Creating Human Risk Visibility: Where to Start and How to Scale

Auto-generated from the live recording.

0:07Our next speaker is Tim Taylor, VP of Security, Education, and Awareness with Mastercard. He will be speaking on creating human risk visibility, where to start, and how to scale. Tim's rocking the stage solo today, so please give him your most best attention and enjoy this session. Awesome. Thank you, Drew. Well, that's a tough act to follow, right? That announcement from Kelly and Mike. I think I also need to change my title because apparently security, education, and awareness is dead. We'll try to find a new title.

0:43We'll work on that. As Drew said, my name is Tim Taylor. I'm from Mastercard, and I've celebrated 20 years this summer at Mastercard, so it's been a good run. Thank you. Yeah. My team and I are responsible for educating, and we've been moving into this idea of risk management now for our global staff, right? So it's about 50,000 people. We've got lots of different languages, lots of different cultures. We're spread all over the world, 170 offices. So it's no easy task.

1:21That's me. So I want to start with a question. What is human risk management? And I'm sure if I got an answer from this side of the room and an answer from this side of the room, it would be very similar, but there's nuances, right? Because it depends on where you're coming from, what industry you're in, what challenges you're facing as an organization, as a company. So what I've done is, as any good IT professional would do, I asked Google AI. And here's what it told me, can't see this.

2:01So I'm going to go like this. So it's a data driven cybersecurity strategy focusing on identifying, measuring, and mitigating the security risks from human behaviors, right? Everybody agree with that? That seems pretty straightforward. No violent disagreements. Then it told me that it's also a proactive system that measures real world behavioral changes in order to reduce those incidents. Again, that seems pretty agreeable. And then lastly, human risk management views employees as a critical component of security, transforming them from potential vulnerabilities into an active line of defense.

2:46So I think that all makes sense to me. I'm a Google lover, and that seems to encapsulate what HRM is. But then, why is it so hard? For those of you who have been on this journey for any amount of time, and I've been at this for about 10 years, it's hard work. And it's hard because it's data driven, and you've got to get clean data. There's one thing my team and I have learned is getting clean data into a tool like Unify or any other HRM platform is difficult.

3:21And of course, you have to deal with humans, right? That's why we're all here. And humans are hard. They make things more complicated. You've got to change their behaviors, which sometimes that's easy to do. But then you have to do it consistently, right? And you've got new people coming in. And then lastly, this idea of an active line of defense, in my view, implies you're never done. So I have to do it today. I've got to do it again tomorrow. And how do I keep those humans actively protecting my company, actively protecting my data?

3:58So it's difficult. It's hard, but it's certainly something we have to do. Now, this is a pretty standard maturity model. You've probably seen something similar to this. I like to think of the left side of the slide as Security Awareness 101, right? We've all started there. You start with compliance. You're building that program off the ground. You're moving into proactive awareness. You're engaging. You've got strong culture that you're building from a security perspective.

4:36And then you're moving into metrics framework. And once you're there, you start to move to the right side of the slide, which I think is really about human risk and about risk reduction. In the middle, metrics framework, you've been gathering enough data. Maybe you've got strong phishing simulation results, lots of click and report rates. Maybe you're driving malware down. Maybe you're even asking yourself, how effective is my training? So you've got a metrics framework in place, and you're starting to use it. Focus on risk is where I would place us at this time.

5:11And we've been at this HRM thing for a number of years now. Prior to Living Security's UNIFI solution, we were using another one, starting in about 2018. And what we've done well, I think, is raise the awareness. We brought the transparency of the risk that staff do to the forefront through behavior scores and other types of things so that they understand when I do these vigilant activities, I'm actively protecting the company on that active line of defense. And when I do these risky behaviors or I make those mistakes, I'm actually putting the company at risk, and I understand how that works.

5:54And then the last thing, of course, data and automation, I think, is really what we started to hear from Kelly and Mike, and that's why I'm so excited, that you start to leverage the automation from a tool like UNIFI, and it sounds like we're going to get to where it's actually predictive, and we step outside of that detect and response mode that we're in right now. So now that we're putting data in, what I want to talk about is what data did we use, and how did we do it?

