Building a Robust Security Culture

Auto-generated from the live recording.

0:07Today's, we're gonna talk about security. It is everybody's responsibility. I think we're all aware of that. You've probably gotten a lot of information so far and that's fantastic. So I'm assuming that you can see my screen. Is that correct? Nick, can you confirm? Yes, we can. Excellent. So building a positive security culture, I'm not gonna read it. You guys are very bright people. We're gonna talk about culture. You probably got inundated with lots of stats. You're probably familiar with it already. What percentage of breaches come through human risk and so on and so forth. But let's talk about culture because after all there's people involved here.

0:43So before we get started, let me introduce myself. I'm the Security Awareness Program Manager at Blackbaud and I've been with Blackbaud for about four years now. I accepted the role of Security Awareness Program Manager about two years ago. And I started that role about two weeks before CSAM was to kick off. And it was a little bit of a trial by fire and learning on the job. So it was a little bit of a challenge trying to manage all the security awareness things as well as CSAM. I'm originally from Chicago, but I live in South Carolina now. And just a little bit of fun. What I've learned throughout the years is that you're considered a native South Carolinian based on three criteria.

1:19One is that you have to live in South Carolina for at least 10 years. You have to have seen who'd eat a blowfish because they're from South Carolina. And you have to know that shrimp is actually a two syllable word. It's actually pronounced shrill. So let's get started. So I am from Chicago as I mentioned. I do have two favorite teams. It is the Bears and Anybody Planet Packers. So a little bit about Blackbaud, let's talk about us for a second. We are the world's largest software as a service company for social good. So what we do at Blackbaud, if you're not familiar with us, if you're familiar with the every, around Christmas, Thanksgiving time, there's Giving Tuesday.

1:58And so we get to open up the New York Stock Exchange with Giving Tuesday. What we do is on our platform is we provide a place for people to set up a webinar or website, collect money, and we mine our data for people who might be inclined to share with you, to give money to your cause. So for example, if you're a person who loves the cats, straight cats in your neighborhood, and you wanna set up a cause for that, we'll look for people who might be inclined to give to that cause. And that's what we do. We take a percentage of that to run our platform, and the rest is yours.

2:34So we are the world's largest for that. So as I said, you're likely aware of all the stats related to cybersecurity risk, so I'm not gonna be sharing stats with you and doing that sort of thing. We're gonna talk about culture, because after all, numbers are good, but people are involved here, and let's talk about that. So what are we gonna talk about today? Here's what we're gonna look at and cover. What is culture? A little bit of a funny look at culture. Can we change it? And the answer to that is yes, otherwise you wouldn't be here. A real life success story that we've had from our culture, and then steps you can take to change your culture.

3:16So welcome to the wild world of cybersecurity. The only thing faster is the internet. Pace at which new threats emerge. We all feel that, don't we? Whether you're on the technical team, fending off threats, or security awareness team, like me, we're all aware of the constant threat concerns. That's why creating a strong security culture is critical to protecting the company. It sounds a little bit cliche, and I know that the previous speaker said she wanted to move away from saying the security is everyone's job, but it is really. So I agree and disagree with that premise.

3:53So culture, culture certainly passed down, even in the workplace. We all feel it, we all see it. We're all influenced by it. So when I took the position for my new role, I had long discussions about what the culture was at that point, and where we wanted it to go. The primary question I had was, what are the drivers to this culture? In essence, what do I have to change? And what do I need to bolster that's already been done? After all, the people before me did some great work, and I don't want to discount that. Culture is deeply ingrained, and it can be a challenge to identify and change.

4:30So let's start with the definition of culture. I think it helps to understand the forces that shape a culture before you try to change it, at its core, its behaviors, activities, and perceptions that define a culture. So let's have some fun. Let's take a look at some cultural norms that may surprise you. This is part of a festival that's believed to purify babies of sin, interesting approach. While this picture doesn't show it, it's one of several mattresses this poor guy had to jump over. I'm putting my child near the front, because I'd be concerned after about six or so jumps, that he might not have the same stamina.

5:11Some other cultural norms that you might not know of, are often involving food. For example, in Bolivia, a coin is randomly baked into pastry. The person who finds that coin is expected to have good luck for the year. From my perspective, that's provided you don't choke on the coin. In Spain, once a year, people gather together to throw tomatoes at each other. As a side note, if you're throwing tomatoes at me, please use cherry tomatoes. In Italy, people throw oranges at each other to commemorate a battle between townsfolk and a ruling tyrant. So I'm gonna give you a warning here.

