Cybersecurity Questions Heard Around the Kitchen Table

What do the people least in the know about cyber want to know? What are they asking?

You're listening to Defense In Depth.

Welcome to Defense in Depth. My name is David Spark. I'm the producer of the CISO series. And joining me for this very episode, it's Jeff Belknap. He's also the CISO of LinkedIn. Jeff, say hello to the audience.

Hello, audience, and welcome.

He is talking to you. Consider that a personal welcome.

That's right. You specifically.

That is. Yes, you. The person who's saying me with a big question mark. Yes, that's who he's referring to.

Yeah. And we can see and hear you also.

So you're looking good and we can watch you, especially when you're sleeping.

That might be a stretch.

And that's where the show got creepy. Hey, our sponsor for today's episode, it's Comcast, they're doing some cool stuff in cybersecurity and we're going to learn more about that later in the show. Thank you, Comcast. Thank you for sponsoring this episode of the show. Hey, Jeff, what do those not in the know about cyber want to know about cyber? And when I say those not in the know, it's essentially everyone who is not listening to this show pretty much or would not want to listen to the show in general because it's really only cybersecurity professionals listen to the show. We. But these are the people like our parents, the people who are just sort of out of the loop, but they use technology they need to be secure, and they may not work for a major organization that has a big security department like yours right there. So according to our guest, who I'm going to introduce in a moment, who has a very popular TikTok channel where she fields these types of, you know, every person questions. The top four questions she gets are, how do I stay safe online? How do I not get hacked? How do I get my pictures data off the Internet, and how do I find out what people have on me? So, Jeff, you have a vision of security, but how important is it to understand the concerns of the average person? Are these reasonable concerns or do you think they're directed actually by media pressure?

I think for the most part these are fantastic questions. To be clear, I don't think these are like overhyped or anything like that by media or anyone else, but they give us some grounding in the fact that often on this show and in other places, practitioners like myself and others, we're focused on B2B security or enterprise level security. And we're getting very technical and we often forget, whether it be our end users or our customers or our family members, that they have very fundamental security questions that are no less complicated than how do I stop an attack by a foreign intelligence service that are like, how do I just protect myself online, doing shopping or reading the news? And it's something that we really need to pay more attention to. And I think we have a perfect guest to help us have the conversation.

Yes. Because she's like her ear is to the ground of hearing all these questions. And actually the stuff we're going to feel today are because we asked the community what are the other kinds of questions people are asking and what should they be asking. But I'm thrilled to have our guest on, if you follow her on TikTok, she's known as Cybersecurity Girl, but for this show we're going to call her Caitlin. Her name is Caitlin Sarian. Caitlin, thank you so much for joining us.

Thanks so much, David and Jeff, I'm so happy to be here. What's everyone obsessed about?

What I'm going to read here is a sampling of some of the questions that we got from actually Your post on LinkedIn, Jeff, about this very question. Like, what are the common questions people are asking now? There were a ton more than this, but this is just to give us an idea to sort of get the conversation going. So here we go. Michelle L. Of Risu Consulting said, quote, how do I keep my children safe online? And if they know everything about me, why should I bother staying private? Nika Coretti of Mambu said, what is phishing and how can I avoid it? Scott Norton of Trellix said, can my smartphone be hacked too? Why shouldn't I use public wi fi without protection? Leo Brian Riley of HackerOne said, quote, I've just received a letter saying my information may have been involved in a data breach. What does this mean and what should I do? And Jerome Levy, who's CISO over at Dolby, said, what happens to the remnants of my digital me that I leave behind? So once again, these are all great questions. Let me ask if you're talking to a family member about these kinds of questions, because I can hear these from family member. Is it different than how you talk to your staff?

Oh, yeah, absolutely. Because I think generally cybersecurity professionals, people that would be working on a team.

And even, even not the cyber professional. I'm just talking like the regular business people too.

