The Psychology Of Cyber: Navigating A Crisis Like A Pilot - George Chapman

All right. Well, fantastic. Thank you ever so much for coming to my talk. As uh as I was stated, the psychology of cyber and navigating a crisis like pilots. So today's talk is going to go through a few of key principles around a bay communicate. We're going to talk about no blame culture. And we're going to talk about the the perils of panic and principles and how the human mind changes under basically fear and how we go through that whole realm of instant response and what do you do if things go wrong and how do you handle it and how do you handle the people that might be responsible for that. But who am I? So

as said my name is George Chapman. I'm a team leading senior consultant from Ches Group. Um so I've primarily my work is divided into four separate areas. three primarily being penetration testing, incident response and red teaming and I have a fourth out of that which is also vulnerability research. Back in 203 I discovered a CVE of critical nature in the ABB appliance that allowed us to get a privilege escalation to roots hold a BSc in computing cyber security elements uh from the University of Worcester and outside cyber in fitness and ran London marathon earlier this year BHF. So if we look at human psychology, it's existed for 300,000 years, but cyber security as a whole has only existed

really for about 30. And we know there's a lot of lessons to be learned here and about how the principles of that can be applied. If we look to Aviate, navigate communicate for decades. This has helped pilots combat a crisis and they know what to do in this situation. If a plane is encountering an issue and something's going wrong, they know to follow this to the letter. So how can the principles of that be applied? We're also going to look at cultivating a blame culture and the importance of taking people along and empowering people on that journey of security. Get the root cause faster. The quickest way to the root problem is direction from the person that knows where it is and

how to solve it. And finally we understand human behavior. How the mind operates? How it deals with panic? How does policing procedure help us get through that? So with a pilot, we know that if they're going through a crisis, they have AVA Navigator to communate, sorry, AVA, navigate communicate to follow. And they know that the number one rule is keep flying. Before they know where they're going, before they know what to do in terms of talking to base, they're to keep flying. That's ultimately what they to do. Once they know that, they know where to pick. Are they going in the, you know, are they avoiding the river? Are they avoiding the mountains? What are they avoiding? Where are they going?

And finally once these have been applied then it's communicate back to aerospace back to base. So how do you compile this to instant response? Well you maintain control systems and you isolate the lists quickly. You isolate affected assets to stop that further damage. Once you know that and you know what's been affected is it domain controller is it? What can we see on the scene solution? How bad is it? Once we know that this then leads into quick isolation and what we going to do we all need to understand the actions to mitigate this and then from here once we all know this we communicate it we go back to the bridge meetings the stakeholders how are we

going to get to BOE business as usual how are we going to take this forward so the importance of the no blame culture is is really interesting because ultimately if people make a mistake and everyone makes mistakes how do we take those people on that journey how do we empower How do we tell these people that ultimately, okay, you've made a mistake and if it's a genuine mistake and it's not malice, then how do we how do we help them with that? Because ultimately scorning them, telling them that this is awful and whatever, you're going to create a culture where people don't want to speak up. They're not going to tell you what's wrong. They're not going to

tell you what do I do now. So, who can tell us about a no blame culture? This is Matly Diet Loft who was the deputy chief NJ of Chernobyl in 1986. Now this is a really interesting story because obviously an awful disaster but there were key few key things that dialogue did which were effectively portrayed in the trouble series but he reluctantly reported issues during the test isolation. He dismissed engineers warnings and ultimately blamed subordinates and minimized his own responsibility. He did this because out of fear he knew that it was a career ending mistake what had happened and it was going to ruin his career ultimately. So risk safety tests knowing it violated operational

protocols. This kind of no blame culture is what happens and you end up with ultimately a disaster. So how do you build an open culture? What what we do to protect the people who work for us and empower them on that journey. So you build it into employment contracts. You know that in the on boarding process if a junior or whoever it might be clicks on a link picks the USB stick in genuine you know accidental whatever it might be you tell them that okay this has gone wrong but you're not going to get fired this is what happens now you told us so we know this is where the the problem stems we know where your

system or where your account can access and we're going to bring them along on that journey and take them through that we're going to integrate obviously into employment contracts but then reinforce course raising it promptly. We don't want them to sort of sit and hesitate. We want to tell us now because the sooner we find it, frankly, from a economic perspective, it's far cheaper. Instant response isn't cheap, but it keeps people working and going quickly. And once we know that, we can operate that and reduce the time that potential attacker has on that network. And then we sure everyone understands that everyone benefits. You import this through training and good policy. As we said, let people know that the data they

hold is important and data security is important. Once people know that the mandated training is is going to bring them along on that journey, people going to know that ultimately my data is important. So, I'm going to raise this. I have an issue. I'm going to use this going forward and ensure that I handle data more appropriately and more safely because they might not know, they might not understand. And that's I think where security should always be a an open sort of policy across the business. It should never be us and them. You should never gatekeep. You need to take people along on this journey and say, "Okay, this is what we do. This is how we're going to do it."

