EP179 Teamwork Under Stress: Expedition Behavior in Cybersecurity Incident Response | Cloud...

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Tim Peacock, the senior PM for a bunch of stuff in Google SecOps, and Anton Zhuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. I have a real job, listeners. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website. cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of the Cloud Security Podcast listeners on our community page. Get the link to that in our show notes. Anton, can you guess what this thing is in my hand?

Well, that's a mineral of some sort or a stone.

That's very good. It's a meteorite. I lied when I said this is the closest I've ever been to something that's in space.

I mean, it's not technically in space anymore, right? So, well, I guess it's a little bit—

Neither this nor her shirt.

Yeah, okay.

And so listeners, what we're teasing is that our guest showed up to the recording in person wearing a shirt that had been on the space station.

That still blows my mind. I'm still thinking maybe it's some kind of a sophisticated metaphor rather than a statement of fact.

I don't know.

Maybe it's been in space in spirit or something. I don't know.

No, I think it's been to space.

It's got me buzzing. Yeah, I think it's been to space.

I think that's really cool. And so what we're talking about on this episode is not cloud security specific, not cloud specific, not security specific, not space specific, but a mindset that can create more effective teams, and specifically teams operating under what we'll describe as adverse conditions. And Anton, is there a space more adverse than either Incident response or outer space? Like, what's more adverse than those 2 places?

I'm thinking recently, I guess there were incidents when people were really thrown into, you know, I don't know what's the polite term, like a real crapstorm, right? When there was major incidents, major ransomware incidents.

Yeah.

Some of them are like really adverse. They're not like, I think about healthcare, I think about some of the recent situations. I'm trying to I'm going to cut some details out of my narrative here, but the point is that these look really stressful. I think in one of the blogs, one of my colleagues, Taylor, actually mentioned that. I'll find his quote because it's a really fun quote.

Well, I'll stall for time. You know, the crazy thing is when you think about this thing of doing security, we talk about how security is a team sport. This episode is about how to make your security team a happier, more productive, more effective team. And I think that's— it's so topical and evergreen.

Yeah. And I found a Taylor quote.

Please.

And the Taylor quote goes like this. I think most people would say, I'd rather not be a victim of a cyberattack that results in my death.

I would like that. Yeah.

Yeah.

I think that's a fair statement. But it highlights the level of stress and the stakes with some of the IR we are talking about.

Yes, it does. It really does. So maybe with that, listeners, let's turn things over to today's Not quite in space themselves, but wearing outer space clothing guests. Today, we are joined by Robyn Szostak, a senior program manager in security and privacy, and Jibran Ilyas, a managing director, incident response, part of Mandiant, now here at Google. Could you two introduce yourselves real quick and tell us about your background, please?

Sure.

My name's Robyn Szostak. I have been at Google for about 17 years, but before—

That's a long time.

Yeah. Yeah. Tell me about it. But before Google, I was an expeditionary leader. I was trained by NOLS. I'm really excited to tell you all about that. And for 20 years, I've worked in security, privacy, safety, and product development at Google. And I'm really excited to talk about it with you all today.

Hi, I'm Jibran Ilyas. I am the managing director in the incident response team for the Central region for Mandiant. I've been doing these incident response expeditions for about 17 years now. And yeah, been at Mandiant, now part of Google Cloud for about 5 years.

I don't want to tell everybody here what I was doing 17 years ago. That's going to be highly embarrassing to me and my perceived level of expertise among listeners. So, I got keen on this deck because, well, because Robin and I ran into each other at breakfast, but you shared with me a deck that described expeditionary behavior as teamwork under adverse conditions. I love that because I can't think of an industry or a role more likely to experience adverse conditions on a regular basis than, well, a security team. Could you tell us what that means?

Yeah. So, expeditionary behavior was first created by a group called NOLS, the National Outdoor Leadership School, which is who trained me. And it was created by Paul Petzold, the founder of NOLS, who saw that in Wilderness conditions, he saw people have conflict with each other. He saw that you'd be climbing a mountain and at the end of the day, people are tired, people are grouchy, and you get conflict, you get people grouching at each other.

That sounds like work.

Doesn't it?

Yeah, that sounds very familiar.

So, he created this structure called Expedition Behavior, which has essentially 5 major pillars to it. But it's if you were to imagine yourself on an expedition. So imagine yourself climbing a mountain or imagine yourself in a canoe. It's cold, you're tired, it's the end of the day, you haven't had anything to drink. And then, you know, one of your co-expeditioners steps on your foot.