Well, I think cybersecurity professionals inherently have strong opinions about an answer to each one of these questions. But where we often don't spend enough time is thinking about. We know how to talk to other cybersecurity professionals about this question. The one specifically is the wi fi question, which I feel like is a deeply religious question in some circles about, like, what you should do. But where we often don't spend enough time is talking, like, hey, how do I talk to somebody in sales or marketing or a consumer? How do I communicate? Maybe I'm putting a blog post on my platform. How do I communicate to people that are not technical at all about the importance of one of these issues and what they should do about it or why they should even care? And if you're good at that, you both help the people that have those questions. But you're also better at communicating about why people should care about security in general. And I think that becomes really important if you want to succeed.

So, Caitlin, this is what you do on your TikTok channel, is you communicate to these people. Let me ask, when you started this channel and now, which you've got quite a significant following, what have you learned about communicating to this audience?

It's crazy, because I actually didn't start this channel for, like, this broader audience. I started this channel to inspire more people to get into cybersecurity. And this broader audience happened because my mom, God bless her, kept asking me a bunch of questions, and I was like, you know what? Maybe other people are asking the same stuff, and. And it's bringing knowledge. Yeah, I know.

She's the reason you're successful. Yeah.

I mean, it's always your parents, right? You got to give them credit. Don't tell her I said that.

Oh, she won't listen to this story.

She actually listens to all the podcasts I'm on.

Really? Okay.

Hey, mom. She's doing a great job.

But, yeah, so I started doing that, and that's what really, like, made the channel explode. But just going back to your point, Jeff, of, like, making sure people are understanding how important it is to keep their data safe is the foundation of cybersecurity in every single company, because you're only as strong as your weakest link. And so if you're. Even if you guys are communicating, like, within your cybersecurity team, understanding that you guys have, like, the best practices, doesn't matter what you do. If a salesperson decides to click on a phishing email or doesn't really take cybersecurity, you know, seriously are important. Like, it's. It's kind of Game over. So I think it's being able to communicate clearly and effectively. And it's not even just clearly, it's making it more fun and showing people that their actions impact other things and just bringing it back to them. At the end of the day, the story is how is this going to impact you? And then that will ultimately also impact your company. It's really showing it from their perspective. Most of my videos that do well are the ones that's like, you're doing this wrong. It's pointing things out that they need to understand. And it's not, you know, a broader picture of or a higher level. It's specifically calling people out for how they need to kind of conduct themselves when they want to be safe online.

It seems like the real key here is, as with anything technical or non technical, you got to make it relatable. Right. People have to be able to identify themselves in the problem and identify something that they can empathize with in the answer that resonates with them. Otherwise, like, they're never going to care.

Caitlin, I want to touch upon something that you said about like, you know, the ones that saying you're doing this wrong. That's obviously one example to the question I'm going to ask here is what did you learn about communicating to your audience? Like, what did you used to do that you don't do anymore? Or what are you doing new that you find lands better with them?

Yeah, I mean, Jeff kind of hit the nail on the head there. It's making it relatable. So it's bringing like everyday things that you use, like how you can keep your baby monitor safe or how you can make sure that no one's logged into your icloud and like reading your imessages or how do you know if someone's hacked into your phone? It was kind of a similar question that we talked about. Or are you using your WI fi correctly? It's relating to them on a daily basis, like, oh yeah, I do use WI fi. I do connect to public WI fi. I do, you know, connect my baby monitor to whatever. Like it's, it's bringing their attention and making it more relatable to something that they're using every day pretty much.

And being more specific is what I'm hearing as well, rather than generic of like why I can't be on this WI fi kind of in general.

Yeah, it's not like a mother saying yes or no. Like you can't do this as like a broad like suite sweeping statement. You're Specifically telling them like, hey, this thing, this is how you can fix it. What are they doing wrong.

