Simply Solving Cyber - Daniel Eliot

Welcome or welcome back to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Teddy Guzik.

And we are excited today to bring you a conversation with Daniel Elliott. He is the director of education and strategic initiatives at the National Cybersecurity Alliance. Which is 50% responsible for the October Cybersecurity Awareness Month. So we're excited to learn a little bit from him. And he's got a non-technical background from learning and development.

Just, yeah, another person to add to the list of people that just kind of show you that you don't have to come from a super technical background to get into the industry and make a big difference and secure organizations. And really, I mean, they're securing more than organizations. He does public, he does private entities, and the work that they're doing is incredibly important.

Yeah, absolutely. So we're excited for you to hear this. Take a listen. All right. We'd now like to welcome to the show Daniel Elliott. He is the director of education and strategic initiatives at the National Cybersecurity Alliance. And what a better month to have Daniel on our show than October, which is kind of the featured month for cybersecurity. So welcome, Daniel.

Thanks for having me.

Yeah. So this show, we like to talk about people and process and obviously what you are doing with National Cybersecurity Alliance really lines up to the people, the human element. So give, give the listeners a little bit of background, especially for those that are not familiar with that organization or Cybersecurity Awareness Month.

Yeah, well, the National Cybersecurity Alliance itself is a nonprofit public-private partnership. So the public partnership piece of it is working with the federal government, particularly with the Department of Homeland Security Cybersecurity and Infrastructure Security Agency. And the private side is working with our board, which consists of companies like Intel and Microsoft and, you know, big behemoth companies, Visa. And so we're able to leverage their resources and reach and insights to develop national-level national-scale campaigns around cybersecurity awareness to drive home the importance of empowering your users, whether you're at home or in the community or at work, to adopt better security practices and having organizations think through the challenges of securing their organizations, whether they are a microbusiness or a massive global enterprise. And so Our role is to make sure that everyone has access to information they need to do their part and be a little more #cybersmart with it, which is the hashtag and the slogan for Cybersecurity Awareness Month. And Cybersecurity Awareness Month itself is— we're in our 17th year, and it's recognized every October. And it's really a time to to rally everyone around sharing best practices and resources and guidance on cybersecurity best practices, or on cybersecurity awareness. And so even though cybersecurity awareness should be a year-round effort, we try to use this month to really get everyone refocused and reeducated around the theme and around the message of cybersecurity.

Oh, that's great. And why is it that you think that for many organizations that the human element or awareness is not one of the first things that people think about?

Well, it's just when you look at investments in particular in enterprises' security infrastructure. So the majority of investments in human assets and financial resources goes to the technology piece of the enterprise, right? We often think that technology alone is going to secure our organization, but, you know, think about it. Who is purchasing those technologies? Who is configuring those technologies? Who is using them as an end user, right? Humans touch every part of an enterprise's security infrastructure. And so I'm not saying we should invest less in technology, but I'm saying we need to raise the level of investment in— if we really want to protect our organization, we need to raise the level of investment in equipping these humans with the right resources and information they need to secure us. We have to help them help us.

Yep, absolutely. I couldn't agree more. Coming from a, you know, a red team pen test background, you see that a lot where companies invest a lot of money in their their external networks or their, you know, their IPS, their IDS, whatever it is that's going to stop an attacker. But it's not— they're not looking at the side of, you know, how am I training my employees for this type of thing? They'll really kind of go into, you know, hey, we have this tool and this tool to stop people from breaking into our environment. But, you know, but what happens if someone's able to phish someone or walk through the door with someone? So It's really, I think it's, people are starting to kind of figure it out, but it's still definitely one of those things that it's, that the social engineering side of things, the human awareness thing is definitely a little bit behind.

Yeah, so Daniel— Oh, sorry, go ahead, Daniel.

I was just gonna say, I could talk for hours on this topic. The social engineering in particular, right? That's not a technological attack. Psychological attack using technology in many cases. And social engineering is as old as time, right? It's an old technique that predates computers. Con artists are social engineers. And so, you know, we can't solve this alone with just technology because cyber criminals are going to find a way to get around all of your sophisticated firewalls and intrusion detection capabilities. And when it lands in that employee's inbox, is that employee equipped with the awareness and the tools to either identify a malicious email, to report it? You know, there's that concept of turning your employees into sensors, right? Help them or teach them how to detect attacks. And give them the tools and the mechanisms for reporting those. And so in addition to all of your technology sensors that you have out there, turn your humans into sensors so that they can help the enterprise detect these instances.

