Unspoken Security Ep 34: Security Awareness Training Sucks! Focus on Situational Awareness.

I don't care if a client gets upset with me, like, oh, I don't want you back because you did that. Like, I did the right thing. Screw you. I had a CEO, I broke into their, their building. This was in another country. I broke into their building and I destroyed them. It's like I went to all these floors they swore that I was never be able to get to. It's like I literally called them like, okay, I'm on your, in your IT department floor. Like, okay, well try to see if you can get into legal because they're lawyers. It's like they've got a lot of data to protect. It's like they're, they're going to catch you.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry. Hey, thanks for tuning in to Unspoken Security. My name is AJ Nash. Before we jump into the show today, I wanted to give a brief understanding of what you're going to see. I have a great guest this week and the content was just so good that I didn't wanna, I didn't wanna cut it short. So for those who've watched or listened to the show for a while, you might remember we had the same thing about a year ago. We had a couple guests on and the show ran really long and I just don't like losing good conversations. So this week I had the same situation. So the guest is Jason E. Street. I think everybody probably knows him in the industry or most people do. And Jason's fascinating and the story was just too good to let go. So what you're about to hear is part 1 of a 2-part episode that we're gonna run of Unspoken Security. I just want to make sure people were aware going in. Please do, you know, pay close attention to the things he has to say. He's a really interesting guy, really smart, knows a lot about the industry, and the conversation is going to be fantastic. And then we'll go ahead and pick it up again in 2 weeks and finish the show. So I just want to give you a heads up, jump on in and catch the show. Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA. I've been building and maturing intelligence programs in the private sector for, I don't know, about 9 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. And I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! So I continue to be deeply committed to servant leadership as a result of that work. Now, this podcast brings all those elements together with some incredible guests so that we can have unfiltered, authentic conversations on a wide range of challenging topics. This is not gonna be a typical polished podcast. My dog makes occasional appearances. She's at daycare today, so she won't be here. People argue and debate sometimes. We even swear here, although my guest today isn't much for swearing, so that won't happen probably. But all of that's okay. I want you to think of this as a— the podcast is really like a conversation you'd overhear at one of the bars after any of the long days that we have at these large cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now today I'm super excited because I'm joined by none other than Jason East Street. Now Jason's the Chief Adversarial Officer for Secure Yeti. He's been called the Notorious Hacker by Fox 25 in Boston. He was called a world-class hacker by National Geographic. He was called the Ponchy Hacker by Rolling Stone magazine, which is a little insulting, but he's also been known as a change agent according to the director of counterintelligence at the Pentagon. However, Jason's a pretty humble guy, and he really just prefers that people think of him as a hacker helper and human. He's a simulated adversary for hire. He's the author of the Dissecting the Hack series, which is currently required reading at 7 universities in 4 countries last we knew. And above all of this other stuff, he's the DEF CON group's global ambassador, and he's spoken at conferences and summits in over 50 countries. Jason, is there anything you want to add to that?

That about sums it up. That's more than I usually talk about myself. So it's like, I'm, I find it very boring.

So it's like, yeah, well, there's, there's definitely nothing boring about you as far as I'm concerned. I've been wanting to get Jason on the show for quite a while. It's my own fault, really. I just, I'm lousy at following up for a lot of these things. Jason's also really busy, as everybody who knows him, I'm sure, is aware. But we were able to huddle up, and so today we're gonna have a really cool conversation. The topic today is security awareness training sucks, so focus on situational awareness. Listen, everybody knows security awareness training is a needed thing. We all have it. You got your annual things and you gotta do your checkboxes and, and whatever, right? And some of that's just cover your ass stuff for corporate or in the government space. And most of us, at least most people I know, have multiple screens. So a lot of times my security awareness training is in one screen over here and I'm doing my work. And then when I stop hearing it in my ears, I click the next button and I just keep going. And we're doing a long time and, and that's fine, but that's not really keeping anybody more secure. You know, it's, it's checking some boxes. But, so Jason, I wanna, I wanna turn to you on this one, right? So to you, what's the difference between, we're gonna talk about the security awareness piece, but you said we should focus more on situational awareness. So what's the difference in your mind between security awareness and situational awareness?

