Human Risk Management 2.0

Auto-generated from the live recording.

0:07All righty, thanks. So I'm Jon Brickey, Senior Vice President of Cyber Security Evangelist at Mastercard. And I like to tell people that I do have a day job. So this is kind of part of my day job. It's one part of it. I lead a program called SHIELD. And probably the most relevant thing for this group is that one of the programs actually are the most matured oldest program in that is our security awareness. So, and actually Tim Taylor, my VP is on the line for this. So this is great. I did wanna start with a little bit of a disclaimer that my attendance here doesn't constitute any endorsement of a product or service, but I will be talking a little bit about the Unify platform because we do use it.

0:57Also, what I'm presenting here is a little bit of a mixture of aspirational concepts, things that we think should be part of a human risk management program, as well as some actual implementations. And I'm not, I'm gonna try not to get too far into like, this is how Mastercard does it, but there will be some mentions. And I also wanted to just say in general that we love being part of this community and we connect with a lot of practitioners in various venues. And so we'd be glad to talk to you if you wanna reach out after the fact and talk more about our program and just some thoughts that you may have as well.

1:37So I'm gonna cover what I'm calling here as human risk management 1.0. I'm gonna, of course, set it up as anyone would, set it up and say, well, this is where we're falling short and then talk about 2.0, discuss, like, how do you get there? What are the things you need to do? And then leave you with some takeaways. So I will say just as a little bit of background on me, I'm not sure how much information you guys have, but I had some experience with this when I was in the Department of Defense where I served for 30 years. So bring a little bit of that with me, but I was not deep as a practitioner in this space throughout most of those years, although on the human risk internal insider threat, of course, we have a lot of training in that area.

2:25So I'm gonna just start off with a little bit of a definition. And this is an adaptive definition from IBM's on risk management. So I'm defining human risk management as identifying, assessing and controlling human risks to an organization's capital and earnings. You could just as easily say to an organization's mission, especially when earnings aren't involved, it's a nonprofit or some sort of government organization. And then there are different categories of risk. So this falls into preventable risk and internal controllable as opposed to external and strategic risk.

3:03And then as far as who it covers, this covers all insiders, whether they're intending to cause harm or it's unintentional. And this is just one area where I gets into what we do at Mastercard versus what we think, what we believe is the right thing. I personally feel that human behaviors are not understood very well when it comes to the cyber domain. And I think that to do human risk management properly, as much as possible, this needs to be under one group.

3:39So the insider threat, as well as the accidental or unintentional threat, I think needs to be part of one program. And I think that you actually need practitioners who understand human behavior more than just, they read a couple articles. I think that to really put this into high gear, you really need to have people with expertise in psychology and human factors. So moving into what I'm calling human risk 1.0 or what we typically call security awareness.

4:17These are just some of the challenges that we're all facing. So one is, in many cases, if we even have a program, it probably was stood up because we were told we had to. So there's a compliance aspect to many of these programs. And I would argue that the ones that are not doing well, that are not engaging their stakeholders or their staff are probably still stuck on that compliance piece. They're just doing what has to be done. And I'm sure all of you here have been involved in organizations, maybe current ones, maybe previous ones, where those things that get checked get done, but they don't get done very well.

5:00So they can tend to be static and just a checklist. And when everyone tries to cram in all the requirements and there's no, when everything's a priority, then nothing's a priority. So if you get a lot of different teams kind of jumping in and say, oh, now you gotta talk about this, you gotta talk about that. And they may not even be security awareness based content. It may be, well, it's privacy, but we have this security awareness training, so we're gonna put it on there as well. So it tends to get overloaded with a lot of other content.

5:39And on the boring side, so we don't necessarily have the content and the expertise to make it really interesting. So one thing, and I will say this is what we did at Mastercard, not saying it's the best, but we brought in an Emmy-winning vocalist named Sekou, and he did some really engaging presentations for part of our training. And that really changed it for us. We, for a good couple of years there, we had a campaign that involved a lot of different initiatives. We had our screen savers like you have here with limited security at the top.

6:15We had Sekou and we had some really fun messages put into all this. So that was really exciting for us, but typically they tend to be on the boring side. I know at one point, I was talking to someone, they wanted to get the rock to show up and do some work for them. I'm like, okay, what's that gonna cost you? Your chances of getting the rock are pretty damn slim. Now, if you get them, I'm sure it's gonna be fun training. I'm sure you're gonna get a lot of, yeah, Sekou, thanks Tim, you're gonna get a lot of great engagements. Or even if it's not great engagement, people are gonna remember that. And then maybe they'll think about what the actual message was.

6:52And that's what we do with Sekou, just he sounded a lot better than me, less nasally, and was just very captivating the way he spoke. But that doesn't apply for most of us. And if for God's sake, don't take somebody and just give them the job because it's their job. Like if you can reach out across the organization and you could find somebody who wants to help and be part of it, hopefully you don't have to pay for that person, but then by all means, try to make it more engaging. But typically we don't do that. And then the last piece I'll just say is that we really get a limited view of human risk.

