trooper that the business needs. So they they do care that you want to be there. So when people aren't listening, let's start preparing for the next steps. When you get into leadership, you sometimes feel like you're the only department. What I mean by the only department is you're the only department who's got to understand about other departments. Other departments don't give a flying monkeys about your department. Save yourself for self there. [gasps] You don't have to know their policies and procedures in and out. But you got to know enough for the policies and procedures you put in place and not stop them doing their business

by understanding and appreciating their business as usual. This will help your progress with the seauite. It will help your progress with the board and actually it'll improve your progress with your own security culture. You'd be surprised by becoming a friend as opposed to being a prisoner. you'll get a lot more done giving that biscuit having some biscuits with a friend in the office having a cup of coffee. Um, one of the things I did uh about 3 years ago, I invited different uh leaders in the organization to come and have a coffee with me. We had a sit down and the first question was, "What do you think I do here? What's my job? What do

I think? What do you think I do for a living?" I had everything from an IT geek in a corner, which was interesting because that's the guy who pays for my wages. Um, through to the correct role. It didn't really matter what they said to me. That gave me an understanding of right, these people I need to bring up. Those people are already my friends. I don't need to really spend too much time with them. And we're starting to work with the organization. The difference is this simple process allows the organization to start working with you. It's a great feeling when the business come to you for help. Great great feeling. So when you are in senior

leadership meetings, when you are at board level, it's not new. They're already aware. So go back to our news flash. They know a bit more information. You start having conversations like you told me about that the other day, didn't you? Yes. I'm after figuring, yeah, £500,000. Right. Okay. I know about it. or they've gone off and researched it. Exact hate being sideswiped. They hate being blindsided. Remember, a lot of this one I'm talking about is mistakes I've made. So, you know, I'm practicing what I preach, but I used to not practice what I preach. So, let's play a bit. We're kind of playing with manice a little bit here now. Right. So, I'm going to change

here. This is the third book recommendation. Again, this is a very unusual book to recommend to a cyber security community. Something we don't spend enough time on is how we project ourselves, how others see us. And this is going to sound very unusual. I get really annoyed when people tell me I'm passionate and loud. Sorry if everybody thinks I'm passionate loud right now. And I want to get more passionate. I want people to understand what message I'm trying to get across. This book changed my attitude. So if you think I'm passionate loud now, you should have seen me before or come to besides exit where I wear pink shirts. That's a different issue. It is hard work to be negative. It is a

natural thing you want to do. You just want to be negative about all you stop doing a thing. You stop trying to do a thing. [snorts] You actually use equal amount of energy being [clears throat] positive. Positive ments. Yeah, that's great. Doesn't always get you very far. Learning to be neutral actually gets you a lot more work done. And I know it sounds weird. Read the book. Makes complete sense. And this book was paid forward to me and I paid it forward onto somebody else. This book teaches you to understand adversity and to relax. If you got incident responders in the room and it's all been kicking off and you've all been doing some investigations been going on for days

and the sea sweet around like headless chickens, it's great to be the calest one in the room. freaks the hell out of them. Not seuite, but you're the calmst person there. That's okay. If you are the calst person in the room, you'll get better answers and better thinking process. But right, we got an example. Oh, you know, it's an average example. Security wants to patch everything. Operations want everything to keep them running. Valance supposed to reduce spending. The reality, if we've been neutral about it, despite most of us being in that column one, because we've done everything we've already been talking about for the past 10 minutes or so, this becomes easier because you're actually helping the

informed decision. You're helping the organization go to that next level. Now, a quick bit a quick bit myth busting. I don't want to spend too much on this slide. Every model works. Give it a dirty. I don't give a to all my my manager is he's very very supportive. He's a CTO. He's very very technical. He listens. It's okay to have a CTO as a tech as a technical manager. It's okay to have any one of these roles. It's just about understanding. The reality is now for today and I speak to all of them. It's just one of them signs the checks. Correct. So don't ask you to see social report too is it's a pointless errand otherwise

you just be a power slave to the executives right so we're now into the boardroom let's go and talk about what really happens they talk about how the basis works how it's for operating you've got 5 minutes maybe four maybe less no clear simple messaging ownership and accountability you want something to happen that's why you're there you're not operations, you're not HR, you're not marketing, you're not sales. So, you want to get very clear. What do you want? You want to be aligned to their strategy, their conversation, their language. Um, we don't like the word strategy in the business I work at. Fair enough. Show us a plan. We have plans, guidance, and options. If anybody works