Oh, it's a huge difference because security awareness is policy-driven. It's not really talking about how to be secure, it's how to be compliant as it relates to certain security concepts.

Mhm.

That's way different. It's like, I, it's sort of like, you know, we talk about compliance like this is going to solve problems. And I always mention, well, what about PCI compliance? Because PCI compliance, to me, I call that Schrödinger's compliancy. Because if you look at every major company that has been popped, they've always been PCI compliant till they're not. It's like, you know, it's like, it's like Schrödinger's compliance here. Like, are you compliant or you're not? We'll never know. It's like until, until someone from, you know, Paraguay lets us know because they hacked into the server. They say, gotta watch out for the Paraguayans. But I am, I'm telling you, well, that's a whole other rant. It's like I got a whole theory about how Paraguayans are like the, the government APT groups from the Paraguay government are the most sophisticated advanced attackers you'll find on the planet. You know why? When's the last time you heard about an APT from Paraguay? That's how good they are.

Wow.

You got to watch out. But I am telling you, is all that security awareness is just policy driven, how to deal with the policy. And it's like how to deal with the company to keep the company safe. Like all these different things that are driven by the company. And I've got this horrible thing and it's like, and I'm sorry to start off on such a, such a terrible topic, but people may not realize this. Employees don't care about your data.

No kidding.

I'm sorry to be the one to tell you that. I'm sorry to be the one to tell you that. That's like, I know it's rough to hear, but they're not really caring about your data. It's like when they've got all these other things that they've got to deal with, all these other policies they got. So until you show them why they have to care about their, your data, well, they're still not going to care about your data. But if you show them why they need to worry about their security, how they need to be more security conscious, not just at work but at home, online at home, on their laptops, at a coffee shop, at— in the mall when there are no computers nearby at all and they're just walking through the mall. When you— excuse me there— it's like when you see that kind of people understanding that there's other threats out there it's like, that are not just related to the data of the company, then they start becoming more security conscious, more situationally aware. And guess what? They still won't care about your data. But if they're not going to fall for it at home, they won't fall for it at work. And that's what you're supposed to be trying to get to, not trying to get them to just like turn this little knob as soon as they clock in, where, oh, now we're at a ton of time, now we're going to follow all the policies and procedures. That's not how that works. It's like, it's one of the things where it's like, I joke about security awareness. It's like, you know, it's very fitting that they put it in October. It's like, because I'm telling you, it's like Security Awareness Month is perfect for October because every year you have to dress up for a month that you care about security policies. And it's such a rip-off because at least at the end of the month I get candy for dressing up like, you know, a raccoon. I don't get nothing for dressing up like a security-conscious employee. They don't give out candy.

That's how I'm upset.

That's angry. That makes me angry. It's like, it's like I wanted candy and I get, I get PowerPoint. It's like, and you get a nice little certificate a lot of times, right?

You get that, you know, that quick PDF that says, hey, you passed whatever corporate security awareness program. It doesn't, but like I said, it doesn't necessarily do anything. It's interesting. Like I've had some of these same discussions, not, not in the way you're framing it. I like this. I talk to people a lot about, you know, security awareness training. The challenge is it's this, like I said, it's like once a month, you know, once a, one month a year or whatever. You just kind of turn it on and off. It, it needs to be a culture. I always talk about, you know, the company has to have a security culture where it's an everyday thing. But you've, you're talking about it in, in a way that I think is even more interesting in that it's helping people understand the situational awareness all the time, not just at work, you know, is building not just a corporate culture of security, but, uh, just an everyday— this is, this is your life, this is your way of life. So that when you're at the mall or the coffee shop or all these places you were talking about, it's just always thinking security. Not like paranoia necessarily, although that happens, but, but to, to just have this ingrained as, as who we are as people. And then you don't have to try to turn it on and off, because like you said, you're not gonna come into the office and suddenly have a totally different set of behaviors you know, we do some of that. Everybody's got some masks we wear to an extent, but you know, it's challenging if you're somebody who does nothing. I'll use me as an example. You curse like a sailor all day long. You're gonna eventually curse in the office space, like even if you're not supposed to, it's challenging, right? And I, I know having done this and others have too, it's hard not to have whatever you're doing every day leak into what you do in an office space, right? And so I think that's, that's an interesting concept. I haven't thought of it until you just said it of helping people see this all the time. Because if this is how you live outside the office, this is how you'll live in the office. This is how you live on your own computer. This is how you'll live on our computer. And getting away from this check-the-box, you know, one month a year, you know, worry about whatever things are going to come your way, right? But I talk about it from a cultural standpoint and sort of a teaming standpoint with the security teams. But I like what you're talking about is, no, it's an all-the-time thing. Like, we have to help people just understand what the world is all the time. And these threats are everywhere. They're not just when you're on your corporate computer, they're on your personal computer, they're on your phone, you know, they're, they're part of your social media packages and that kind of a thing. So I, I think it's a really interesting idea and you've presented it in a way that actually nobody has really said this to me before. So, you know, are there other aspects of it beyond what we just mentioned in terms of, you know, the, the coffee shops and those kind of things? You know, where are other areas where you think people need to start seeing it this way?