5:46This is a dad joke ahead. Where I come from, we call this a random act of Valencia. Everyone in the company plays a part in your security process. Everyone also shapes the culture. Here are some people that make my job, and likely yours, much more challenging and entertaining. See if you recognize some of these cultural warriors in your organization. Let's have a fun look at these. Let's start with the update of order. You know that person who does not see the value in updates, their computer is still running on windows from over 10 years ago.

6:22All these things affect your culture and your security position. Habak, what I refer to as Captain Click-Happy, who without giving a single moment of pause, will click on the link for a free phone with the zeal equivalent of winning a lottery. And incognito, the incognito illusionist as I call him. This person thinks they've gone dark with the internet equivalent of a Harry Potter invisibility cloak. They express confidence that no one can see their activity, so they proceed to all sorts of nefarious sites.

7:03Sure you have one of these people in your organization. What I refer to as the Posted Prodigy. They think they have the most cryptic method of password protection. So with a quick Facebook search, we discovered Mr. Wiggles, a bit of a simple map, and the password was tracked. I've even had some people tell me that they have what they refer to as a password pal. They shared each other's passwords in case they forgot them. Don't worry, they said, we trust each other. Somehow I don't think that that's the safest approach to it. And last, my personal favorite, as a remote first company at Blackbaud, we often find our team members at local coffee shops using wifi.

7:43They wouldn't get the name of the wifi as second thought. Free wifi, free viruses, nothing scary here from my opinion. All these people make up the culture. Our job is to educate and shape their behavior, acknowledge the good and correct the not so good. So how long does it take to change a culture? According to sociologists, it takes about five generations or 90 to 125 years to change a culture. Are you telling me that you don't have that long? I'm guessing so. Neither do we. So we embarked on changing our culture right away.

8:22So let's talk about myth-busting. In recent years, the general school of thought was that it takes two to three years to change a culture. I'm here to say that you can shift culture much faster with some key focuses. First, you need the full support of the C-level. Second, understand your current culture and focus on one to two things that you would like to change. Then put your marketing hat on and create a campaign about the importance of cybersecurity. Be sure to expressly identify the why in a way that people can relate to. Partner with groups and create security relationships.

8:59But most importantly, have some fun. We're gonna talk about that later. There are many studies that prove that people will buy in much faster when things are fun. One of the things I wanna encourage is stop being the team of no. So if you're part of the security team, whether you're a security awareness program manager or part of the security team, we need to create a partnership. So stop being the team of no. And one of the things that we do within our organization is we always say, if we're gonna say no to somebody, we need to give them a path to success. So create that positive relationship with them. But say no, no, no.

9:34But say, hey, not right now, not with that, but here's your path to success. And most of all, have some fun. Do things throughout the year, not just at cybersecurity awareness month. So we take our cue from leadership. According to Harvard, the single most decisive factor in changing culture is the passion of leadership. And I think we've all experienced that. When leaders are involved, it makes it a lot more readily accepted from the team. So the more passion from the top, the more success you're likely to have. So my encouragement to you is find your executive cheerleader.

10:14So let's talk about a real life example that we had where we changed our culture here at Blackbaud. So I'm gonna give you a real life example. My first project at Blackbaud was PCI audit. I was handed the project with about six weeks before the due date with over 300,000 vulnerabilities to remediate. Yep, that was a pretty daunting task. The tension between the audit team and the technology team is pretty much depicted between this picture. There's a lot of tension between the two teams, lots of finger pointing, lots of confusion about responsibilities and so on. And since I'm a firm believer in using the use of humor, I incorporated humor into my meetings and status reports to ease the tension.

10:54That helped. However, we got through the audit with no time to spare. We literally finalized our audit that year, the night it was due, no stress there. Post audit, I made some suggestions on ways to improve the process as well as to improve the relationship, many of which were implemented. So we created a campaign that I referred to as Alliance with Compliance. I reminded the tech teams that compliance is not their enemy. And compliance literally wants to clap their hands and say, great job. They just want to affirm that we're doing the right things.

11:32One of those frustrations was that the team felt compliance was dumping additional work on them. And I'm sure you've probably experienced that as well. However, from my perspective, audits happen every year like clockwork. So I suggested to our teams that we be more proactive and we build in sprints time for the compliance work. We also streamlined the process for managing the work to give better visibility. Did we hug it out? Not really, but yes, we did in sort of a way. We're now aligned and we work together as a team. We plan for audits. Our process gives us clear understanding of responsibilities and our reporting gives us visibility to everybody.

12:09We no longer see each other as adversaries. So let's fast forward that to this year, we did have a success story. The second year, we literally finished 27 days ahead of the due date. Here are some typical things that may seem obvious but are not always implemented. Reward people for doing good things like reporting phishing, bringing security concerns to your attention.