Here? I'm going to address the things that users should be saying. Nika Kokredze of Mambu said, users often don't ask about the importance of regular software updates, the role of multi factor authentication in enhancing security, and how to identify and report suspicious activities. Troy Fine of Drata said, what are the risks associated with using personal devices for work purposes? That's what they should be asking, Said. And Humberto Ghana of DOT Security said, the information shared through the news only focuses on the big events. The average user doesn't see how that applies to them, so they don't know what to ask. Good point there. So Kate, let me start with you. Do you think there are questions that your audience is not asking that you just sort of say, hey, you need to be concerned about this and you're not even showing that you're concerned because you do get a lot of feedback from your audience, right?

Yes, a ton of feedback. And I think they don't know what they don't know. And actually going back to what you some of these questions, why users don't ask this stuff, I kind of want to beg the question, why would they ask if they're not in cybersecurity and they don't know what half this stuff is, why is this relevant to them? First of all, they don't know what this is. And second of all, even if they kind of had an idea, why would they ask how is this important to them? How does this impact their life? So it kind of goes back to the first part of the segment, right. And how are we making it more relatable? But yeah, a lot of people don't ask because they don't know. You only know so much and this isn't their profession.

Right. And Humberto Ghana makes a good point. It's like, you know, the stories you hear aren't about individual usage. I mean, I think what you're doing, Caitlin, is providing a great service because you're doing what most are not offering at all. What do you realize people don't ask? Jeff?

I think kind of in the meta, people don't ask why any of this matters. Right. And I think regularly we assume that companies like mine should be spending millions and millions of dollars on security. And, and you know, sometimes we get really down in the weeds about, you know, what does this endpoint detection software do, how does it work, does it fight in memory things? And, and we rarely zoom out and Go. Why does any of that matter? And the reality is it matters because people like Caitlin and you and myself have regular human lives. And we do things online because most of our economy is online in many, in many ways today. And if we don't have precautions or if we don't design systems that are robust and resilient, we. We're impacting humans. There is real human harm that can happen there, not just numbers and spreadsheets that get changed or maybe some famous people that get affected. But when it comes down to real human harm, we want to take caution and we want to make sure that there are ways for people to protect themselves. And we want people to ask these questions about how should they protect themselves, what should they care about? And then I think most importantly, we want people to identify the things they should care about versus the things they shouldn't. I love this about the WI fi thing that was in the last segment. You know what, it doesn't matter. If you're someplace where there's public WI fi and you need to use it to book your plane or see what's going on, just do it. Don't worry about it. It's probably pretty safe now for everybody that's going to come for me in the comments. There is a nuance to that, but let's talk about in the comments next time. But the reality is just do what you need to do and then leave it to people like Caitlin and I to make sure it's safe enough for you to do what you need to do.

Let me ask this question to both of you and we'll close out on this. When you hear this line from somebody goes, why do I have to protect my privacy? I mean, they already have everything about me. I've got nothing to hide. Caitlin, how do you answer that one?

I think it's a personal preference. I mean, everyone says that to me about why I created certain social media channels and my life is out there to the world, and I pick my poison. But I think it just depends. I mean, there's a lot of threats out there and I don't want to, like, make this a somber moment, but just know there's a lot of threats out there. So, like, the more data that people have on you, it's probably easier to be targeted for those threats. But there's also a lot of good that happens when you're targeted specifically for marketing. So it's really like choosing what you want and it's having. It's having that knowledge of the ability to choose, like the Consumer has the right to choose where and who has their data and what they do with it. And I think a lot of people don't realize that. So if you don't care, then you don't care. I don't know if. Jeff, you have a different perspective.

Well, I have a different perspective. What do you. Okay, I know you've heard that line before. How do you respond to it? Jeff?

I think for me, there's two things. One, there's a big difference between everyone having your information and like seven or eight companies, presumably from your perspective, having all your information.

Right. But people talk like that. They were like, they have this sort of like, I give up. They've. Everything's out there already. That's.