Well, we have failed our employees from day one. It's like, it's like one of the things is that so many people in cybersecurity are so quick to blame the employee. It's like stupid user clicked on the link, stupid user went to a website. I say stupid information security didn't properly train their employees on day one. It's very simple. You go to all the employees on their orientation and you tell them, my job is for securing the company and protecting all our jobs. But you may not realize this, that's also part of your job description. If I— if we had a company where we had a delivery driver, the delivery driver is hired to deliver packages. But we all have to realize that that delivery driver knows that to deliver the packages, they're given a piece of company equipment, that van. So that means part of their job responsibilities to do their job is the safe and secure operation of that piece of company equipment. They have to make sure they lock the doors when they leave. They can't allow someone to bring something in that's not authorized into the, into the vehicle. They're not allowed to let someone take something out of the vehicle without authorization. They can't accept unknown packages that are not supposed to be there. It's like they have to follow the safety laws. They have to use their seatbelt. They have monitoring systems on their vehicle to monitor their behavior. They have to, I mean, use the turn signal possibly, maybe one time every day, maybe, hopefully. It's like, so they have to operate that vehicle because it's a piece of company equipment. And so your employees need to realize, and you need to talk to them as with their laptops and their desktops as a vehicle, because they makes it relatable to them saying, just like a delivery, your job may be HR, 'Your job may be accounting, your job may be developing or making widgets, but in the process of doing your job, like delivering packages, you're given a piece of company equipment. And so therefore, it's part of your job responsibilities to maintain the secure and safe operation of that piece of company equipment.' And when you say that right off the bat and they realize because a lot of people are like, well, security is not my job. I'm not getting paid to do this. I'm not getting paid to worry about like what emails are coming in. But when you let them understand part of the responsibility of the equipment that they're given is, is security and stuff, then they start understanding that. And when you explain to them, I see you as an employee, I see you as a team member, You're part of my team. You need something from me, you let me know. You find something a little bit suspicious and you feel like, oh, I don't know if they would send it to me, I'm not gonna make fun of you, I'm gonna thank you for it. It's like, uh, you are part of my team and all team members have to work together. It's like we're all working to keep the place secure so we, we can keep a job. It's like when you show that and you tell them, hey, you know what, we're going to do a lunch and learn on how to properly secure your Wi-Fi at home. We're going to show how to update the firmware on your routers because the FBI sent out a report saying that you had to update your D-Links. Well, we're going to show you how to do that. When iOS comes up with a new update on the iPhone or Android and Google comes out with a new update, we're going to send you a company-wide email letting you know, hey, update your systems. It's like, this is a new— and then when Windows or Mac or Linux comes out with the new— well, not Linux because it's like every other day, but when it's like Mac or Windows, You know, second Tuesday of the month, it's like, hey, this was a very bad security patch. Make sure you update your systems at home, not at work. Make sure you update your systems at home because we care about your security at home. And when you do lunch and learns that talk about like how to check the settings on privacy for your social media accounts, how to check to see what your children are doing online to make sure they're safe. When you do these kind of lessons, when you give them lessons on pickbutchering scams or jugging or like all these other kind of attacks that they face in the day-to-day world, they're going to come to the realization that, yeah, I have to be more aware, but also, oh, security's not trying to get me, catch me doing something wrong. It's like they're not trying to catch me riding dirty. They're, they're trying to actually help me. They're actually— they're part of it.