Yeah, absolutely. So Daniel, how did you get into cyber? What was your background? How did you get into the field?

Yeah, oh gosh. So I, you know, I started my career in learning and development at Eli Lilly supporting global manufacturing and quality, and I fell in love with the field of training and development and learning and development and being able to apply best practices from adult education and, you know, organizational development. And structural design, applying those principles to solving problems within an organization and maximizing the effectiveness of the employee. And so, um, throughout my entire career, I've been in learning and development in some form or fashion, but fell into cybersecurity when I was tasked with creating economic development programs in Delaware on a statewide basis. And, um, when you're designing an economic development program to support the business community, of course, in today's economy, one of the things you have to educate them on is cybersecurity. And so I, I developed a cybersecurity program in Delaware and scaled it up and it became, it blew up. I thought it was just going to be a regular old program that I ran and it'd be fine and ended up blowing up. And I got You know, we replicated it in multiple states. I received a letter of commendation from the governor, from Governor Carney's Chemistry Advisory Council. I mean, it just, it was really successful. And I think it was so successful because of the way I approached it through an education lens and not through a technology lens and not through a, stage-on-stage lecture. This is, you need to use FAPN, you know, instead of applying some thought to the way we deliver the education.

Yeah. So, so maybe bridging into the question we ask every guest, which is tell me, you know, a large problem that was put in front of you where you solved it with people and process. So obviously you had not been in cybersecurity deep learning and development background, you know, getting into the psychology and human element. But when you were given this challenge and you mentioned, you know, we've, we've jumped to the conclusion, which is it went so well and it got replicated, which is awesome. What were some of those tactics and techniques that really worked well that you did end up replicating, probably even into what you're doing in your current role now?

Yeah, I mean, gosh, You know, the difficulty, you know, I wasn't sure I would be able to do it because I'm not a cybersecurity expert, right? I am not a technologist. I'm a program manager and an educator. But so I was really terrified of taking on this project because it was just something completely new to me. But one of the benefits that I had, or one of the assets I had, was that I was part of a university system that had, um, Starnes Walker, who was a cybersecurity, um, nationally recognized cybersecurity expert, um, who was leading, uh, University of Delaware cybersecurity program. And so I was able to tap into experts who had worked on a national level, um, and began building out an advisory committee to help me think through this strategically, right? With the people, process, and technology components. And so by surrounding myself and being mentored by experts from private sector, from the university infrastructure, from public sector, I was able to figure it out. And a part of it, One of the tools that I used, piece of it was, you know, understanding the audience and trying to figure out what exactly the small businesses were struggling with. And so we, you know, we thought we did needs analysis and surveys to identify where, where they were struggling and how, how could we leverage the assets of the state and the university to help them? Did a thorough analysis of what's available out there in the federal government that we could raise awareness, because the federal government's not great at telling people what resources they have. They often create a lot of great resources and then sit them on a shelf. Yeah, yeah. And so, um, it was a lot of also figuring out what's been done. And now part of my role is kind of helping the federal government figure out what needs to— how they can communicate these great resources, but also what new resources need to be developed. Right. But I think a piece of what made that program so successful is, again, my approach with education, thinking strategically about how do people want to consume information, particularly adults. Adults have a lot of, they have a lot to share, as you can tell, 'cause I'm not shutting up. Adults have a lot to share. They want to share their experiences. And that's one of the, great things about adult education and learning and development with adults is that you need to tap into that well of their experiences. And so what we did was we designed, you know, a very straightforward, non-technically focused workbook that we walked them through in small group sessions, no more than 10 to 15 business leaders at a time, so that we could have conversations. And we would not only I would facilitate the discussion, but we would have community cybersecurity experts at that table too. Whether it was a, you know, a chief security officer from Bank of America, which had a big presence in Delaware, or a cybersecurity professional from the university or whoever, we had people in the room, but we focused them on small discussions, small group discussions, so they could ask questions. Because again, I didn't want to be that sage on the stage when lecturing to a business about what they need to do. They have questions and we need to help them work through this.