That's too easy. But I think the other thing that's really important that Caitlin hit on that I just want to really highlight, it's about choice. If you're a creator and you put your whole life online, you're still choosing which aspects do not go online. That is very different. Even though it might seem like, you know, you're letting everyone into every part of your life, you have the ability to make choices about what is not online, and you should retain that choice. And then later, if you decide, I don't want any of that stuff to be online, even though it was, you should have the ability to pull it off. And that is why you should care. And that is why you should care about companies giving you the control to make those choices.

Before we go on any further, I do want to tell you about our sponsor Comcast database. Yes. So in the battle of the MP3 players, there was a clear winner. The ipod. I don't know if you remember any of the players before that, but they didn't quite pull it off. Because Apple knew to hook you in to the ipod by pairing it with itunes, a platform that would make it easy to buy, download, and experience the world of entertainment digitally. Flash forward 20 years and you'll find an analogy to the MP3 player in the security data lake. Like any MP3 player, a security data lake is an amazing repository, but for data rather than media. But if you actually take care to work a little magic on the data upstream, such as performing an extract, transform and load or ETL process on it, then that security data lake becomes, metaphorically, of course, an ipod, transforming data into actionable insights or usability, really. So datab from Comcast Technology Solutions does just that. Datab is a security risk and compliance data fabric platform that works early and throughout the data pipeline to connect and enrich disparate security and IT sources Integrated with your security data lake, datab creates a single source of data truth that can live long term and cost effectively in a data lake and be easily accessed by anyone. So DATAB and your security data lake work seamlessly together to offer a rich data ecosystem that will forever transform your security risk and compliance programs for the better. So learn more about datab and how it can help you optimize your security data Lake investment. Visit now get ready for this it's kind of a funky web address, but you know Comcast. You know how to spell Comcast, right? But it's comca so you put a period between the A and the S in Comcast. So comca C O M C A period St Databee D A T A B E E comcat St Databee.

Why are they behaving this way?

Yael Citro of OX Security said, quote, I don't think they think about it at all. When an attack hits the papers, they look to the left and they look to the right and if no one is panicking, it'll probably work out okay. And Yanis Pierrot Sakos of Detectify said, quote, I recently had to support a few friends that fell for a phishing attack initiated by another friend's Instagram account that was taken over. No one really knew how to deal with this situation, which led to stressful decisions. I want to start with that last comment right there of when you don't know and it happens to you, many people panic. So have you talked people down from the ledge who have been in similar situations?

Caitlin yes, they panic and they go to me. So I have the lucky one. And a lot of times I just refer them back to some of the videos I've made. A lot of people just don't know what to do. And I mean, I don't know if we want to walk through the steps of like some active things that we can do.

But no, no, I mean our audience, our audience is in the know. But more I'm interested in like these people when they don't ask questions and they don't get educated, when it does happen, there's panic.

Yeah.

Because they cause like what do I do next?

Yeah. And then like a lot of times also a lot of companies don't have a place to report or ask an actual person. It's just a bot. So like for example, like meta, like if a lot of people get hacked on like Instagram and Facebook, there's no one that someone can talk to and like, you're obviously kicked out of your. Your account. And so they're. They're like in sheer panic and they don't know what to do. So usually they reach out to me. But, yeah, there's no. I mean, if you think about it, we are all given technology now, like from babies, right? We've never been actually taught how to use it, how to protect ourselves, what to do. And so there's. Yeah, it's always sheer panic. It usually comes. Comes back to me.

And I'll tell you a quick, funny story. This actually happened during the recording of one of our episodes of the CISO series podcast. I was in person recording with the CISO of Atlassian, and I had Mike Johnson, who now is the CISO Rivian, with me. And just literally a moment before I was going to hit the record button, all of a sudden my sister calls and she got caught in a phishing scam. And I said, guess what? You called at the right time. And I put her on speakerphone. And both CISOs essentially told her, just call your, you know, your help desk and tell them this has happened right away. Because she was. Because she was embarrassed. She was embarrassed this happened. And most people are. I mean, you've probably seen this too, Caitlin. Yes.

Yeah.