Yeah, like, yeah. Well, it's interesting point. So I, I gotta ask you a question. I wanna come back to that 'cause there's more, you know, we're kind of rolling into the second question as we do this, which is good. But you said something I really wanna, I wanna jump on because you talked about, you know, these like brown bags, like lunch alerts, help people know. And you mentioned like, you know, updating your router for instance, which is, which is a pretty technical thing for a lot of people, right? But it, it, it spawned an idea as you were going down this path. So we didn't talk about this at all in the prep, but I'm sure you, you, you're knowledgeable enough to know a lot about it already. I've seen some companies talk about even going down the path of like, hey, We're going to extend into your home environment, like we will provide security for your home environment. I've seen at least executives, right? Where are your thoughts on that? As far as it— let's say a company wanted to do that. They're like, hey, we're gonna— we're not gonna do just corporate security, we're gonna do all your home security too. We're gonna provide you a router, we're gonna— we're gonna tie you into our network, we're gonna do all this, or we're gonna, you know— where's the line between, hey, that's a great service, that, that would help my house be safer theoretically, and hold on a second now, what happened to my privacy? Now I'm part of your network all the time. What do you think's gonna happen with that down the road too? Is, are we gonna see more of that? Companies actually extending into employees' homes because there could be a service and a benefit. And, and what do you think might happen there? I've seen a little bit of talk in that space.

Lord, I hope not. It's like, I, I am telling you right now, it's like if you have a laptop, a company laptop, and trust me, I've, I've made employees hated me when I was doing the blue team and stuff working at this bank. And some of these other organizations I worked at because I was like, if you're given a piece of company equipment, that laptop, I don't want you to be able to access anything except for the VPN that connects to our internal network and then makes it— you can't be surfing on Facebook or tweeting something or downloading the map or going to— no, you have to go every trap piece of traffic from that device has to go through our routers, has to go through our device. I don't want to know what's on your network. I don't want to know what's on your systems or what's on your personal computer. That's your personal stuff. I just want to make sure when you're using company equipment, it is through a third secured connection. You could connect to our network from your home from a conference, from a hotel in another country. It's like, as long as it's going through a secured connection— because we had a separate DMZ for our VPN users with a little bit more monitoring and restrictions. It's like, when that was done, it's like, so that's the important part. It's like, you do not— I don't— because once you start securing someone's home, then you're responsible for everything that that person's doing. And you know, if you got someone at the— under the age of 25, they've got a Minecraft server they're working on and stuff, and they've got some new JavaScript packages to put on it that are really cool. They said that they're going to get extra bonus points for it if they, if they download it and run it on their systems. Or there's a new build for Baldur's Gate 3. It's like, let's get that going. No, no, it's like you don't want to be responsible for that, and you also don't want to be monitoring Oh, I saw that y'all went and y'all were staying online just a little bit too late, or y'all— and what websites do you go? It's like, I don't want my government, my company to know what porn I go to. That's between me and my government. It's like, okay, it's like, it's like that, that's, that's a personal matter and stuff, you know? It's like, you don't like everybody else knowing your business. That's why I got up so upset with Snowden. It wasn't the fact that they were spying on me and grabbing all that stuff. We knew that. It was the fact that they leaked it. You're the National Security Agency. Motherfucker, I don't want my porn surfing history going out to the world. People in China and Russia and the Paraguayans knowing it. It's like, it's like, that's ridiculous.

I can assure you the Chinese do not want to know the porn you're having. Been at the agency a long time. I can assure you the agency doesn't want to know exactly that you're watching. I promise you that. I certainly didn't want to know it, and I'm sorry I do.

I didn't say I was watching. I'm saying this as an example. I don't even want to know more about your porn history.