Ugh.

Yeah, you're probably going to do exactly what you did. Come on, don't you know I'm tired? You're such a jerk. And that can just now Now, you've got to put your sleeping bag in a tent and sleep right next to that person, and you're grouchy at each other.

Ew.

And so, Knowles created this structure to continually have positive interactions on expeditions. So, the pillars of expedition behavior are, if you think about this, think you've got to depend on one another. Think that you're in this together. No matter what happens out in the wilderness, you have got to depend on the people that you're with. You also can't actually get space from each other, much as you might want to try.

Like us in the studio right now.

Pretty much, right? You think that the wilderness is big, but the ice shelf you might be sitting on or the canoe that you're in is actually really small, and you're next to each other and you're not going to get space. You're uncomfortable. It's going to be cold or rainy or your boat's leaking or whatever it is that's happening. And you've got to get through this together. So they created this structure that focused on communication, leadership and followership, self-care, team care, and group dynamics. And self-care and team care are in that order on purpose. It's really important that you think about them that way. This structure has been so successful that it is now used by NASA to train astronauts. Every single astronaut who's currently in the astronaut corps is trained in expedition behavior.

Huh. So you get to have the same training as all the people in space right now.

In fact, I don't know if you can see it, but this shirt that I'm wearing right now is from International Space Station Expedition 64.

No kidding.

This shirt's been in space. I haven't. But the shirt has.

Whoa.

Wow. That's, that's really cool.

So wait a second. For a few things, I felt like the pillars are kind of about being nice and just being a good human. But some of them feel a little more magical than others. So can you clarify this?

Yeah.

So magic, I actually, I like the way you describe it, cuz sometimes it feels that way. There's one that I really wanna dive into, which is I think the one that's least intuitive to most people. Which is leadership and followership. We spend a lot of time talking about leadership and training people to be leaders and how to be good leaders and talking about what it means to be a good leader. How much time in our personal or professional lives do we spend talking about what it means to be a good follower, to support someone else in the leadership position, to say, look, you're in this role and I'm in this role. This is where we are right now, and I'm going to support you so you are the most successful leader that you can be, and our team is the most successful team that it can be.

That makes sense because at best you get the do what you're told or do whatever you want and align at best. But there is much more.

In thinking about leadership and followership, what you're thinking of instead is what do we need to do together? What will we do together? What do we need to accomplish together? Because if we're having conflict with each other, some of our energy is going toward our conflict and not towards solving the problem that's in front of us.

Like surviving in space or defeating enemies who have nuclear weapons on the side.

You know, this line pays for the entire ticket for this podcast. The energy argument. Yeah, actually, I'm not joking. Like, we can pretty much just call it— and this is because this is like when you argue, when you do something, the energy is spent and it's the energy stolen from solving the problem.

Most definitely. And when you think about the bad actors who are out there, There are a large number of bad actors, and I promise you that they expected whatever thing just happened in your enterprise. So, they're well slept, they've got plenty of caffeine, they weren't thinking about something else, and they know what they've just done. And the defenders, those of you who are seeing this, identifying it, trying to figure out what's going on, you were probably thinking about 5 other things just a few minutes ago, and now you need to figure out how to respond to this. So now you need to put your energy toward this problem, which is of a size that you don't even know yet.

So let's say you stepped on my foot. What am I actually meant to say instead of, ah!

You could say, you stepped on my foot and that hurt.

Oh, that's better.

And then I'd say, I'm sorry, I didn't mean to step on your foot. I'll try to watch where I'm going next time.

Yeah, that's better.

So let's apply it to the IR environment. But it's— this part is much better, but it's a lot is very much in the being a good human kind of bucket. But I think that let's turn it to IR. And I think that I am imagining the sort of like stressful expedition conditions, stressful conditions of dealing with an incident. Like, that similarity is kind of in the air. So, Jibran, how would you apply this if you imagine like the most stressful IR incident you had? Don't have to name names, whether it's healthcare or something else. How did it apply to your actual IR war room or scenario room?

