Cybersecurity Insights - Deficient Forethought for Digital Technology Risks with Alexander Stein

Welcome to Cybersecurity Insights, and today let's talk about the risks we all ignore in the technology that we all desire. Because technology, well, it's mesmerizing, right? In this digital age, it captures our attention, it embraces us, and we're just woven into it. The latest smartphones, autonomous driving vehicles, Artificial intelligence assistants, virtual and augmented reality, they're all growing. This immersive social media platforms, and you know, the list goes on. Every day there's a new innovation and we're lured by these things and it's emerging at such a rate and it's so tantalizing, these technologies. It holds the promise of connecting and enriching our lives. But there is a potential dark side. For every great innovative benefit, there are accompanying risks, and often those risks are ignored to the detriment of us, the users. But why have we not learned to be more careful and proactive? We've all gotten burned in some way, shape, or form. So today We're gonna be talking with Dr. Alexander Stein. And Alexander holds a PhD and is an expert in human decision-making and behavior. He founded the Dolis Advisors, a psychodynamic management consultancy that advises CEOs, executive teams, and boards in organizational matters with complex psychological underpinnings. And in addition to all of this, his advisory works, you know, in the leadership and culture space, ethical governance, fraud, and abuses of power. He's also engaged to address human factor vulnerabilities in cybersecurity and mitigate unintended consequences in technology that assumes decision-making functions in human affairs. So welcome. Great again to talk with you.

Great to see you again, Matthew. I'm really glad to be here.

And you and I have had conversations many times before, you know, interweaving how people and our decisions and our mental frameworks can be wonderful, but can also get us into a lot of trouble when it comes to technology. So, you know, what has driven you to go into this field? Because, you know, in the conversations we've had before, you have a unique perspective. Why are you in this space and what drives you in here?

So, my PhD is in psychoanalysis. I actually have a background as a clinician in private practice before I founded my consultancy. And so, my work centers on people and my depth of expertise is in why people do or don't do certain things, you know, the obstacles that they throw up or that we throw up and how we continually and repeatedly make the same mistakes over and over again and what can we do about that. And at one point, I decided to pivot out of private clinical practice and start working in the larger business space. And so my— the core of my advisory work is with CEOs and boards and people at the top of an organization, those who hold— the power, influence, and responsibility for an organizational ecosystem. And over time, that has expanded to involve other sort of more focused practice areas in cybersecurity, in technology, particularly technology that has begun to assume autonomous decision-making functions as surrogates for people, as well as in risk, ethics, and bad behavior, shall we say, like malfeasance, fraud, and abuses of power. So for me, it's enormously important to be able to have an impact on a large scale in organizations, possibly even if it's not speaking too grandly, on society, because there is nothing more important, and really nothing more central, to everything that we do, or anything that we do, than people. And it does seem to be this central element that is again and again relegated to the dustbin, or at least to the side. And that's a problem in itself that I hope that we'll talk about. Why does that happen, and what can we do about it? And how important is it actually for people to bring to bear a reckoning with the significance of the human element, and not just to talk about it, or not have a conference that talks about the human factor, or to have people as a part of process, but really to bring expertise in the human dimension as a part of the bench in a multidisciplinary team.

So, you started with people and the decisions we make. And as, you know, the technology revolution expands and we abdicate a lot of our decisions to technology and these machines, you're now moving to those organizations and those leaders who are creating that technology or implementing it or using it because, well, just because we can develop technology doesn't really mean we should. Right? There exists potential ramifications when technology we trust and rely upon is misused or abused. So the first question I have for you is, what are those systemic mistakes, those long-term embedded mistakes that we're making as part of the development of new technologies?

Well, of course, my answer is non-technological in a sense. I look at this as technology issues are really human issues that involve technology. And so the reply that I have to that question from my professional vantage point is that we, first of all, we seem to have this fantasy that outsourcing certain aspects of what we can do to a tool is a good idea. To me, that's kind of a misuse as a general proposition of a tool. A tool should be able to assist us, and if there are certain things that the tool can do on our behalf or to make our lives easier, that's all well and good. But there are certain aspects of the technology, if we look narrowly for a moment at technology as a tool, that we are are attempting to get it to do things for us that we really need to be able to do for ourselves. There may be efficiencies from a business perspective to computational velocity and scale that's beyond what our brains can do. But there are decisions that we have technology looking to do that are really beyond what the tool can do. And so we're a bit over our skis, but nonetheless we're absolutely enamored with, you know, what we've done so far. And as generally looking at the marketplace where there's so much money being invested, so much money to be made, companies are reluctant to start to pull back a little bit until we can understand what actually are the unintended consequences. What are some of the things that we can do? To mitigate some of these risks or to protect ourselves from our own decision-making.