Maybe offline, maybe at some point. But it's interesting because, I mean, I'm with you, obviously. I don't want companies, you know, involved in my network, right? You know, I've seen some of it at the executive level. There's some executive protection in terms of, you know, it's a service, right? So it does make me wonder where that line is. Are they going to come in? You know, they can set up my network for me. They can set up security. They can advise on it. But I don't think I want them to be monitoring. What's going on in my home network. But it is interesting because you have challenges, and executives tend to be some of the worst in this sometimes, in getting people to follow the rules, you know, follow the advice. You tell them all these things they should do, but then they don't do it. You know, simple things like social media is a good example of that. You know, stop posting. Well, first of all, lock down your social media. Stop having your Facebook open to the world. I can't imagine how many times I've run into that, and I know you have as well. It's really easy to do a bio on somebody when you keep your Facebook wide open. You tell me where your kids go to school and what activities they're involved in and what your alumni association is. And what trips you're going on and where you are in the world, well, it's good to break into your house while I know you're in Paraguay apparently. You know, I can knock down your door 'cause you're not around 'cause you told me you were gonna be on a soccer trip with your kids or whatever crap you're doing. So like helping people understand that, but that gets back to the discussion we were having earlier of this all the time sense of security, right? Helping people see it all the time and have it be a part of, you know, their life, not just something we turn on and off. And so, you know, one of the questions I know we were gonna talk about, and we sort of leaked into it already, which is good, So we know that security awareness sucks. We, we already opened with that and we wanna talk about the situ awareness, situational awareness instead. What does good training look like to you? We already know the check the box once, you know, every October is garbage. Like it's not really helping anybody. It's compliance and you maybe you'll keep doing it for corporate, but what's good security training? What's good situational awareness training look like to you year round?

I would say one of the things I do, and this is not a shield, but it's like, this is said within two, it's like I do a training class at Black Hat which actually talks about, and it's geared for IT people, for security people, people who deal with employees to try to create security awareness. Because what I do is I show them, first part of the class is how to rob people, as but for demonstration, not for actual doing a teachable moment. It's like, it's just for how to do demos that will impress executives or get them to like go, oh my gosh, this is a bad thing. So we go through those steps. And then the second part of the class is literally how to gamify and create a situational awareness program in your company and environment. It's like, and one of the things that we do, I kid you not, one of the labs that we do in this class is Meme Creation 101. It's like how to create a good situational awareness meme. It's like a poster. Because now imagine this, you want your employees to take security seriously, and so you go and you buy all these stupid security awareness posters to put up for month— for October, and they're like, oh, well, whatever. No. What you do is you have a competition among your security people. You tell the employees all company-wide that they get to judge the submissions from the security team members of their security awareness meme poster, and the top 3 winners that y— they voted on they get to be printed out by the company. It's like, and put up in, in the building. You just made all your employees read— because it's 3 entries per employee— you made them read what, 9, you know, 18? It's like, how many situational awareness meme posters did they— because they have to understand the meme They have to understand the relativity to security and why it matters and why it's funny from the security aspect. They got— we got them doing research on security now, and it's fun. Year-round they get to go and look at the poster like, 'I voted for that one.' It's like— and they feel like they're judging security, not security judging them. And that makes them feel more actually involved in the process. And more invested. That's how much money does that cost? Not very much.

Not as much as a breach.