Yeah, out of the many principles that we've discussed, there are 2 that are on top, more or less. One is concern, in other words, the empathy. So it all starts there. Like, if you really feel the pain of, like, a healthcare incident where people are not able to get their medicine, children are not able to get their insulin, The surgery patients are not able to get into surgery rooms. So when you actually feel all that, that is when it all starts. And, you know, as you can imagine, the number one challenge for like an incident response lead is putting together a team on a Friday night or a Saturday morning where everybody has plans. So that, you know, understanding of the situation, how grave that is, and concern, the empathy for other human beings, that is where it all starts. And then once you get in it, The other principle for expedition behavior, which is dignity and respect, that goes a long way. I know some of that we were just talking about. You know, when you give the amount of respect to the person who sacrificed their family time or their studies and just, you know, made a trip wherever we need to be for the onsite, for the incident response, if they're getting the respect, the one thing that happens with them is that they start taking ownership. And I feel out of all the things that we do, ownership is the one that generates magic. When people feel that, hey, they're part, they're a very, very important part of the puzzle and their role counts, they start doing extraordinary things. Like you would have a problem and there will be 5 people raising hands for a solution. So, that is what happens when you give people respect. And when people actually feel it, I feel once you get those 2 principles of expedition behavior down, the rest follows. And then you start producing results that you don't think you're even capable of. And I've seen that many times in my 17 years. We go in there, we feel that, oh, it's going to take X amount of weeks. But when people start coming together and people really practice teamwork and understand each other's strengths, That's when something happens that I call it, you know, we become invincible as an incident response team, and that's the magic.

I love that answer, and I think it's so wonderful to be able to apply these things when it counts the most. But most of the time, hopefully, we're not engaged in incident response. And so, are there ways for teams to practice this kind of mindset outside of the worst of times? What about during the best of times?

Great question. I think the concept of shared destiny Like, even when the times are not tense. I think that's really, really important because, you know, if you've been in security and compliance, you might follow the principles where, okay, you got to take care of your critical vulnerabilities, you got to take care of your high vulnerabilities, but what about the mediums and the lows, right? And then, if you're a good pentester, you might say, oh, I can combine 2 or 3 low vulnerabilities and make a very, very high impact. And that's what happens—

Right.

That's why we say compliance doesn't equal security, right? So I think when you basically combine the strengths of, you know, everybody that may not be a master at something, but they're coming together for a shared goal, and when you practice a number of times for a goal— and we say it a lot in security that you must do tabletop exercises.

Mm-hmm.

And those tabletop exercises are, you know, getting real and real because we're asking, like, people, hey, what about these firewall logs? We want you to actually go get it rather than saying, oh yeah, we need firewall logs, we're going to get it in 20 minutes. We want you to demonstrate how you get it. So in unreal circumstances, not the real ones, you still have the capability or ability to go do that as well as you would in a real exercise. So again, when you give a shared goal, you have to put that time crunch because if tabletop exercises don't have those time crunches, then it's pretty lax. But I think you got to make it as real as possible and then those results come.

The question then becomes of how do I get to that? Like, I guess you can always send everybody for an expedition to where Robin was, Kamchatka. Kamchatka sounds like it would be pretty extreme. So, what are other ways that are a little shorter? I don't know if easier is the right way because I don't think you can learn it in an easy way. But so, in any case, how do you learn that if you can't send everybody to Kamchatka?

So, one of the things that I like to do is just introduce the idea, just like we did right here. We said, you know, let's talk about leadership and followership and let's talk about what this means. You know, when I actually went to Kamchatka, I was there to canoe a couple hundred miles of a river. And on the very first day, of that canoe trip with people, you know, most of whom we'd known for 24 hours, we had a canoe flip over and get stuck in a strainer. And we hadn't practiced any recovery skills together. We hadn't practiced any emergency skills together. But all of us came together as a team. We made sure to keep ourselves safe so that we didn't make the situation worse. We came over together and we communicated with one another about, all right, you're going to do this, you're going to do this, we're going to get the people out of there. And we did and everything was fine. But we had to do that in a very short timeframe. Because we were using these principles. The very first principle was you've got to depend on one another. And you know, at some point, it might be you that's in a boat that needs rescuing. So, you know, the first thing you do is you think, I'm sitting here next to Tim. I know that I have to depend on Tim, and Tim knows that he has to depend on me. And that's our very first principle. We can talk about that without having anybody have to go to Kamchatka, even though it's a A really fun trip and I wish I could do it again someday.

No, I'm not sure I'm buying it, but okay.

Anton, aren't you from near there?