So it sounds like, I mean, we see this with the, especially the economics of it, right? Whether it be efficiency gains or simply new revenue, new technology and innovation is bringing in tremendous amounts of money, which is motivating companies to throw everything out there as fast as possible. And try and do anything. Um, but there is risk, right? I mean, cybersecurity is really about all those unintended consequences and misuses of technology. And the faster it floods out there, and it's being pushed by companies, but it's also being pulled by the consumers, right? We want all those new technologies and whatnot. And if we go back to the axiom in cybersecurity, right, security isn't relevant until it fails and then it becomes relevant is the concept of giving up that decision control that you were talking about, is that concept of trust in this technology. And maybe it's safety, maybe it's privacy, maybe it's security. Are those things that we're just not grasping, that, that we're looking at the, the, the pretty paint and we're not, we're not seeing the deeper problem until it, it bites us in the backside? I mean, what's— is, is that happening? And if so, why haven't we woken up? Because a lot of people have been bitten.

Yeah. Well, why haven't people woken up notwithstanding having been bitten is, is a, it's a whole sort of rat's nest of issues. Let's come to that in a moment. Um, to, to go backwards a little bit to, to where you began, um, there is this tendency to— it's a bias, I guess, of sorts, kind of the presumption that things will work out and to deny or push back some of the potentialities that could go south. So you mentioned something a few minutes ago that's an absolute inescapable truth, that there are uses and abuses. So immediately, I think we can start looking at risks in those categories, right, so that they're inevitably, no matter what you make, technologically or otherwise, it is bound to be abused, right? That's just part of the malevolent creativity of people who are bent on doing something that is antisocial or asocial or illegitimate or for their own gain and destructive to corporations and society. And there's nothing that's going to be done about that. That is an intrinsic element of the human condition. So, you know, if we're making things that absolutely inevitably, predictably, statistically will be abused, why are we not constructing systems to better protect that? And why do we think that people will just blindly trust in something even though they know that eventually it's gonna be abused? And, you know, to what extent will people just follow along with being placated by PR statements about mistakes were made, or we're working on it, or we're going to patch it, or it's going to be fine, or don't worry about it. And eventually bad things will happen. And I would say if you spend any time on the Internet or reading the news, that moment has actually already passed, and we're already in a period of enormous social disruption a lot of which is driven by, if not exacerbated by, technological problems. And of course, going back to my starting point of, you know, that these are actually human issues that use technology, the technology itself is not the problem. It's not like we've built an atom bomb that's exploding and now we have fallout from it. There's an internal misuse a structural misuse. And so in this respect, if I can just add a little bit more to this long paragraph, the Venn diagram is that now we have an overlap. It's not just malicious actors and negligent insiders. They're actually starting to blend together because we have decision makers, very powerful authority figures in the technology space and not only. Who are making decisions which other people are supporting and investing in and furthering that are harmful to society and to people. It's benefiting few, but even those people who are benefiting are in for a shock at some point.

Is it just that we're gullible? That's the first thing that comes to mind, that You know, in our generation, we've seen this transformation of digital technology come in and incredible new ways of communicating and engaging and doing business and work, remote work. And, you know, interview 10 years ago, 5 years ago, you and I wouldn't be having this conversation on the internet, right? It would be face-to-face in a room somewhere. It is tremendous benefits. And are we just blinded by this shiny goodness and we're willing to, accept that there could be some bad things in the closet way over there, but I'm so focused, I'm so gullible because I'm not used to this environment. I'm not, I don't have my sea legs yet to understand there is balance, there is give and take, and I need to think ahead a little bit. Is that the problem that individuals and society as a whole has right now with this digital revolution?