The return on the investment. And there is a— oh man, I blank on his name. I wish I could have it. It's like— but he works for this bank in Colorado, and he created one of the most revolutionary— and when I do the class in Black Hat, I literally have a screenshot of his LinkedIn profile because I give him full credit and props to it. But what it is, is he works for Alpine Bank, and it's like— because they allowed me to say the client's name— and he literally, he created a phishing competition. One of the worst exercises that a security person has to do for their company is a phishing exercise because everybody's going to hate you. Okay, because they feel like you're attacking. Why did you send this to me? Why did you try to trip me up? Why did you try to get me to click on it? So what he's done is literally, it's a year-round competition. It's like, I may add a little bit, I've added a little bit to it and stuff, you know, to what they've done, but not to discourage from or dismiss from or diminish what they've done. But the way I envision it is year-round. You have a year-long competition that ends in October because of Security Awareness Month. It's like— and what you do is HR attacks legal, legal attacks IT, IT attacks— and what they do is each department is responsible of creating their own phish. Then They fill out the who they want it sent to, and there's a form on the intranet website that security provides so they don't have to write it all out. All they have to do is fill in the blanks. Here's the people we want to send it to, here's the subject line, here's the body, and here's the malicious link we want included for them to click on. And then that's in the format already so the security team can just copy and paste into Go Fish or whatever server they're using, and it's like, and send it out. And they do this year-round. So in January, legal's attack goes on. February, IT's attacks go on. Or it's like, if it's a banking system, you got one branch going after another branch. So they have to discover what kind of fish And then in October, there's two awards given out: the department or the team that had the most successful clicks, and the team whose team clicked the least. And so now you're no longer going, oh, freaking security trying to trip me up. You're like, oh, it's on now, motherfucker. It's like, I'm— now it's a competition, but also it's year-round. Is this the month you're targeted? Do you feel lucky, hump hump? You feel lucky? It's like, it's like everybody's gonna be on edge year-round to see if they're being sent the fish this month and this is the time that they're being attacked. Is that— is that—

is it Ross Bensler? Is that the— is that the guy from Alpine?

I will. I'm going to straight up—

I was Googling while you were talking. Ross Bensler apparently is a VP there, executive VP, and I know he did a blog article talking about what you're talking about.

Oh, good. Then it's probably— it probably is. It's like, I'm trying to see. It's like, yeah, here it is. It is Ross Bensler. Yes.

Yeah. Look at that. See a little—

he is the man. He's done so much for that. I went there to give a talk to them. And, and I was supposed to be like teaching them, and I told him like, dude, it's like you schooled me, motherfucker. Yeah, it's like, why did you need me here? It's like, it's like they, they've got their— when people do something good, they've gamified it. And that's the whole second part of my class is talking about the gamification of security awareness and situational awareness, and they've got it down pat. My talk next year is actually based on some of the stuff that he's done. And what I do is I show an actual exploit that I would do or something that I would use for an attack, and then I show how to gamify it. It's like, and how we could gamify people to be aware of those and, and thwart them. It's like, so, but yeah, he is like, he's done wonderful stuff. It's like, I love it when the good guys win., and I love it when bad guys have bad days. And he is like the blue— he's one of the best blue teamers that I've seen in a long time with the way he does stuff. So props to him. And, and also, as a red teamer, we all have to realize the only reason red team exists is to make the blue team better. It's like, if you're not helping and make— and improving the blue team, you suck. It's like, it's not about breaking the stuff, it's about validating their security and finding issues that they need to fix. That's it. That's your job.

Yeah. Well, you make a good point there because— so I love gamification, right? It seems like a lot of the security is like the red team is out to win, right? They want to make people look bad. They're just almost overly aggressive, you know, in their competition, as opposed to remembering what you're saying, which is, hey, the job is to make people better, right? And find a way to do it. And if you can do it and make it a positive experience, It's not about humiliating people. It's not about, you know, throwing people on the wall and saying how bad they were at this and, you know, shaming them into more training. And as you said, like, I've seen teams where it's like, ah, we won. You know, the red teams are excited. They tricked a bunch of people and it's the same people they tricked last year. It's like, you didn't win, you lost. You're not teaching 'em. They're not getting any better. Exactly. Like, the idea isn't to do that. The hope is, sure, the first year you launch a program, you'll, you'll get people. But the idea is to go, hey, how do I help you get better? Let's, let's sit down and see what happened. This is why you got tricked. It happens. Listen, everybody gets fooled occasionally. Everybody has clicked on a phishing link, myself included.

Exactly.

It happens.

Myself included. Yeah.

And that's the thing is, is saying, okay, how do we make this less likely to happen instead of, you know, getting in their face and trash-talking them essentially like it's some sort of a sporting event, which I don't recommend doing that there either. But it's, it's this aggressive, competitive, you know, instead of being teaming, as you said, of, hey, we're on the same team. My job as a red teamer is to help you get better as a blue teamer. You know, every year hopefully you beat us more. Like the red team wants to lose. That's the idea, right? At the end we should all lose cuz if we lost, you won and, and the, the company is safer. And if you lost, you didn't lose. I think I'm gonna steal a line from you, but you said you didn't lose, you learned, you know? And that's, I think that's a key component is not to get on their face and talk about, oh, you lost and you're doing terrible, whatever. No, you learned. Let's talk about how to make it better. Here's the things for next year, right?