It's very, very far east of Russia.

4,000, 5,000 miles, but yes, it is kind of close by.

Just next door.

Just next door.

Yeah.

But just introducing these and saying, hey, we're going to operate our team in this way, right? Then, the first thing is to introduce the principles. The second thing to do is if people miss, and they will, if people make mistakes, they will, talk about it and say, hey, this thing happened. Let's use that first principle of expeditionary behavior, which is communication, to talk about how this was a miss and talk about how we're going to do it next time. Understand that this conversation isn't punishment. It isn't someone getting kicked out. It's us strengthening our bonds as a team because we've got to depend on each other.

Wait, wait, 4,000 kilometers, not miles. I checked the distances, 4,000 kilometers. So, it is kind of next door by standards.

Yeah, by like Far East standards, that sounds about next door. How have you seen this happen on like an underperforming team or people that are not gelling? How do we fix a broken team with this? Can we?

Yeah. So, this is actually one of my favorites because one of the things that happens on an underperforming team, that's maybe one of the first places you see people start to look to each other of, this isn't working because it's your fault. This isn't working because you didn't do this. And that kind of thing can cause these schisms in the team that can just make things worse.

Mm-hmm.

Now, if you think about expedition behavior, you think, you know what, sometimes someone's going to do something wrong and that's okay. We're still a team. We still have to depend on each other. And talking about things that way, talking about, hey, this person did something wrong, you know what, They did. That's true. And we're still a team. And we're still going to work together. And we're still going to come together in the way that Jibran described until, you know, to become invincible. But to get there, what we need to do is understand that it's okay for people to make mistakes. And when they do, because it will happen, we're still going to come together and practice these skills with each other and not blame one another.

Yeah. Now, that one thing in incident response, like, especially in the recovery, what happens is a lot of people are trying to be very helpful. And one thing that gets overstated are the timelines. Like, for example, if the whole healthcare system depends on your work, you know, sometimes you might want to say, you know, we'll try to get that up in a week. And then you get to that week and you're like, you know what, these backups that I thought would be restored, On time, they're not really working. So, you know, there's a lot of blame that goes in that. So just like Robin said, when you trust the intentions, when you understand that, hey, you're all trying to do your best to get to a goal, and then somebody else is going to make that same mistake, not because they intend to make a mistake, it's just because they're trying to lift, keep their spirits up. They're trying to do the best. At least they're setting the goals, aggressive goals. So even if you miss that week, Maybe it's 3 days later. So, rather than saying, oh, yeah, it's gonna take 6 weeks, and do whatever. So, I think understanding that everybody's trying to do their best, that really helps.

I love that answer. I think that's a great answer. I love both of those answers. And I love this whole conversation, but I have to do my least favorite part of being a podcast host, which is ask our traditional closing questions. One, do you have a single tip you can recommend to help teams be happier and more productive with this mindset? And 2, do you have recommended reading to help people really embrace this and learn more?

I would say the single tip that I would offer people is learn what followership means. That's so unusual. It's outside of our paradigm. And supporting others in the leadership position can make a world of difference. That's my one single tip. And the book that I want to recommend that I love is not a book about expedition behavior. It's actually a book about negotiation. It doesn't make it clear, but if you study this, you'll see this book actually brings to life many expedition behavior techniques without saying it out loud.

Huh.

That's a book by a University of Pennsylvania professor named Stuart Diamond, and the book is called Getting More. Stuart Diamond is a negotiation professor, and this is his book about negotiation. It really— the techniques that he describes really do embody expedition behavior.

I love that answer. Jibran?

Yeah, I have a book recommendation too. It's a book called Who Moved My Cheese? by Spencer Johnson. And it's about change, adapting to change, and also letting go of fear. You know, in my line of work, there's a lot of fear, fear of like the kind of people that you're going to meet. Fear of the kind of new technologies that you're gonna have to learn on the go. So I think when you adopt the change and let go of the fear, that is when you open up. That is when you come out of the cage and you start leading in the followership aspect that Robin mentioned. So yeah, that book is very relevant for this, even though it's not about exploration behavior, but those topics in there are pretty good.

Well, Jibran, Robin, thank you so much for joining us today. I've never been this close to something that was in outer space. And really, this is like, what a fascinating way of thinking and approaching the problems that we're all tackling in our industry. Thank you.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chevaikyan and _TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.

Security.