Well, one of the issues that we're going to encounter as we progress in this conversation and beyond is that you can't really speak about, "Is this the problem?" or "Is that the problem?" It's a cluster, a constellation of problems. And the failure to grasp the complexity of the situation is part of the problem, right? So one of the issues at play is not merely that we have a tendency to be gullible or that we're susceptible to the lure of some potential and then we have a bias against the adverse consequences in potential. But that we do have this tendency to oversimplify and to minimize a real grasp of the complexity of the issues at hand. And it's going to play out. One of the best ways that I often use to describe the seemingly invisible force of the human dimension on this, of decision-making on this, is the example of the Tacoma Narrows Bridge. Are you familiar with that? So there's a very famous— Tacoma Narrows?

Oh, the Tacoma Narrows Bridge, yes, the one that collapsed. There's a great video out there. Please go Google this. There's a tremendous video, um, uh, that talks about this cataclysmic failure.

Correct. Well, spoiler alert.

Sorry, sorry.

Um, so, but, but the thing that, that's really deeply compelling from my perspective as a specialist in, in people with regard to this is that, you know, it was in the early days of long-span suspension bridge engineering, and it was a magnificent achievement what they did. But the single thing that they failed to take account of was the wind. And so, you know, when you Google this and you see the incredible video, you know, the platform starts to torque, and as the oscillations increase, the bridge collapses. And the autopsy on that event was that it was the forces of the wind and that the bridge structure had been too rigid. In a sense, you could say it was too well built. And so the lessons learned in terms of bridge engineering was to put in the spans that enable things to move and to have towers that could sway so that it could accommodate the forces of the wind. And this is one of the missing elements in terms of the underpinning psychology of technological design and implementation, that there is this force, which no one really takes strong account of in depth because it's intangible. And it's this intangible risk that is the thing that's going to bring the bridge down.

So we've seen impacts before, and, and to use the analogy of the Tacoma Bridge, if that video, right, if history changed a little bit and that, that bridge torqued and never collapsed, I bet people would have still gone back and forth on it, right, until something calamitous did eventually happen.

Correct.

And I see in our environment, right, we're seeing healthcare breaches, we're seeing all sorts of data breaches and ransomware and hacks and, you know, attacks and critical infrastructure go down. We're seeing some of the damage, but is it just not cataclysmic enough? Is it gonna take life safety issues? Is it going to take autonomous, you know, uh, uh, cars getting hacked and having them, you know, an attacker run somebody into oncoming traffic and, you know, killing 1,000 people over a weekend or something, something dramatic to wake people up and force them to take a step back and go, wait a second, right? Let me review this. As shiny as that new little object is you know, there's some other considerations here. Is that what it's going to take, do you think?

I certainly hope not, but your dire forecast is a distinct possibility, which is really sad, I think, and it would be great if things could be done to change the course of that, right? So this is the work that I do, this is the work that you do, this is the work that a lot of people do, whether they're CISOs in an organization or they're they're working for a technology company. It's not just speaking truth to power. It's really trying to shine a bright light on some of the adverse potential consequences and to be able to get people in decision-making positions to pay enough attention to and to give credence to that as a potential outcome to do something about it. And that does seem to be enormously difficult. And it, it is a pattern. Throughout much of Western society that, you know, what you just described, that kind of trajectory of like repeated yellow warning signs and then red warning signs. And we see it with climate change, we see it in some of the geopolitics at play, we see it in, you know, what's happening with Facebook/Meta or whatever they're going to call themselves next time there's a scandal. Or, you know, that there are just so many instances in which we see what's happening and yet fail to take appropriate countermeasures. And there are opportunities to intervene, whether it's, you know, recognizing the signals of imminent malicious or lawless action from a threat actor, or the potential adverse consequences of unintended misuses or abuses of technology to do something about that. And the fact that we don't is a problem that transcends all of the other problems.

It exacerbates it. I mean, you know, my world is risk management, right, in the cyberspace. And even if you're perfectly capable of coming up with a risk assessment, it means nothing if nobody's listening, if nobody acts on it.

Correct.

And it's like boiling the frog sometimes, right? I mean, you raise the heat slower and slower and the frog doesn't jump. It's, you know, so doing the right, having the right information in regards to risks, but also I guess being able to communicate it in tangible, meaningful ways. And you had mentioned a really important word there, opportunity. So, in the organizations with those CEOs and companies that you work with, what is that opportunity? Because we've talked about trust, we've talked about misuse of technology, we talked about, you know, poor custodians of that kind of service or things that could be a detriment to their downstream customers or partners or vendors, suppliers, right? Everybody's connected. What are those opportunities? How are you explaining that? To get attention.