Embarrassing, definitely. Yeah. So. And now I've told everybody, by the way, on the podcast, that this happened to my sister, so she should be.

More embarrassed if anything, if it happens again. Hopefully it doesn't. She won't be embarrassed anymore because everyone already knew she did it one time. So what's. What's one more. Right.

We all get one ride in the barrel.

All right, so, Jeff, have you dealt with. I mean, first of all, obviously you've dealt with these incidents at work, but outside of work, for friends, family who have these had these incidents. I've had also similar to something happened to my mom.

This is the thing where it's a great opportunity to remind ourselves that humans use our product. And if we don't provide an obvious way for people to deal with harassment or report a problem or recover an account that gets compromised, we are setting ourselves up to, you know, we're creating a lot of panic and confusion and fear in our users, but we're also setting up ourselves for a really expensive support cost. And we're forgetting that we build these things, a lot of them, for people to use to improve their lives or, you know, in some places, people are making money off these accounts, whether they be, you know, like Etsy or TikTok or YouTube, where you're monetizing your content like this is your job. It is all too easy in some cases for a large business to just go, I don't know what's going on with the accounts, so just shut it down and nuke it. And it's dead to us. And the reality is like, we are not doing enough in the industry to make sure that people have an easy path to recovery when something like this happens to them. And therefore people still have these really panicked questions when one of these things happens to them.

Why does this still happen?

Heather Naggle over at Kodis Dak said, and she referenced something we reported on not too long ago, quote, we saw today about the school that reset everyone's passports to change me. How do regular, everyday people know what is safe and best practices without a clear path? We're studying cybersecurity in depth. And this, we all brought this up earlier. Caitlin, you as well. This is not the case. And then Rebecca Harness, CISO of Quickbase, put a funny comment. She said, the second I tell people I work in cybersecurity, they change the subject.

I wish they did that to me. They just asked me if I'm going to hack into their phone and I'm.

Like, oh, I know. That's irritating, isn't it?

Absolutely. We are. That's what you do all day.

Already did it.

My dad was a doctor, and what drove him crazy is when people would chronically pester him for medical advice. And he always threatened he would do it, but he never did. Where he would say, sure, strip and I'll examine you right now, which never happened.

I'm learning a lot about you and how you came to be David based on who raised you.

Things are making sense now.

Yeah, it's all coming together.

So I want to get to the, you know, we sometimes make fun of and security people do this. I don't condone it, but they do it where they make fun of the ones who don't know. Oh, they're so clueless. Like the wall of sheep at Black Hat, too. Let's make fun of the people that we're hacking into. But as we realized, you know, without a cybersecurity education, like the case that we heard of the person who changed everyone's password to the same thing and then essentially allowing everybody to look at everybody's account, it didn't dawn on them to not do that. And they didn't necessarily have the right cybersecurity education to not do something like that. Now, I know it also seems somewhat logical as well, but how much can we blame people for not knowing if they don't have traditional educations, Jeff, how.

Much can we blame them? 100%. How much should we blame them? 0%. And let's just take this example. When you fly in a plane, how much aeronautical engineering and piloting knowledge do you create in yourself beforehand? Zero. And your flight on that aircraft requires you to have zero knowledge. Right. We build all these systems into the planes. We put people on the planes that are there to ensure your safety and ensure that you have a safe ride. We put people that have tens of thousands of hours of experience in the piloting seat. They have, you know, tons of support structures around them because we realize this mode of travel is for common people that don't need to have this knowledge and they're going to use this as part of their daily lives and rely on it. Unfortunately, that thinking of like the person who is a passenger or just utilizing this utility for day to day use shouldn't know all this information. That's thinking that doesn't carry forward to things like, you know, apps that we use on our phone or, you know, our day to day use of computers. And it really should.

So Jeff makes a good point. I mean, like, we have systems out there, like flying, where usage requires no knowledge of the product. But we realize in cybersecurity that's not the case. We essentially demand users understand knowledge of the product.