And okay, if you failed a fishing exercise, that's fine because this is the train we're going to implement to get effectively you to a better standard. And here here [Music] so how do we understand human behavior post the brain of fear now this is a really interesting quote which states that when we're emotionally upset or stressed we can't think the IQ points we need to thoughtfully consider decisions are defeated temporarily and because of this our mind puts into perspective and puts into action illogical basically solutions problems that could be done or could be planned for as well as normal policy. So if we look at the human behavior, how stress leads to rational decisions and

the common instinct being do this, do this, do this, do this, fix this, fix this quite quickly. We know that ultimately these aren't correct. If you're in a room full of people who are scared, that's going to change how you feel and it's going to change the decisions you make. The words on the page don't change, the thoughts in your mind do. And that's really key. Your thoughts do especially under pressure. So you account for this by writing clear policy and you build confidence and calmness in high pressure situations. You account for the unpredictable behavior under stress by testing it and testing it again and train through it. Once we know this, we know how the human

mind operates. We've done some training. We know if this domain controller, this mail server, this is your account gets popped, we know what what to do. We know where they're accessed. And then this is back up by principle of lease privilege. Ultimately across the business, people need to know the importance of their data. And if they don't need access to elements of data or types of data, then don't give them access. If they don't need it for their role, don't give it to them and review this consistently. If we look at people as a whole and we look at the fact that 95% of cyber attacks are ultimately because of human error, then we know that largely if it

is because of human error, we can work on that. We can build the people. we can help people through training and help people understand the importance of security. Uh this is a great quote from Dr. Barker which says that effectively the human can be the weakest link in security and be manipulated but it can also the strongest link too and this is where we're going to go into that. How do you build the people? How do you help bring those people along? So you build the people obviously through training and policy and procedure and then you go into like a war room and you disaster recovery test this. You go through what happens and you test this much like backups where

you need to integrity test them. You take them through what what could go wrong if this someone gets here. What could happen? And then we also look at things quite morbidly like bus factor. If someone has done this for 10 years, they've been the one that's got a car and done the backups. This has never been tested. It's always been this way. What happens if that person's not here anymore? What happens to that person leave? Has someone got the SSH keys to go back into this backup server? Where are they? what what happens and you need to stress test almost like a puzzle and pull links out the loop and see what breaks because once you know what breaks

you know how to fix it and you have to fix it before your time pressure before you're under effective pressure. So you test the scenarios you haven't thought of and you scenarios you have thought of and you test them again and once you know that you can stabilize you can test it consistently and then you can bring people along on that journey by ensuring those plans align with the business requirements. How do we get to BAU? Because ultimately the business still needs to make money. The business needs to continue. How do we do this? We do it in a way that aligns with those objectives and then do this in a way that allows you to okay in a degraded

state. We might lose our payment gateway. We might lose this temporarily, but how do we go forward? And that proactive thinking as opposed to reactive thinking is going to be really key. So what are the takeaways from this? But we know to Aviate, navigate, communicate, this is something that's gone through aircraft and airlines for hundreds of years. They know it works to help pilots manage a crisis. They know that ultimately to keep going, work out where you're going, and then finally communicate down. And we don't jump on those steps. We know to cultivate a no blame culture and bring people along on the journey because ultimately that punishment doesn't always help in a genuine scenario. Bringing people along

and not making them scared will help them raise their hands. If they are in fear, if they're worried about something, they will know to stand up and say, I found this. And that friendly culture, it allows people to have that sort of sense of knowledge sharing. So people are going to know that, oh, you shouldn't do that. You should do it like this, do it this way. That can only be collaborative in a business in a positive manner. And finally, you understand behavior. You understand that when people are panicking that ultimately we've done this in training, we've done this in testing. We know what needs to happen now and that is go to the policies that should be quickly and