Crises have life cycles, right? There's before, during, and after. And as a general proposition, you know, talking about what are we going to do, what's the catastrophe that has to occur, there is this general pattern in which attention isn't paid until something has already happened. People talk about risk management. People talk about mitigating risks and minimizing unintended consequences. But what we see, the evidence, the body of evidence in fact, is that it's lip service actually. And that as a general proposition, change doesn't happen until something bad has happened to catalyze the imperative for change, rather than proactive, preemptive, measures to avoid catastrophe. So again, we come back to the issue of complexity. One of the elements of risk that doesn't get talked about enough or deeply enough or with sufficient sophistication is human risk. So you can have a perfectly architected blueprint for risk management from a, you know, from an IT perspective or from an AML perspective or, you know, whatever it is, and everyone will say, well, you know, the threat actor or the person or the negligent insider, you know, the problem is with people, but there's a design that attempts to quarantine and simplify the, variables and the intangibles of that risk. And so the problem of oversimplification is non-trivial. The presence of general psychological illiteracy is non-trivial, right, in which there's a short shrift given to the astronomical complexity and the massive forcefulness of these intangible elements, right, in which the delta between blueprint and reality when it comes to human behavior is vast, right? So you can have this perfectly designed system where everyone is in agreement, everyone has buy-in, there's complete alignment, this is going to work, you know. The attack surface is as close to zero as it could possibly be. But guess what's gonna happen? It's not. And the reason why is because the blind spot is right in front of you. And in fact, it could be the person who's making the final decision.

So you and I have talked about this, and I want you to explain this to the audience, what the Dunning-Kruger effect is and how often you encounter it. Now, I encounter it quite often, surprisingly often when I'm dealing with executives or boards or so forth, or professionals in the security field, even. Can you explain a little bit? Because I think it dovetails into what you're talking about here.

Well, Dunning and Kruger were two PhD research psychologists who created a study, the results of which are known as the Dunning-Kruger effect, which essentially established a framework for recognizing and then measuring the ways in which people overestimate their capacities. So that you can essentially be on some point of the scale of incompetence and view yourself at the other end of the spectrum of enormous competence. So that's an example of the Dunning-Kruger effect. It plays out all over the place, you know, and it's certainly a problem, you know, when you have people in positions of authority who presume that they know things that they do not and don't have the confidence to admit their limitations of knowledge or skill or to bring in other people who can complement But in a sense, that's also different from people who are just willfully blind or even indifferent. So again, not to be the cold wet blanket guest here, we have multiple arrays of multiple problematic elements at play at once. And this is one of the reasons why it's hard to take ground, like getting people to listen. Getting people to give credence to some of these issues which are hard to talk about. I mean, we can tell stories or I can analogize the force of unconscious decision-making to the wind on a bridge, and people are going to be like, "Okay, fine. Why is this guy even here?" So I won't get engaged, or I'll leave, or they won't pay attention to what I have to say. And then their bridge collapses and they're like, "Well, what happened?" "Call in the engineers." And it's like, "No, you didn't hear me the first time." And so that's not entirely Dunning-Kruger. That's also an indifference and a disregard to what's actually happening. In some respects, there's this willful defiance at play in which the fact of the human element as central to all of this is the last thing that people actually want to confront and deal with. And it's one of the reasons, I think, this is purely speculative from my perspective, it's one of the things that drives the desire for technology to outsource some of the capacities that we should be able to do for ourselves. In other words, there's this way in which we're actually developing tools to do things for us because the last thing we want to do is do them.