Do we demand it or do we just assume that they have it and. Or hopefully assume that they have it? If anything, I feel like we're happy that they don't have this knowledge because it might be more flooding of questions and comments and concerns. I feel like it's kind of swept underneath the rug. I'm obviously on the user side because I interact with them on a daily basis. And I think it's the company's responsibility to start educating their users on how best to use the platform or whatever it is. App, website, I don't care what it is. I know some banks send out reminder emails about passwords and stuff, but I do think it's the responsibility of the company to like inform users what their rights are and what they can do. And obviously there's the privacy policy that some people in your comments will probably argue that, you know, companies have. No one reads that. So how are we educating users in like a digestible way that's relatable to them and so they know the importance of everything that's going on because there's no education, like we talked about numerous times. Anywhere.

Well, we are going to bring this to an end right there on the. There's no education closer, but I mean it's quite the opposite. Caitlin, this is exactly what you're doing. This is the service that you're providing. So by the way, to our listeners, if you're on TikTok, which a bazillion people are, although many cybersecurity professionals stay away from it, by the way, what's your take on that from the cybersecurity professionals who stay away from TikTok?

Caitlin, I understand that the media has portrayed TikTok as basically the devil, but from my work with them, I don't agree at all. And I think it's the platform that's actually able to. You're able to communicate to the next generation of people. It's such a powerful platform and it's not, in my opinion, it's not controlled by the US at all. So probably why the US doesn't like it. It's very much based on what you like and the algorithms cater to you. So I think it's such a powerful platform and I think people should give it a chance, in my personal opinion.

Well, I am a fan of it, I use it and I follow you as well. Caitlin's account is Cybersecurity Girl. All one word on TikTok. Please follow Caitlin Also, we'll link to it as well on this page. Now, normally we say what's your favorite quote and why? But since this was sort of such of a kind of a mishmash of a show because the quotes weren't exactly always advice, we're going to skip that part of the show and we're just going to close, close out. And first I'm going to say thank you to our sponsor Comcast. We greatly appreciate you sponsoring and being a brand new sponsor of the CISO series. We've actually been in long conversations with Comcast, so thank you for sponsoring us. I want to thank you, Caitlin as well for coming. And any last words? I've given a plug to your channel. Anything else you would like to plug?

No, I. I'm just really excited to be here. I have other channels too on Instagram. So if you decide that you don't want to start a TikTok or you don't have one. I'm also on Instagram for Cyber Security Girl as well and YouTube and you.

Put the same content there or something different.

It's similar content. Yeah, I kind of switch things around a bit. But yeah, I'm just happy to be here. And if you guys are, like listening to this, make sure you go back to your loved ones and educate them on the importance of cybersecurity.

Caitlin, have I mentioned there's this other platform that you may have heard of, LinkedIn? Yeah, it's. You should give it a shot. Take a look at that.

I feel like when I post my reels on LinkedIn, it. It's a little bit different. It's not as professional as I feel like LinkedIn should be. I still go on LinkedIn all the time, though.

I love LinkedIn. I think you, you have to bring the change that you want to see in the world. And if you think LinkedIn needs to be weirder, I think you gotta lean into it.

Lean into it.

I mean, I'm already extremely weird, so I can make it weirder if we need to be. But yeah, we'll work together on bringing it a little bit weirder. How about that?

We welcome all of that to our audience. Just to let you know, it's our first guest who brought a matching pink microphone and pink jacket and we appreciate.

That he's extremely on brand.

Barbie inspired.

Barbie inspired recording. Thank you very much, Caitlin. Thank you very much, Jeff. Thank you to our audience as well. We greatly appreciate your contributions and for listening to Defense in Depth, we've reached.

The end of Defense in Depth. Make sure to subscribe so you don't miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site cisoseries.com where you'll also see plenty of ways to participate, including recording a question or a comment for the show. If you're interested in sponsoring the podcast, contact David Spark directly@Davidisoseries.com thank you for listening to Defense in Depth.