easily accessible. People to know where they are and resilient. Test them. Test them consistently. Once you've tested them and you know work, then if it happens, potential incident is far less scary because we've done this before. Okay, it's not great. It's happening, but we know what to do. And then that across the whole business gives a holistic approach to security. >> Thank you. [Applause] >> We have any questions? >> Yeah. >> Any questions at all? >> Yeah, go for it. >> Um, so you were talk you talked about like cultivating no blame culture and how training is a massive part of that. Um, specifically when you talk about war gaming and for instance, I was wondering

in terms of cultivating that no blame culture. I guess it's all very like well having a war game though it's fake people are like so stressed about stuff but a real scenario. How can you train to have a no blame culture when say more senior people often you are under that pressure? It's a human nature to blame. I'm wondering what kind of training people. >> Yeah. Yeah. So to be good people, I guess >> I don't know. I wonder how that's kind of combed if that makes sense. >> Yeah. Yeah. No, for sure. So repetition, right? That repetition of training and policy allows you to take a fear out of it. >> There are going to be people who you

might not see. They might be in different offices. They might be in different parts of the world. You're going to be on calls with them. But you need to succinctly communicate the facts and that that is done through training. So you get training down to a point where it's as realistic as it can be. When you start adding those unknown factors, then of course going to be fear. There's going to be that sort of oh no we haven't tested this before. So you go back through the training and you go back to the policy. If you go back to the policy and stand on it and say look this is the policy of what happens. This

is what we've done before. The stakeholders are going to know that. Stakeholders are going to know that okay this is what needs to invoke Dr. this is how we're going to handle this. We might have to send some emails out and tell people, but ultimately that's right sort of toward a sort of disaster recovery point of view. But if we know to recover from it, what's been affected, we can almost push that almost think of it like a river with diverting water. Okay, we're going to have to stop this part of the process and that procedure. We're going to have to push it this way instead, which isn't often stress tested, but that's why disaster recovery

works because you stress test the untested. So hopefully that bit of an idea. Fantastic. Awesome. Questions? >> Yeah, go for it. >> Um, so what would you say accountability means in a no blame culture? >> Accountability and a no blame culture. >> I would say that genuine mistake that isn't grace misconduct or mult is quite clearly that someone has made that mistake I think is really key. Obviously if it's malicious that's a completely different conversation. But someone that's junior or maybe is working on a new system. They haven't been aware of this policy procedure which then ties back to training is is coming at it from a friendly open way because that knowledge sharing can often stop people

doing things in a way that isn't correct. If you spot someone that's doing something incorrectly, that open culture allows people to go, "Hey, by the way, you should probably do it this way. Probably not do it this way. Um, this is in the handbook." And you enforce that through training. Hope it helps. >> Yeah, go for it. >> One of the points you mentioned building in the culture into employment contracts. Yeah. Do you mind just expanding on like an example? >> Yeah, for sure. So you you build it into employment contracts to protect that person. So people need to know that ultimately if they make a mistake, they can be educated through that. They be

trained through it. They're not going to be disciplined for a genuine mistake. And if you build that in the the initial part of that, so there's legalies around that and everything else, but the initial part of that allows that person to stand up and say, "Look, I've done this. I made this mistake. What can I do now? How can I take this for? What do I who do I need to talk to?" And if that's documented and that's communicated, that person isn't going to sit on the issue and panic and worry about everything else over their lunch break or whatever it might be, they're going to know that, okay, this is the person I talk to. This

is the security officer I've got to talk to. this is how I raise the issue. This is where I need to go now. And that that can only help people because they're not going to be worried about their job. They're going to be worrying about who do I tell now how to stop the spread of this potential issue. >> That's it. >> Yeah, go for it. >> How common is that to have it in the contract? Is it >> how uh like a hypothetical? >> It it depends on the organization, right? So, you might have people who and organizations that are really open um and are really not gatekeeping. they might bring people along. Every

organization company's different and often you don't know what's in the contract until you get a job and then you're you're looking at it, right? So it it can really change um massively. There's no sort of right like one size fits all contracts dependent on your responsibilities, dependent on your operations. It it's really key in changing to that. You can pick up on a cult quite quickly when you start. Um, and once you pick up on that, you can then kind of work out, okay, what's this kind of business going to be like where work? Um, I've been very lucky where I work is is very open culture. So, we we you know that it's great, but there are

places that aren't that. And it's unfortunate because if you bring people along in that friendly, open culture, it can only sort of bring about uh like a collaborative knowledge sharing. Collaborative knowledge sharing is key. People learn more, people grow more, the business grows, everyone can benefit from it. Fantastic. Anyone have any other questions? [Music] Thank you very much. Thank you very much.