12:49Better safe than sorry, as we like to say here. Continue to educate, over-communicate and build champions. Leaders set the tone and must be committed to the change. Find people who are naturally seen as role models and give them a voice. They will like it and you will be benefited from it. We all know that phishing is one of the biggest threats. Therefore, phishing employees is not just a click the box for compliance as often as treated, but a way to challenge your team to be better. Don't punish people for failing a simulated phish. View this as an opportunity to educate them on what they should have noticed.

13:28If you haven't started using these and other techniques, you should start now. So I've implemented homoglyphic attacks. It's the use of special characters embedded in this setting URL. So oftentimes our employees would notice the URL and say, oh, that's just Terry phishing me again. So when I started embedding this sort of thing where you can see where it says blackbaud.com with special characters, visually it looks like blackbaud. We're used to seeing it day after day after day and that challenged people. So why did they do that? Not to catch people, but to educate them. And so those sort of techniques are very important.

14:04We also purchase type of squat domains for use of phishing. Things that look like blackbaud but aren't. So you can see in this example, it's blackbaud.com. So visually, once again, our mind slides over it and says, oh yes, that's blackbaud. We found blackbaud.biz, that sort of thing. I'd encourage you to do type of squat domains and purchase them for purposes of phishing, first of all, but also before threat actors do, because they will. And then they will be sending texts in your cases. And then pre-texting is also on the rise. That's a technique where the first email sets the stage with a promise of a follow-up.

14:41Let's look at an example of one. HR related emails are certainly the most failed phish because we often want to see what HR is telling us, whether it's about a dress code or our vacation policy, that sort of thing. So this particular phish sets the stage for the follow-up. In this case, we had a dress code policy phish. There's nothing malicious here. Yes, it will generate a lot of talk because as a remote first company that puts us in a position where we're always on camera. So dress code is a sensitive subject. And yes, I have seen people in pajamas and all kinds of things. So dress code is probably a good thing to do.

15:19So this generated a lot of talk and a lot of failure. Not that I was looking for failure per se, but HR policies often do that. So here's the follow-up. The stage was set by the pre-text email. This follow-up contains a malicious link. Everyone wants to know about the dress code. Plus an offer to receive a clothing allowance was just too good for people to pass up. So I would encourage you to think outside the box. Communication through newsletters is helpful. It lets other teams know what may be coming and it builds trust between the teams.

15:57So let's also have some fun. Here's a shameless plug for Living Security. We use their cyber kitchen series as a Pinterest challenge. People posted pictures of their completed recipes after watching the video. Anyone who posted was eligible for a randomly selected prize. So have some fun with your team. They'll enjoy it and you'll have some fun too. As always, we should educate your team. For example, what we do on the last Friday of each month, we take a security related topic and we break it down into easily understandable concepts. For examples, perimeter defense, encryption, vishing, just to name a few.

16:33This has been well-received as we cover topics that we hear all the time, but we may not fully understand. That's not to say that there are experts in encryption with a three or four paragraph overview, but they will have at least more insights. We also provide links to additional info for the more curious. So thinking outside the box. Also, get your security team involved. You have a vast knowledge of base to draw on. It builds relationships with your security team and the rest of the organization. And it's just lots of fun. So you find the right people and they'll enjoy doing it and they have lots of insights.

17:09Sometimes they'll have so much insight that you have to slow them down and say, "Hey, wait a second, wait a second. "Way too much information or don't die so technical. "Make sure you understand your audience." So we, during our CSAM last year, did a live hack of a network, which was a bit scary for both us and the organization. Don't worry, we gave them a handout afterwards on how they can secure their personal networks. Not all security people want to present, but there are some. You should find them. They'll love it and so will you. For CSAM this year, we're involving one of our security team members who wrote a book on personal data security. We're gonna do an interview style format to ask questions about protecting and retrieving your data that is out there in the wild.

17:50So once again, find your security champions and use them, get them involved. Also having some fun. I read that when an overall company is well versed in the policy, the risk from security can be reduced by as much as 40%. Not sure if I fully buy that, but that's what I've heard. Reading policy, if you're anything like me, that's a bit of a yawn. So I often joke and say, "If you can't sleep, read a policy or two. "You'll be out faster than an Aaron Judge home run, "leaving Yankee Stadium." So how do we address this? We picked some quote unquote key policies.

18:26We assembled a small team of funny people and wrote some funny scripts, which we turned into doodly videos. So they'd get bite-sized nuggets of our policies with an overview, and then there's an attestation of reading. So imagine a tiny USB powered desktop vacuum sucking data from the system through the USB port. So having some fun, building some humor into it, people are going to enjoy it and you'll have fun putting it together as well. So the use of humor, make me laugh, as I like to say.