6:32So when we started this journey, we leveraged the data that we had the most of. In about 2018, we started a very formal phishing education program, lots of simulations. We were testing the entire enterprise on a monthly basis. And we drove our click rates down from double digits down to single digits fairly rapidly, and conversely, our report rates from low to high. Then we focused on the correlative aspects of, is the phishing simulations having any effect on the malware events that are email-based, and we saw a direct correlation, and we've driven our malware events that are email-based down to zero, basically.

7:17We then broadened that over to look at browser-based malware events, and we're pulling that information as well. And then number three, we had lots of training data, because that's what a security education and awareness team does, whether it's our annual compliance training, our new hire training, targeted training for those groups or organizations that wanted some additional support. And then all of this was pre-COVID, so we had lots of good data on clear desk violations. And so that's how we started, and we've moved forward from there. So the next couple of slides, I want to just talk about six pillars.

7:55This is how we're categorizing and trying to plan out what's the next level of data to bring in. And so what we've done is, on the web and endpoint security, we've talked about malware events, and we're continuing to move forward to understand where do we go from there, right? Mountain Center in the middle is phishing an email. We've moved beyond just simulation information, and now pulling in real-world click and response rates. And we're this close to moving and pulling in threat information, which would be and help us identify who on our staff are highly targeted individuals, even though we may be blocking them through our email gateway.

8:38We need to know who those threats are targeted to. And then we're starting our conversations on the data loss and the privacy side with our DLP folks, as well as our insider threat teams to understand who's doing those things that are policy violations, who's sending confidential business data or source code out of our network. And then the last three pillars really talk about security training.

9:13Again, we're not going to stop training. We just are looking for new ways to do it. So we have a lot of data on that. And then on the physical security side, our organization is called Corporate Security at Mastercard. And it is a combination of cyber and physical. We take the safety and security of our employees, it's very important to us. And so it's not just clear desk violations, but also emergency notifications. We do a quarterly test just to make sure that we can reach our employees no matter where they are in the world, and that they know how to get back to us.

9:51And that's important. We're considering badge policy violations, maybe lost or stolen devices. We're also trying to just assess what's the value of this? Is this good risk information or is this important to us for other reasons? Last but not least, and probably the most complicated at least from my perspective is access and authentication. We've moved beyond passwords. We're a hello for business company. And so we've included the adoption of passwordless into our current behavior scores, primarily just to drive adoption of these new features and new security solutions that we've implemented across the company.

10:33Self-service password resets is one we may use, but really we want to step into elevated and privileged access. I've got a whole team of engineers that are trying to figure out how many slices of access do we have in the company? And then how do we categorize that? And then how do we prioritize from a level of importance to the threat actor, right? So I should be going after the most critical access, right? Would be one way to do it, then another way to look at it is simply what do I have the easiest access to get that data?

11:08Where is it? How clean is it? Et cetera. So I've talked a bit about the data. Let me just tell you what I think we've learned over our journey over the last several years. And I alluded to this with the access data, but getting clean data into a tool like Unified takes time. If any of the data that my team owns, it's pretty straightforward. We can get that in fairly quickly. We know what it is. It's clean. We understand it. But as I started to work with other teams like our SOC, our insider threat teams, incident response, resilience teams, whatever that might be, we ran into issues because of the data integrity, the data accuracy, and so it's just difficult.

12:04In the middle there, something I think that my team struggled with for a bit over the last 18 months at least, and I think my team is tired of me harping on them, we have to make time to operationalize this. And that's why I'm so excited about what I heard from Mike and Kelly. We spend so much time getting data into the tool and then figuring out how clean is it, how good is it, do I understand the numbers coming back, that we forget to take action. And then we're on to the next quarterly score. So it just feels like we may be stuck in a bit of a rut where we're generating lots of important report cards to our staff, which has value.

12:45It keeps them engaged and keeps them aware of what's vigilant and what's risky. But are we actually taking enough action to make meaningful progress and drive risk down? And then lastly, keep it simple and use what the tool is telling you. This is kind of a learning for me especially. I think we've been overthinking it on my team, or at least I have. And so we're trying to go back and just simply use the data and use the information that's coming out of the tool, and then move forward and take action. So let me wrap up with just some takeaways, right?