Exactly.

And, and so as long as the red team continues to think that way, that Hey, we're here to help. It's a teaming thing. Gamification, I think, I just, like I said, I love the idea. Make it a game, you know, get people involved to compete in a healthy way with each other. Get them thinking about security. Get them to stop thinking about, ah, I hate those damn security guys. They're always out to get us. And they're, they're, you know, because that's what people do. And then people want to work around security. They want to avoid security. Security is the enemy, as opposed to the enemy being the guys and gals outside that are trying to get into us, right? That's the real enemy, not security. Security is supposed to be helping us get better. And so I love what you're talking about, and, you know, props to Ross Spencer over there at Alpine Bank.

Apparently—

I don't know Ross, hopefully he watches the show now— because it sounds like he's doing some very cool things. And anybody who doesn't know Ross, who wants to get better, should check him out.

Yeah, I met his whole team. He's got some savvy people with him, which is really good. And, and when we get back to like this whole red team toxic masculinity that you like, you gotta put people in the face, see if they got a plan, and you gotta like break it and you gotta find vulnerable— no, motherfucker. They are— every client that you come across, they're getting a vulnerability assessment, a red team, every day, 24/7, from all over the world, especially Paraguay. It's like they are getting— they're, they're getting attacked. These— your client is paying you for the effing report and to be able to tell management in an effective manner So they will invest in the money it takes to fix it. And if you can't give them a report and you can't communicate the reasoning of why they need to invest this money, then you failed your client. I don't care how many vulnerabilities you found. It's not about finding the vulnerabilities. That's not the end game. The end game is getting them resolved, getting the company to fix them. I celebrate so effing much when they shut me down, when an employee catches me without me having to give it to them. I guarantee my clients that I will get caught no matter what during the engagement, but it is so much better when they do it without me having to give it to them. It's like I make— I go out of my way to describe how good the employee did and respond on my reports because I want them to be celebrated. We celebrate the wins that the client does. It's like, it doesn't mean that I'm— and I, I used to have— I have very bad imposter syndrome. I used to fail, very low self-esteem. It's like, I felt like as a red teamer, it's like I had to punch people in the face. I had to, I had to break them or I wouldn't be doing a good job. And if I didn't get in, then I wasn't good. And that is crappy. It's like when I started realizing, and I still get when, like, I've had a company last year where, I kid you not, it's like I— but it was the second year that I, I worked on this client and I did another phishing attack on them. 100%, 10 out of 10.

Nice.

Every client shut me down. And my first thing is going to be like, man, I— could I have done better? But then as soon as that little thing is done, I— and I start thinking logically and not emotionally, I realize I did an amazing job that first year. I made such an impression that every— because it wasn't the same people, it's like it wasn't the same pretext. And I was like, wait a— I— this is awesome. They learned from these experiences and they're doing a better job. It didn't mean that I sucked. It meant that they did what they were supposed to do, and I validated their security because my job is to validate their security. That's my assignment. So many people don't understand the assignment, motherfucker. It's not to find and break something. It's not to find a vulnerability. Sometimes you will find them, but the goal is to validate your client's security.

Yeah, well, that's a good point. And so that leads us to the, to the next piece here, and I'm excited to chat about. So listen, this is what you do, right? We get— let's get into the, the, the— this has all been fun. Let's get into the most fun part, in my opinion, right? So your primary role is, is testing companies, right? As I said, validating their security, like Jason, for those who don't know, and I can't imagine anybody who's listening or watching doesn't, like Jason commits crimes legally. Like, I mean, Jason breaks into places.

This is what you do, right? I rob banks for a living. Yeah.

He robs banks for a living. Right. And doesn't go to prison. Now it's nice. Doesn't pay maybe as well as bank robbery, but the risk's a little bit lower. So let's talk about that. Like, what do you do when you're testing company securities? Like, walk me through like the prep, you know, the process, you know, as you prepare for it and some of the stuff going in. And if you got some war stories you want to share, Like, I think, I know people want to know about this. This is kind of the exciting, cool part, and you've got one of the coolest jobs in the industry, frankly.