19:02Strike a balance when using humor. It can be your best friend when building culture. So you should use humor strategically, always maintain professionalism. No off-color jokes, no potentially offensive jokes, that sort of thing. And then find funny ways to highlight consequences of non-compliance with security. It'll be much more memorable and less threatening. You won't be the team of punishment. So once again, morning, dad joke ahead. What are a CISO's two scariest groups? Everybody outside the company and everybody inside the company.

19:37Some do's and don'ts. So do use humor to enhance the experience, not to replace it, be careful with that. Use content-related humor. Don't invoke humor just to try to make it funny. Avoid sarcasm at all costs, that's a challenge for me. And avoid inappropriate humor. Remember, it's not a good thing when HR knows you by name. So humor is a significant impact on learning and retention. The use of humor in teaching can make learning much more enjoyable and engaging, which in turn helps people remember the material better.

20:13It's not just about making learning fun, it's about leveraging the psychological and neurological effects of laughter and enjoyment to enhance the education process. In summary, humor can be a powerful tool in educating and training, helping to make complex ideas more understandable and memorable. Bottom line, you can change your culture. I've covered some of the techniques that you can use, and I've also shared some things that we do to have fun. If I could leave you with one idea, it would be this. Remember back when you were in school, the "best teachers" were often the ones that incorporated humor into the learning experience.

20:52So have some fun, you will enjoy it, and they will as well. It looks like this is where the fun begins. If anyone has questions for Terry, feel free to throw them in the chat. While that's happening, Terry, you mentioned the humorous ways of shedding light on some things. And, you know, as a learning moment, what are some of your favorites that you've used and seen at, you know, other colleagues of yours use, things like that?

21:29Oh my gosh, there's just lots of fun stuff. We'll do like little funny videos with phone things. We'll ask people to decorate their desk with Post-its, where, you know, they have password things, that sort of stuff. We just, we try to have some fun with it. We find these small things. We designed a perimeter defense as a castle, you know, to try to give people kind of a visual connection of what a perimeter defense looks like and why it's important, and why they're on the very front lines near the moat, trying to protect the castle.

22:05So we try to give them visual, you know, kind of fun connection points that help them relate to what we're after. But you gotta be careful not to over-educate because when you educate, educate, educate all the time, what you'll find is it starts to become an annoyance. So you gotta find that fine balance between the two. Yeah, it's not an easy balance to strike, especially if you're trying to do, you know, a little 30, 60 second video. Some sort of, right, like you gotta get your joke across, but you still need them to hang around long enough to read the important stuff at the end. Yes.

22:42So you mentioned Blackbaud having, you know, you do some in-office stuff. You've also obviously got a heavy remote culture based off that email that you put together. How have you balanced both in October and throughout the year the culture side of people being remote? It's a good question. What we, we're not big on surveys 'cause we generally find that surveys, you get two to 3% of people that respond to it. So it's kind of a difficult measure. But Nick, we are, as you know, we're implementing living securities, unified product, which will kind of give us a baseline measurement of security from a culture standpoint.

23:21So that's something that's important to us. But I do an approach what I refer to as MBWA management by walking around. And while we're remote, I don't really get to walk around per se. But I make connection points with people in the various departments. And I'm often just reaching out to them saying, hey, how are you doing? Tell me a little bit about how you perceive security. And so I get feedback in that sense. Now, is it biased? You might think that that may be the case from a standpoint of, you know, they're talking to a guy from security. So are they going to give me any bad news?

23:58Yes, they do, by the way. So when things are, you know, they perceive things not going right, they let me know. So one of the things that we wanted to do within our culture is security used to have this kind of mindset of, it's security, we're just going to put in what we want to put in, and you guys just have to deal with it. And I wanted to change that culture, that perception. And so when I first took my role, one of the things that I got a lot of feedback on was, you know, security is like a bully. And I know they're trying to do right by the company, but, you know, they're locking down everything. I can't even do my job.

24:33They don't tell me, the next thing you know, I'm operating one way and now I can't do my job. And so we wanted to change that to say, wait a second, we can't just be the bully. We can't just be the team of no. We want to make sure that we're embraced by the company. And so communicating and telling them what we're doing and why we're doing things goes a long way. But in addition to that, as I mentioned earlier, one of the things that we want to do, and we make sure that we do a good job of, is if we're going to start to shut something down, A, we tell them way ahead of time. We're going to, unless it's an emergency and we all get that, we're going to shut this down.

25:07But here's your avenue for success. Here's how you can do what you're doing, but in a much safer approach. So when we started telling the people the why, not being the team of no, and building that path for them to continue to do their job well, and without the friction there, that changed the dynamic of the relationship with our security team.