13:25And the first one is, look, if you're starting into this journey, by all means step back and define your goals, make sure you've got executive buy-in. We would not have been as successful in the early stages of this journey that we're on without really strong executive buy-in. We've had our CISO was right there behind us, giving us the support we needed, president of our technology divisions were behind it, as well as the CEO. And as we sent out those first few score cards, it was fun to watch our executives comparing scores and giving each other trouble when they didn't get 100, because everybody wanted to have 100 and score better than anybody in corporate security.

14:10Number two, again, take action on the visible risks. If you're not in an operations mode to where you're looking at the information and taking action, then you're not reducing risk. Number three, keep your metrics and your dashboards simple. Use what the tool's telling you, push it out, keep it simple. And then number four, where you have vigilance, make sure you're celebrating that. We heard a little bit about that with what Mike and Kelly were saying, but I'm not sure we're doing enough of the celebration of those, the vast majority of Mastercard who are doing the vigilant things and protecting the company.

14:49And then of course, where you do have some risks, identify it and take action. The last thing is, do you have the right skills on your team, right? Security awareness professionals, as good as they are at security awareness and education, don't necessarily make the best risk analyst. So if you can't get that on your team, where do you have the risk analyst in your organization that you can leverage? And use them to help identify where those risks are, and then use the security awareness skills that you have to take action.

15:26I think that's all I have. Drew, are we going to do some Q&A? Thank you, Tim. Thank you so much. Appreciate that. A real world example of the last many years. I mean, you're... It's been a few. Yeah. I mean, it seems like from what I know, Mastercard, you're always trying to get better. The status quo is not in your vocabulary and it's always challenging, but I think the reward is there. Can you describe some of your biggest ah-has or wins or rewards that you've seen over the last couple of years? Yeah.

16:02I think one of the big things is when we first introduced behavior scoring, just how it was accepted and embraced by everybody from the lowest analyst in the company to our CEO. It generated considerable buzz and we're a competitive kind of company and we don't like to have low numbers in general. We're a pay for performance, so not having a high behavior score. People took that as a personal insult and quite frankly, we got lots of feedback from people who had lower scores that told us we were completely wrong and I think that was the first one.

16:40Yeah. And that was a big one. And how did you respond when people were first starting to understand like, what is this risk score and does that make me a bad employee if they have a low one? Right. And that's a challenge too. We simply had to explain that to a lot of people, look, this isn't being used for performance perspective. This is being used simply to raise awareness and to make you aware of what's risky and what's vigilant behavior and where you fall in that score. It's a lot of education to them.

17:15Is that just in emails or like how was that education coming about? A lot of what we're doing because we have a small team. There's only five of us. We leverage our business security officers who are aligned to business units to help with that messaging. We also leverage our regional security officers who are sitting out in all the regions and different countries around the globe to have that local presence and to do the local messaging. So it's really a combination of stuff coming centrally from my team and then using our partners inside corporate security to deliver that message. Awesome. If you were starting over again, what would the first step that you'd take knowing what you know today?

17:54Oof. Maybe look for a different job. I don't know. This one's hard. I think simply skill sets on the team I think is where I would go. It's one thing to have good security awareness skills, right? But this idea of are you schooled and are you looking at it from a risk perspective? This idea of risk management is different, right? It's a different principle, it's a different discipline that you have to have and so that's probably the one thing I would do differently is look to bring more risk backgrounds onto our team as we move from plastic security awareness into human risk management.

18:40Yeah, that makes a lot of sense. We had a question on the audience and if there's any questions here, feel free to dial them in. Oh, there's a bunch. Where are you with your branding of user-facing security? Is it still the security awareness program? Are we moving on to human risk? There's another workforce security and risk adoption maybe out there. Where are you guys at with that? Yeah, it's interesting. We branded our program several years ago as secure at first and we've continued to use that and I think it fits. A lot of what we've been doing for the last five or six years has been around behavior scores and people understand that it's still about risky behaviors or vigilant behaviors.

19:26I think the way it's been presented really has been from a risk perspective and I don't see us having a need to change that branding at this point. I think where we decide to go next as far as the next level of information that we're going to share with our employees is where we might need to do some differences because, for example, behaviors obviously, as you know, Drew, you can control. Now if I tell you that you're highly targeted and I just need you to be even more parent annoyed than you are today, that's different than classic awareness and that really becomes this idea of I need you to think about the risk that you're taking every day as you process your emails, as you browse the internet, as you whatever.