7:27So if let's just say that a new program only has like efficient simulation program, that's how they measure their performance. Well, as you all know, that's only a sliver of human behavior in an enterprise. So you're gonna get some data. Is it really the right data? Does it really measure human risk? Is it a good enough proxy? And what does that tell you? If you have a 10% click rate, does that mean that it's the end of the world for you or 20% click rate?

8:04Is that, that's a simulation. So does that really measure what the human risk is? I'm sure there's probably a lot more out there that you'd like to get, but you might not have the maturity in your program, you might not have the resources or just may not even understand what's out there. So I'd put that area on the left side here of the maturity model and Tim and team developed this based on some guidelines from SANS or an example from SANS. So if you move up beyond that, so as I talked about, we all kind of have the basic compliance checklist and then we have most companies are also promoting awareness.

8:42Maybe it's in October, you have cybersecurity awareness month and you do some other events like that, or maybe you put out some information before the holiday season about different scams or before the elections. So that's all good stuff. And that's all what I would consider the bare minimum, the basic security awareness. Really moving up into what we're saying is human risk management 2.0, it's being much more mature. So it's just deciding on metrics in advance. What's important to the program, but more importantly, what's important to the organization? What gets reported up?

9:17I would argue that even if you have a number of measures that go into the metrics, that's difficult to do, to really understand and come up with a model that has data and actually means something and is not just a number. So I'm gonna talk a little bit more about that later. The other thing is culture change. To really make a difference, this is gonna become part of your culture. So everyone loves to say culture eats strategy for breakfast. Well, unfortunately I have culture and strategy under my program, and I'm trying to do both.

9:53But culture, it just so happens that the lead from my security awareness team also is our lead for our culture. So our whole culture program within the security organization is an added layer on top of what the enterprise does. And so we put a lot of thought into that and we're able to help drive that narrative and try to really bring people together to think about security more than just a checklist and more than just the annual training. And to sustain all of this, you have to make this whole program engaging. First of all, you need to have a program. So as I mentioned, more than just a checklist, more than just your annual training, more than just a phishing simulation, you really need to look at the whole picture.

10:35What can we do? So we have our own branding, secure it, and Mastercard. And with that, we have all kinds of other things that come along with that, whether it's individual risk scores, which I'll get into, or it's your phishing simulations, or it's just general campaigns that we have, whether it's bringing in experts to talk about what we can all do to be more secure. You really need to build a program around that. And that includes things like the incentives. Just telling everyone what's the right behavior doesn't mean that it's gonna happen. So you could do things like incentivize through gift cards, through awards.

11:11We have phishing tournaments where we reward people for identifying and reporting actual malware, actual phishing emails. So there's also, we're very fortunate at Mastercard. I should have said this earlier on. So Tim on my team, Tim Taylor leads a pretty robust team. We've got five full-time staff on that team for the number of different programs that we offer. So whether it's under our secure at score, or it's training, we have a school, a phishing school for staff, the different awareness campaigns that we have throughout the year.

11:53It's a pretty robust program. And so that is not something you could just create overnight. It takes trust. It takes an enterprise that believes in this from the top down. And just in the past we had our previous CEO was on a presidential board on cybersecurity. Our current CEO is very supportive. And one thing that helps sustain it is that port. Whenever we do our individual risk scores or efficient simulation scores, our executives share that information and they compare each other. They love to brag about who beat the CISO.

12:29Our CISO even paid for a pizza party for the winner winning division in a competition last year. So it takes that kind of engagement to really sustain a program and to make it really something that's a mature program that will thrive. So some of the other things that I think should go into this is that, again, I mentioned some limited telemetry before. If you just have, you know, hey, what, did we get 90% of our people completing the annual training? Did we get a phishing click rate of 5% or 10%, whatever the number is, what did we get for report rates?

13:08Those are just really the tip of the iceberg. So to get to human risk management 2.0, we really need to look at what are, what's all the other data out there? And again, going back to like, what's your model? What is a good proxy for human risk in the enterprise? And so you have a lot of different sources of data on behavior. Also want to point out that there's a difference, I think, between what an individual does and kind of like who they are or what access they have. So there are things that they do, and we look at that differently as well. So if someone does something, that should be categorized and it should be reported and part of a score.

13:47If somebody just has elevated access because of the role, it's not something that they can really fix, but they need to be aware of it. And we need to look at that overall as we think about what our risk is. For example, if you have too many people with access to, with elevated access, they can all be the best people. They can all individually score really well, but you still have a lot of access. And so that's a challenge and that's something that you need to identify. One thing I'm not gonna get into here is AI. So I know everyone likes to talk about AI. That's great.