One of the things I love about working for Secure Yeti is that it's not just the coworkers. We've got like a really good team, but our clients get what I do. They're not looking for someone to do a checkbox. They're not looking for someone to go and just say, oh, just just go in and, and we want a pen test, or we want you to do that. They let me do the teachable moments. They let me do what I call a situational awareness engagement, where I go in. And when I go on site, you have to understand, I ain't trying to check to see if you're compliant. Sarbanes-Oxley, Gramm-Blueschreily, any other old white dude, HIPAA, HIPAA, I don't care. I'm not looking for compliancy. I'm there to fuck you up. I'm there to be the worst possible thing at the worst possible time in the worst possible way. It's like I am trying to rob you. So when I go in, I will go in through all these different ways. I'll try any different kinds of means. It's like I will go in and then I will do as much damage as I can, and then I leave for 2 minutes. And then after 2 minutes, which shows that I successfully escaped, It's like one of those times it took me ducking into a beauty shop in Beirut while a couple was having dinner from Kenya. It's like it was very awkward. It's like, but I had to, I had to evade to make sure they didn't catch me. And, and then after that 2 minutes, I go back and I make a point to talk to every employee that I compromised. One time I had to get the, I had to wait. In the bank until the bank was closed down so everybody could get there and understand how bad this was. Okay. Because I was like there for like 30 minutes twirling around in the back of the teller line, just like, I should not be here. So, so yeah. So all these kind of moments, it's like, and then I explain to them, and that's where my work is. My work's not the breaking. Robbing people is easy for me. It's like breaking into buildings is comical. I don't know why I, I'm such a good thief and such a good bad person. It's like, I mean, I was raised to be a bad person, but it's like I, I've made the active decision to be good. But man, it's like breaking in is not the problem. The work that I have to do is when I come back, because now I got to take a very negative experience that these people had and I have to turn it positive. I have to explain to them, look, I wasn't testing you, I was teaching you. Your company cared about you enough to give you this live exercise so you would understand what would happen for when a real criminal comes in. You can be prepared. It's like, so when you can get— so you'll be prepared for that. So this is what I'm there for, because your employee— your employers, they're not trying to test you either. They're not going to put a little checkbox and get you in trouble for this.

This—

you've never— you weren't prepared for this. This was not something that you've ever encountered. That's why I'm here, so you see it now, and now you'll be ready the next time it happens.

And that's a good point.

What I turn them to is like— and I say, look, you didn't lose, you learned. It's like, this was a learning experience. I'm a teachable moment. That's all. It's like, so I'm not— I don't talk— I do not give out names. To people that I compromise. I only give out the names and I make sure to spell them right in the report of the people that catch me. And I literally had an employer. I— there's a big problem. When I used to do subcontracting, I have a very bad disability. I don't care about money.

And that's not good for business.

It is not good for anything, dude. Trust me. Personal. And like, I just do— I don't, I don't. I, I was homeless. It's like I came from a very poor family. I mean, we were on food stamps. The gray blocks of government cheese, which was amazing grilled cheese sandwiches. Oh, it's like—

it's good to know.

I mean, oh my gosh, if government cheese was sold in the market, they would not have a deficit. It's like it would be literally— it's like, I don't know what it was about that cheese, but it was good. Little nice little blocks of whatever that was that you You know, pretended that they called cheese. I loved it. Yeah, I loved it.

All right. Hey, thanks. So that finishes up part 1 of the 2-part episode we're running with Jason East Street on Unspoken Security. We've enjoyed it so far. I know he's been talking a lot about security awareness and what we should be doing really, which is situational awareness. And we're just really getting to the good stuff here. But as I said, the episode runs pretty long, so I wanted to cut it into 2 pieces. So we'll be back in a couple of weeks. You'll get to see the second half of this. You'll catch up on the rest of a really interesting conversation with Jason and myself, and also get to find out his unspoken secret, right, that we've got at the end. So please come back in 2 weeks and catch the rest of this. Thanks. That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time. Legends are made.