So, so what do you think would be the biggest difference in teaching a group of adults versus someone who's, you know, 13, 14, 15 about cybersecurity? How would you— would you approach that the same way or would you approach it differently?

I definitely approach it differently. One, using different examples, right? Because we use technology differently. Adults use technology a lot for, for work, and so the way you position it, youth will use it for building their network. That is what they are at the age of doing right now. And so there are different security concerns around that that we want to highlight. And you also just look at usage statistics for different types of social media, for instance. Kids are not on, you know, Facebook and LinkedIn, stuff like that, but adults are. Kids are on TikTok and Instagram or whatever else. So, I think the examples you used, and again, I think also when you approach talking to adults, you do want to build in way more time for them to share, to ask questions, and to share their experiences. 'Cause that's the way they learn best. And so that would be some of the off-the-cuff suggestions I would have. But, you know, it really is customizing the content. 'Cause I always harp on, you know, cybersecurity is not a one-size-fits-all thing. You have to design role-based initiatives. And so making sure that you are, to your point, that you're customizing your talking points and your examples to the different audiences so that it— so they'll pay attention and see that it's relevant to them.

Yeah, yeah, I agree. I— so I've had experiences over the years building awareness programs for Fortune 500 to small business to nonprofit, to international nonprofit, and everything's a little bit different. But I'm curious your thoughts and your approaches When it comes to, like you mentioned in your example of that first program you built, the small group sessions and a workbook and cultivating conversations, maybe in some of the larger companies, how do you address the scale of trying to replicate what works so well at that entity, maybe where it's more geographically dispersed or internationally, you know, international differences? How do you recommend creating some of those really good open sessions?

Yeah, and you know, my program was specifically designed for a very specific small audience. But when you're talking about global enterprises, for instance, you know, the best way to scale an awareness program across the globe and across multiple audiences and to get buy-in from those diverse audiences is to create an ambassador program so that you can have individuals who are locally, or local individuals be able to carry that message and carry that torch of security awareness. And so creating a handful of security ambassadors for your organization will really amplify your message and all of your efforts across the globe. And you also have to think about when you're talking about global communications is when you're an awareness professional, you also have to customize. You can use that ambassador also to provide feedback for your specific communications or graphics. You don't want to use graphics with a pig, right? In certain countries. I don't know why you would use a pig, but people try to be funny with graphics.

I've seen it before.

Yeah, you don't want to use certain language. You know, sometimes people use humans in their graphics. Well, if you use a human that doesn't look, you know, a person that doesn't look like the people in that community, then they're not going to feel connected to it. And so part of that ambassador program would also give you advice and guidance on how to reach those audiences and what would resonate with them.

Yeah, that's so important. And another vector that I've used, and I think it's not quite as good as the ambassadors or champions or SMEs, or I've heard a number of different names that work depending on the organization and culture, but like leader, leader toolkits and passing information through leaders. I think there's a time and place for it, but I don't see the same adoption and passion of communication than getting either a volunteer or a voluntold champion within a specific sector that kind of is challenged to come up to speed. And, you know, I'm curious your thoughts on that. Have you seen the same? I mean, there's a place for it, but have you seen that that's maybe less helpful than the champions?

Yeah, I mean, I can see why a toolkit would be— now what you can do is equip a champion with a toolkit. That would probably be a great approach. But if you can If you give someone a toolkit who isn't, hasn't bought into becoming that ambassador or that champion, right? Then they're not gonna do much with it. And so, yeah, I think you first have to find those champions and then equip them for success with a toolkit that they can use. If you decide to go down a toolkit route and, you know, we do the same thing at the National Cybersecurity Alliance for Cybersecurity Awareness Month. Equip champions each year with a toolkit, with a ton of resources that they can use and customize for their audiences and repurpose and co-brand or whatever they want to do. And the purpose is, you know, we're really targeting awareness professionals with these champions toolkits for the most part, or security evangelists in some form or fashion across the globe, really. And so these toolkits are valuable to individuals, again, who have already bought into the notion of spreading security awareness.