14:23And I think there are lots of benefits of AI, but for this specifically, really, I think automation is key because if you only have one, two, even three, even if you have five or six people like we do, you still need to automate things. So for example, pulling in all the telemetry, pulling in all this data, that's not an easy job. So if you can automate that and you can also get insights very quickly from that, then that's very helpful. Our team also reports out as I'll talk about to other parts of the organization 'cause we need them to be engaged. We can't be the ones out there with the bullhorn talking to everybody in the enterprise.

15:00It's too big of an organization. So beneath these general categories, I'm gonna identify some additional behaviors. I'm gonna neither confirm nor deny that we're using these, but I will say, going back to my comment earlier about aspirational, there are lots of things we'd like to do and it's part of a journey is understanding, okay, if that's what we wanna, this is the behavior we want to reward and we want to report on that who owns the data, how do we get the data, how do we automate that and then report it out in a meaningful way. So there's probably a lot more data that you have available that maybe you haven't thought of.

15:39And so we've been thinking about this for quite a while and we've been implementing some of these as well. So whether it's somebody's, there's a lot of data about our endpoints these days. There's a lot of data around privacy as well. I think everyone's kinda got a handle on the phishing email part of this. There's also things like the training data, like, okay, who completed the data? How early in the process did they do it? Are they doing this, you know, within the timeline that they were given it or are they doing it leisurely whenever they feel like doing it? Are there additional training out there?

16:16Like for example, one thing we're hearing from regulators is they're role-based training. So you've got the training for all, you may have training that's just for some of your staff. Like for example, your developers or your business assistants. And then you could look at the very advanced training. Okay, maybe the very advanced training you leave for or the training for few, that may be based on actual behaviors. Like if you get people entering credentials in your phishing simulations, then maybe you single them out and say, okay, we've really gotta focus on this 'cause this is high risk.

16:54There are also physical security indicators. For example, if somebody continuously loses their badge, maybe if somebody, you could also look at emergency notification systems. If people reply to those, maybe that could be part of your score and it just makes them a little more alert. The last one I wanna leave was really supporting the enterprise with policy, different policies. So for example, if your organization is implementing a passwordless authentication program and it's not mandatory or some other policy that's not mandatory or even if it is mandatory, you could use that as part of a score, use that as part of your reporting.

17:36And then that could help drive adoption quicker if people are comparing scores to each other and trying to one up somebody on their team or one up their boss, which is what we see a lot of times. So just to give you an example of like how we see risk. So at Mastercard, we're very fortunate in that we acquire a couple of companies that do risk quantification. Now what we found is that they don't really dive very deep on the individual or human risk quantification. So we've been working with the team for a while and now we're getting to the point of coming up with a metric for the enterprise.

18:14So not just an average of the individual, like what's your click rate, what's your reporting, that's an input to what we see as an overall human risk score. And the human risk score may include some measures from your insider threat program. So we're not gonna put information on a risk score about one individual, we're not gonna name them out at this level, but maybe there's some way that that factors into the overall human risk score. And we think it's important because we talk a lot about technology and we talk a lot about different processes, but I feel like we leave out the human part.

18:49Now, if you're getting at least your click rate and report rate in there, then good on you. That's good that you're getting that at least discussed at the executive level. But we think that coming up with what is more meaningful involves a more holistic view of the different data that you have. On the human risk side, sorry, as overall as a team though, what I wanted to say was, even if you have a large team, even if you have the resources to support your program, there's a good chance that you can't really do this effectively without the help from many others. And we're very fortunate that our team is able to work across many divisions at Mastercard.

19:29Very important to work with communications, like they help with the messaging. It's also important to help to work with human resources. Many times you can't do hardly anything without human resources, especially if you're dealing with a global workforce. So if you wanna implement a policy like a progressive discipline model, if you wanna actually be able to terminate employees, you have to know, you know, in someone-employee relations, you have to understand where your employees are, what rules apply, you've gotta work with human resources. Alongside of that is also legal. Risk management teams, we have three lines of defense, and so we have risk management people spread throughout the enterprise, and so understanding what's important to them and how our risk scores integrate with the overall picture is extremely important.

20:13And then I'll just end it with the business units. So our business units, there are many of them, they're all around the world. We have regional security officers, so we work with them to help communicate this entire program. And to also get feedback so we can make it better. And believe me, we get feedback. If we don't do something right, we hear back from our staff and that's a good thing. And so just to end up my time before, I think we might have time for questions. I just wanted to say that you gotta do the bare minimum, and if that's just Human Resource Management 1.0, then so be it. You could always try to build your program and look to others for advice on how to do that.

20:51Also, that there's a lot more data out there that you might wanna consider as we talked about. And then to do this effectively, you really have to work as a team. And so try to partner with different pieces of the organization and find a way to get them on your side.