20:18That might require us to do some different branding and some different levels of education at that point. Yeah, that makes a lot of sense. Another question from the virtual audience, did you rely on your comms and HR teams to guide your user-facing voice of the program? They wanted to, HR definitely did. We partner very strongly with comms. We actually have communication professionals from the comms team embedded in our security division. We're, I think, the only division in the company with that and that's been a crucial benefit to us and a big reason for our success.

20:54We didn't get a lot of pushback from HR. What was more from employee legal and privacy is where we simply had to have the right conversations to explain to them what are we doing with all this data and how are these scorecards going to be used and once we explain that it was for risk reduction only and not from a performance perspective, then they bought in. Are you seeing any translation into your customers outside of Mastercard when it comes to the rapidly-changing security risk factor and is anything you're doing internally helping to make them more secure as part of what you guys are doing at Mastercard?

21:42We do have a partnership. I actually run a working group where I'm pulling in kind of my peers, my counterparts on the solution side. We're internally facing protecting Mastercard and our security solutions divisions are out there creating products and solutions as services to provide our customers, banks, consumers, card holders and so we're trying to partner with them to understand where are they going. They're leveraging us as subject matter experts and it's kind of turned into this bit of a it's a true partnership of how are we going to do this as a company to not only protect ourselves but also to help protect our customers.

22:27Questions from the audience, we can get really tactical here, communications, engagement. Yes, yes, absolutely. Thank you so much. I love getting my steps in. Thanks again for sharing insights today. You mentioned more than once about the importance of keeping things simple. Just a couple of data sources and not overcomplicating. Can you delve a little more deeply into the lessons learned in that regard? Yeah, and I think as far as how we communicate to our employees, we're doing a good job of keeping it kind of at that level of not oversimplify but it's understandable and they know what they're doing right or what they're doing that puts us at risk, right?

23:16The simplicity that I keep coming back to is really how do I take this and explain what we're doing to senior leadership and ultimately the board, right? I've got a challenge from my CSO right now to have how am I going to tell this, Tim? That's what he keeps asking me. And we've been working on this for several months. How do we make this simple for the board? Because it takes -- I mean, Edna talked about it, wherever Edna is. As a board member, she'd want one slide with three bullets, okay? So I'm going to take her advice to heart, one slide, three bullets, and then have some supporting slides in the background.

23:53But part of the challenge, I think, with human risk management and you're talking to senior leaderships, especially boards, is it's complicated. And there is some understanding and some education that you have to do somehow. So that's kind of where I'm at right now. That's our biggest challenge. Communicating to our employees, I think we've got that down pretty well. It's how are we going to take this to senior leadership and the board so that they understand whether we're making progress or not or where we might need investment in technologies to help augment what we're doing from a human behavior perspective and really bubble wrap certain groups or individuals.

24:36Other questions, don't be shy. Don't be shy. All right, I think I got one more, and then we'll wrap it up. When you're just starting with your human risk program, what are like the top two or three kind of data sources that were most important for you or just a good starting point? For us, where we started primarily was our phishing simulation education program. We had tons of data on that, and it was something that we could readily get our hands on.

25:13We owned it. We understood it. We started there. Then I think the second most important one was this idea of, "Well, how is that either helping or hurting my malware issues?" At the time, several years ago, sorry to say, we probably had too many malware incidents from an email-based perspective. As soon as we implemented our program, we drove that down dramatically and very quickly. I think it's those data that are going to show biggest results or show some big wins is where we started.

25:49It was the stuff that we understood, and it was ours. We could put our arms around it and own it. That's where we started. When you say a starting point with the email malicious, inbound malicious data, did you have that starting point? Did you have a metric or a number or threats per day or incidents per week coming from email that you could take that, and then were you able to actually go back and show the executive team like, "Hey, here's where we were. Here's where we're right now." Yes. We partnered with our SOC, and so they had been tracking, and it was a known issue and a concern for our CISO, really, which was the impetus to do some type of education on the phishing side.

26:28Those two just came together and worked out well for us. Awesome. Last opportunity for questions on camera. Of course, Tim's going to be with us this afternoon, so you can come and find him. Awesome. Let's give Tim a big round of applause. Thank you. Thank you so much.