So, so are these, are these champions in your guys', I guess both your guys' experiences, but are these champions information security professionals or are they just someone that's passionate about security in a different role in the organization?

Yeah, I mean, it doesn't have to be an information security professional. You know, it could be a marketing professional. You know, ideally it's someone who is an influencer within that area, whether it's an influencer within the department or whether it's an influencer within the site itself. It's someone who knows, who is passionate about this and who can communicate it because, you know, A lot of times technologists are assigned security awareness roles and they're not— some of them just aren't comfortable being in an awareness role where you have to be, you know, you have to be kind of in front of a bunch of people a lot of times and use marketing approaches and psychology approaches and graphic design, all this. I think you need to find someone who is influential within that community, but also who feels passionate, whether they're a technologist or they're not a technologist.

Yeah, I agree. And I would even maybe go stronger, like Teddy, to your question. If given the choice in the champion programs that I've led or consulted on between a business leader or business SME in an embedded area, or their adjacent IT or security professional, 9 times out of 10, there's always an exception, but I would choose the business person. Because I kind of feel like the IT and IS people get it. They may not always be perfect, but they could advocate when needed. And to me, Daniel, to your point, if you get an influential champion that's embedded in the business and not seen as another IT person doing an IT job, I think that's the best. And really, I mean, I think we've come a decade or so and still room to grow of kind of getting information security outside of the basement of IT. Because I think that's where it grew up. And it was never really IT's responsibility to secure the entire organization. There was always a people element. It just had less prevalence back in the day when attacks were brute force and not socially engineering, you know, 10 times a minute, really.

That's a great point.

So, so, Daniel, I want to talk a little bit more about— you mentioned the Cybersecurity Awareness Month, you mentioned the Champion Program you can sign up for. I actually went through that this year and recommended all my clients do, but really good opportunity. I was amazed at how far the materials have come along for things that are available for free. That's really been helpful to nonprofits that we assist. But also even large companies that maybe they can start with that and use their limited budget on the next level or, you know, a custom video or something that really resonates with the organization. So walk us through some of the resources that your organization provides and how folks can get more plugged in, whether they're in a formal awareness role or not.

Yeah. And, you know, We have a ton of resources on staysafeonline.org that are customized for different audiences, the non-technical, general consumer, the business community, young and old, you know, anything in between. And all of our content is, for the most part, designed for any non-technical individual. We try to write it for those audiences. And, you know, the National Cybersecurity Alliance, we have tip sheets on various topics like talking to your kids about privacy and configuring your privacy settings. We've issued some tip sheets recently on— with the pandemic, there have been a lot of individuals laid off and so— or fired, right? And so we created some tip sheets on employment scams. And so a ton of different tip sheets, infographics, videos, that people can share. A lot of organizations will take the content and post them on their website, post them on, you know, in the break room, use them as a foundation for their own awareness initiatives. And so, we encourage people to download them, the videos, the tip sheets, whatever they are, download them and use them and co-brand them if you want. But, you know, there's, no lack of cybersecurity resources out there in the world. Right. And so what we don't want under-resourced organizations to do is focus on kind of recreating the wheel. You know, start with what's publicly available, what that you can leverage, um, in the public domain, such as NCSA's resources or the Federal Trade Commission's resources or Homeland Security's resources. Use that information and use it as a foundation for some of your reinforcement efforts. Because what you want to do, of course, is, you know, set a foundation for security awareness and then continually reinforce what you taught them throughout the year. Right. And so, you know, these resources are designed to help you do that. In some form or fashion. And so we also, in addition to the educational materials, host events all throughout the year, virtual events now, but on various topics. And all of our events are always free to attend for individuals. Nice. And throughout October, we'll be releasing, we're constantly releasing new resources and amplifying new resources from others. For instance, Federal Trade Commission is coming out with a new— it's called Careful Connections document that helps developers of apps and devices design them securely. So they'll be promoting that later on in the month. So we, you know, CISA came out with their Cyber Essentials Toolkit Number 4, and so we've been promoting that. And the American Bankers Association recently came out with a really funny, great campaign called Banks— I think it's called Banks Never Ask That or Banks Don't Ask That. And it's a group, a ton of videos and graphics and stuff that banks can use and credit unions can use. And so We try to be not only a creative source of information, but also an amplifier of some of the best practices that are going on in the industry.

