2. The views and opinions expressed in this session are those of the speakers and do
not necessarily reflect the position of:
• Our Employers (We do not want to lose our jobs);
• Our Family or Pets;
• Our Friends (well, some of them we blame);
• Republicans or Democrats;
• Our Social & Service Organizations;
• Any ISSA Chapter or InfoSec Organization we pretend to belong too (we are still earning
street cred at some of them…..hey there WSC!);
• North Carolina; or
• Fake News!
AND, we are not condoning some of the acts highlighted in this presentation. Without proper
authorization and/or consent, many of the things we discuss can have serious repercussions.
We cannot afford your bail money or your attorney fees.
3. Who: Mark Felt aka “Deep Throat”
Known for: Watergate
Position: Associate Director of the FBI
Who: Sherron Watkins
Known for: Enron Corp
Position: VP Corporate Development
4. Who: Edward Snowden
Known for: Leaking NSA classified information to
the public
Position: Computer Security Consultant
Who: Bradley Manning
Known for: Leaking classified, unclassified, and
sensitive documents to Wikileaks
Position: 35F Intelligence Analyst
5. IT STARTS HERE
“ The only way to
remedy a human
problem is with a
relatable human
solution.”
Dr. Mansur Hasib
6. COMMON
MISCONCEPTIONS
• It’s not me, it’s the culture.
• All users want to be trained.
• It’s not worth fighting, it has been like this forever.
• Training should differ for entry to mid level management and mid
to upper level management.
7. “Every interaction trains
users to behave securely
or insecurely. There is no
middle ground.”
Dr. Kelly Caine
REFLECTION
• Personal culture versus organizational cultu
• Morals
• Experience
• Educational background
• Sorting importance
• Bringing it all together
8. “Goals are harmful
unless they guide you to
make specific behaviors
easier
to do.
Don’t focus your
motivation on doing
behavior X. Instead,
focus on making
behavior X easier to do.”
Dr. BJ Fogg
WHERE DO I FALL
9. WHERE DO I FALL:
CHANGING BEHAVIOR
Behavior
X
Behavior
Y
• Which behavior would you
choose? Why?
• Triggers: 3 Types
Facilitator = High Motivation/Easy
To Do
Signal = Hard to Do/High
Motivation
Spark = Hard to Do/Low
Motivation
Facilitator
*
Signal
*
Spark*
10. TURNING A WEAKNESS
INTO A STRENGTH
Option A: *Complete Overhaul or an Epiphany *Not addressing the core issue
*Not cost effective or realistic has the *Lack of long term vision conjoined
largest financial impact with changes in cybersecurity.
Option B: *Change your environment *Works only for an individual
*Can be cost effective but rarely is *Only works if you are not the issue
has potential long term growth *Can be taken as avoidance versus
acceptance of change.
Option C: *Take Baby Steps *Gives the ability to combine
*The most cost effective option waterfall agile approaches to
and has sustainable long term change culture.
growth.
11. TURNING A WEAKNESS
INTO A STRENGTH
• Establish your knowns
• Establish your cultural
norms
• Activities in the
upper-left quadrant
offer “good value” at
a comparatively low
cost.
• Training shows the
highest ROI Cyentia Institute study New Research: Voice of the Analyst Study
2017
12. TURNING A WEAKNESS
INTO A STRENGTH
• Combine the top to the bottom waterfall employer driven approach with the collaborative
team building approach when it comes to training and cost.
• Create an overlapping training model that shares cost with the individual and employer that
creates a win win culture that grows together.
