Irrational But Effective - Applying Parenthood Lessons to Cyber Security

Connect | Protect | Optimize
Irrational, But Effective
(Applying Parenthood Lessons to Cyber Security)
Rafal Los – VP, Chief Security Strategist

Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
./whoami
Just in case you don’t know me

strategist, advisor
strategy executive
~25 years in ”the business”
writer
a guy who knows a few things
VP, Chief Security Strategist –
Lightstream Managed Services
professional smartass
Founder
Down the Security Rabbithole Podcast
father of twins

Lesson 1:
Worry when everything is quiet
silence is terrifying to security people

when my kids are loud,
I don’t worry

when my kids are quiet,
I start to panic

3 types of baddies

“those that set off alarms”

“those that leave a trail”

“ghosts”

ghosts leave nothing*

but can be devastating

take-away:
hunt threats in the quiet

Lesson 2:
You can’t prevent every possible oops
bad things will happen, contain the disaster

you can teach them

you can warn them

but bad sh** will happen

sorry, it’s true

prepare them

design contingency plans

practice regularly

involve everyone

build containment in

take-away:
practice reduces panic

Lesson 3:
Creativity beats boundaries every time
always think about human creativity

kids and hackers

demonstrate amazing
creativity

often used phrase:

“How the hell did they
manage to do that?!”

both work ‘around’ controls

I put cookies on the top
shelf in pantry…

my daughter used my SON as a
ladder

take-away:
hack outside the box

Lesson 4:
Your reaction matters more than the
ouchie
never let them see you sweat or panic

the first time your child
falls

they look at your reaction

how you react influences
their next move

if you remain calm, steady

your customers will too

resist the urge to PANIC

take-away:
appearances matter

Lesson 5:
They know better, but will do it
anyway
two words: compensating controls

“I know I’m not supposed to
do that, but…”

don’t pretend you haven’t
done it

recognize this is human
nature

what’s the impact?

sometimes,
you get away with it

sometimes,
you don’t

we provide “training”…

training != behavior

assume they’ll break rules

implement compensating
controls

three strikes rule?

take-away:
“training” no guarantee

Lesson 6:
You, the expert, is never right
the frog won’t believe it’s being boiled

”dad, my friend said…”

authority and expertise

are not absolute

perception matters

proximity matters

relationships matter

be present

be relatable
Complexity Averted.
Possibilities Realized.
© 2019 Lightstream
Communications. All rights reserved.

be “human”

aka: “don’t be a .. donkey”

take-away:
your authority only matters
if they accept it

Lesson 7:
They love you until you tell them no
prepare to be the enemy, it’s OK

my kids love me,
unconditionally

until it’s time for bed

or I have to say no

what happens next is odd-

they can turn quickly

animosity is temporary

trust your policy

what you want is respect

be fair

take-away:
be respected always,
liked usually

Lesson 8:
Sometimes you must meet them half-
way, or else
you can’t fight water, but you can direct it

sometimes policy needs
flexibility

homework is a priority

but it’s going to rain later

play now, promise homework
later

enforce the promise

works the same in business

be appropriately flexible

absolutists always lose

nobody likes a dictator

flex, but don’t abandon
principles / policy

if you don’t strategically
bend

policy will be subverted

take-away:
grant limited exceptions

Lesson 9:
Be a friend, and an authority; but
know the difference
people will take advantage if you let them

children need balance

be their friend

but know limitations

and sometimes you’ll have to
be “aww dad!”

be your customer’s buddy

but have boundaries

our job is relationships

without them, we’re tyrants

coach, counsel

enforce limitations

take-away:
master relationships

Lesson 10:
Tomorrow won’t be better, or worse;
just different
maturity brings different types of disaster scenarios

parents-to-be ask:

“is year 8 easier than 2?”

nope, just different

challenges at 2

challenges at 8

challenges at 18

risk shifts, threats change

as your org matures, this
applies

bigger companies,
smaller companies

different problems

different threats

different scope

security challenges change

security teams adapt

threats, challenges change
as org matures

take—way:
a rock that won’t move, is
worn away slowly

Thank you!
• Where to find me
- Twitter
• @Wh1t3Rabbit and @DtSR_Podcast
- Down the Security Rabbithole Podcast
• iTunes, RSS (https://ftwr.libsyn.com), and almost literally anywhere else
- Lightstream – Consulting, Professional & Managed Services
• www.Lightstream.tech
- LinkedIn:
• https://www.linkedin.com/in/rmlos/
• https://www.linkedin.com/company/down-the-security-rabbithole-podcast

Complexity Averted.
Possibilities Realized.
www.lightstream.tech

Irrational But Effective - Applying Parenthood Lessons to Cyber Security

Recommended

Recommended

More Related Content

More from Rafal Los

More from Rafal Los (20)

Recently uploaded

Recently uploaded (20)

Irrational But Effective - Applying Parenthood Lessons to Cyber Security