in public sector, you'll do this already. Do nothing. Do the most expensive option. Here's a recommended option. Give them options. that tells more than oh that verbal diarrhea again. Be transparent. Do not water in your results. If you don't know what that means, do not just give them greens. Do not just give them things you think they want to see. They don't want to see the greens. They only care about why you're in the room in the first place. So if you've got 20 metrics and 18 of them green, don't talk about them. Leave them on. leave them on your desk because it's the two that are not green is the reason you're giving them

guidance and options. Do not muddy the waters. And again, that took me a while to get my head around. So, don't board the board, right? We've already established they're actually quite clever people and some of them quite wealthy. What they don't know, and this is where your guidance comes in, does it delay acquisition? Remember, we accept the risk. What do we invest? That's the thing that's going to land. So this is the takeaway. So now this is a bit you know take photographs of this if you like. [snorts] This is a framework from the cyber leadership institute. I use this. This works. Frame your difficult discussions always this way. First section own it. the facts that need to be owned and

discovered for the thing you actually own in there for in the first place. Nothing else. Frame [snorts] it the translation layer from technical to operational. So you got all that great stuff for being the engineer. You'll be all that great stuff on your metric and all that complication. Now let's think about from their point of view. Guide the ask the guidance to the management suite for response. And I don't forget that you're in there for a response. You want them to ask questions. You want them to answer. Don't be in there cuz that was the worst thing to do. The last board presentation I did, the CEO said to me right at the beginning, don't

want anything technical, Pete. I was like, "Yeah, right. Pops." Cuz I knew there was nothing technical. I thought I think the only technical thing we spoke about is because they asked they asked what the word posture meant when it came to cloud posture because that was a word in our metrics. So no surprises, keep the story clear. Make sure you know who owns it, who's going to do it, any compromises, any trade-offs because you can't always stand your ground. And finally, how it aligns to what the business wants to achieve. So here's an example. We've got our activity. So this is the thing the engineer said. We've blocked 7 million unwanted emails. Good for you, chap.

Condition. This is our frame. Our email platform is approaching an important life or it's just [ __ ] One of the two. The latter is where we're at in the moment. The type that vendor can see me now. You know why? Give me pressures. And the last one, what am I actually asking them? We recommend replacing it. We want some budget. We want to do something different because they already know about fishing. We've already told them. So, this is a template. Please take a picture of this. All right, this is this is this is the one. All right, I'm going to keep on the screen for two sec. Um, this helps us move forward. This is your

final frontier. This works. And by the way, it works at your level if you're just an engineer or instant response or whatever you are to your manager. This process works. All right, ready, steady, go. You've done your bit now. You've done your ownership. You've done your frame. You've done your ask. Now put it through the opport sounds better. Sounds more military, doesn't it? Add this to yourself. This is not asking about. You ask this to yourself questions. You've got your ready. You got your activity and all that process ready. What's the outcome that you want? Well, either A, B, or C. What are the options I've given them? What's the value to them? So, make sure the setup

you've got. Okay. So, ops care about that. HR care about that. Okay, I've got I've got the right people in the room. By the way, that helps with presentations. So, if OPs are sat there, I'm talking to you there. >> See proof what makes it credible. It might be a metric. And if they've never seen that metric before, try and tell them beforehand. Don't just give it them for the first time. So, beginning this year, I changed how all my metrics worked because we had a regulatory change. So, I sent a paper out, onepage paper, going, "We're doing this. This is how it works. Any questions? Sat two meetings. I had about one or two questions. They

see them every month. I give you a question about why certain things are not green. Oh, wait a minute. This is working and ownership. Who's going to actually do it? Who's validates the information? It just helps avoid that deja vu or rejection or management not not listening. So before we close, remember your role in the organization. Remember, you're actually there to help them, not just be the cool defender dude or dudet. You're not the doomberer. The industry has moved on significantly. It's grown significantly. It's evolved significantly. Cyber in 2026 is a brave new world compared to what it used to be. Look at some of the gray hairs in the room. You all remember some of those uh

when it was computer security, it was information security and cyber security. Blah blah blah blah. Here's your 7-day challenge. Please take this away. Okay, take one of the metrics, risks, or recommendations you've done recently that fell on its backside, rewrite it based on what we've talked about this morning. Reach out to me, let me know if it changed, who listened. I would love to know. I'm confident we'll have some decent success rate. And that's it for my philos philosophy. There is no technical stuff in this stuff. It's all very simple. So before you run to the hills, I have stickers. So come and find me for stickers. Uh otherwise, I'll see you in the bar. One

last thing, anybody's noticed the Easter egg in every slide, come and talk to me at the bar later. I'd love to know if you found them. THANK YOU. BYE.