Yeah. So one last question, and then Teddy may have one last to kind of make sure folks can get connected to you. But one question I have is if someone in an organization gets tapped with, you now own security awareness, whether they're a DBA, a technologist, a marketing person, you know, anything. What's their starting point? What would your guidance, the journey you've been on, what would your guidance be for them of how to engage?

Engage with their program or engage with NPSA?

Well, we can weave both in, but I would say engage to get started. Let's say they know nothing. They're coming in cold.

Yeah, no, I would say first off is that, you know, for when you're starting an awareness initiative, I think the first thing you need to start looking at, one, is pulling together data, right? Pull in information from your threat intelligence team and your SOC team and understand what some of the primary threats are to your organization. I think it's also essential that you pull together a diverse advisory committee to help you plan it. Don't think you need to do this alone. If you're able to pull together a committee that includes, you know, legal, compliance, HR, InfoSec, whoever it is, have a diverse committee and get buy-in from those individuals. So that they can influence their respective organizations that can also provide input into how you can structure this program effectively. You know, in addition to that, then you start looking at, all right, you can't solve all problems for the organization, right?

Right.

Yeah. So, what is low-hanging fruit that we can either chip away at and be successful, show metrics to leadership quickly.

Yeah.

Um, or an alternative approach would then be what are the riskiest behaviors to the organization, taking that, those insights from, um, your SOC team and threat intelligence and understanding, okay, maybe we need to solve this problem first. But you just have to take it a bite-sized step. Um, and not try to solve every of the organization's problems at once. Right.

Yeah.

Pull together a strategic plan and make it module-based for yourself and for the employee base. Yeah. And it might just be starting with the executive, right? Yeah. You know, start with a specific cohort and again, get some success metrics under your belt and I think that it's, you can't build an entire fully mature awareness program in months. It takes years to do that. And so Rome was not built in a day is what I say.

Rome was not built in a day.

Yeah. Yeah. And I think a lot of people tasked with it feel the weight of cybersecurity. It's a heavy, heavy burden. And so I think they have to take a step back and realize and remind leadership that it cannot all be done at once. So chipping away at it is important. Yeah. Yeah.

So, so, Daniel, I have one more question for you and then we'll wrap up. But how— what— okay, two things, I guess. One would be, is there anything that you would like people to understand about the National Cybersecurity Alliance? And then also, where can people learn more? What else can they, can they figure out and, you know, what can they do to get involved?

Yeah, well, you know, I think, you know, the National Cybersecurity Alliance is one, you know, we're one of the oldest nonprofits in cybersecurity awareness there is, and we have lasted as long as we have because of strong public-private partnerships. So if organizations are— your two questions kind of blend together for me, actually. If organizations want to learn more about the National Cybersecurity Alliance and get involved, there are many ways to do that, such as submitting, submitting blogs, or I often collaborate with organizations on tip sheets that are relevant to different audiences or other resources. I just wrapped up a learning module that we're going to deploy with the cyber or white-collar crime Center. And so, you know, we're always looking for collaborations, but being a nonprofit, we're also looking for funding. If there are organizations that like to do— that want to do some sort of campaign with the National Cybersecurity Alliance, you know, we're able to leverage our reach and our deep bench of experience and capabilities to complement an organization's efforts. And so I think one is, you know, we're always looking for collaborations and partnerships in any form or fashion to help spread awareness. And yeah, I think, you know, most of the organizations can learn more about all of that at staysafeonline.org, which is our website. I know some people try to look for us under National Cybersecurity Alliance, but our website is staysafeonline.org.

A lot of people also call us Stay Safe Online, but It's easy to remember though. Everyone needs to stay safe online. Stay safe online. So let's all go there and visit. Daniel, thanks so much for joining us for this conversation. Really important work you're doing. We really appreciate you spreading the word through this channel. And thanks so much and have a great rest of the day.

Thanks for having me. It's been a pleasure. Thanks, Daniel. Thanks a lot.