Yeah, it makes sense. I've seen Dunning-Kruger effect so often and sadly to say, a lot of times it's around ego, to be perfectly honest. I've seen brilliant engineers and maybe they're brilliant at electrical engineering or silicon, manufacturing or whatever, or even brilliant executives from HR, marketing sometimes, so on and so forth, be thrown into a role of owning cybersecurity. And in their mind, they know they're a brilliant Silicon architect, right? I mean, papers and they're world-class. And the next day they get a title that has security in it and they still think, I'm world-class, I'm super smart, I've got this. And they don't realize it's apples and oranges. And yet they go in with the confidence, this isn't that complex, I'll pick it up in 20 seconds. And they truly don't know. And then they tend to surround themselves with other people, right? And now you have this, this multiplicative effect and these massive decisions and viewpoints that are so far from reality, right? You know, no, we engineered this perfectly. It can't be hacked. No, you're going to be surprised here real soon. And they are. And then they're shocked, right? Well, how did it get hacked? Because you engineered it to operate, to perform. You never engineered it understanding there was going to be an intelligent attacker, maybe even an insider that was going to undermine it, right? Little things. I've seen HR executives be put in charge of security? And no clue, no clue, right? And yet, but they believe, and they truly believe that, "Oh no, I've got this. I'm making the right decision. I understand this." And it's challenging. And how do you get, you know, that type of group who thinks, "Oh, I figured this out. Oh, the bridge isn't gonna fall. You know, I know I'm an HR person, got put in charge of engineering and building this bridge, but it's fine." "Right, it's just a bridge. I played with Legos before. It's fine." Right? And there's nothing you're going to say to them short of showing a bridge just like it that's fallen down, right, to convince them. Because again, we can use analogies. We can show, you know, videos of other things. But if you truly believe it, that you're right and that you understand it and you're right, that's a really big rock to push.

Yeah. No, it definitely is. And you're describing in some regards both a typical and an atypically radical situation where someone is so mismatched in terms of role and task and ability, and it's a disaster waiting to happen. But of course, when that happens or should that happen, implicitly it suggests that the organizational structure that created that is blind to those risks, and that if it weren't that issue, it will be another issue. So—

Good point, yeah. It's systemic. You're describing a systemic issue. Not only is it that group that's making the decision, it's the people that put that group in charge, right? It keeps going layers and layers and layers.

Right. So, you know, you asked, so what can be done about that? One of the front-end problems is scaling expectations. It may sound grandiose. I would love to be able to have the power somehow, or the platform, or the influence to be able to get these kinds of messages across in such a broad way that people would at least pay more attention and do something, be engaged with trying to do something, because these are actually deeply complicated long-range problems. There's no binary fix. It's not a toggle switch. The other is to, once inside, be able to start touching more of the organization, because rarely, to the point that I was just making, is it isolated. Organizations are complex ecosystems of functions and individuals, and being able to get the board and the senior management team and the business line leaders and all of the people who are in positions of decision-making authority and influence to at least gather together and talk together about what they think is going on or where they think security issues lie or what they think is already secure and safe.. And to be able to see all of the crevices that actually exist where they think they're aligned, and to come to understand that they're going to need to work in tandem. To use a musical analogy, this is like polyphony, right? It's chordal. It's not a single string of notes. And that to orchestrate that kind of security architecture goes way beyond the security function, and it's not technological, it's cultural, it's institutional, it has to do with leadership, and that too is massively complex on a human and behavioral and decision-making level. It's not just tone from the top. Sure, it matters, but, you know, it's also then what happens in your subcultures, and what happens if your leader is depressed or anxious or risk-averse, and the person next to him or her is anxious and depressed and risk-averse. And the person next to that person is, you know, filled with hubris as a way of overcoming something else or as a consequence or counterfactual to something else, which he or she is too ashamed to admit, but, you know, and is like battling addiction and driven to do anything possible to prove that they're fine by doing well at work. In the meantime, they're tying their shoelaces together and sticking their fingers in their eyeballs. And so all of these things are playing out. And it sounds like a ridiculous kind of South American soap opera or psychodrama, but it's real life, right? That you have people who are making decisions who are living who they are, and they're implementing and doing certain things within their capacities and within their skill sets, but they are not exempt from or immune from all kinds of other things that are those sort of intangible forces that are influencing what they think is noticeable or what they think should be dealt with. There are lots of things that get normalized that shouldn't be. There are issues going back to what will it take? Does it have to be a catastrophe? So what we see is that if you're looking at something from the outside and you have a perspective, that informs what a risk ought to be or what a danger might look like. And the people on the inside are looking at exactly the same thing, and from their perspective, all is well. It's exactly as it should be. Nothing is wrong. It will be very difficult to create a change there until something, you know, until they step on that rake in the grass and get smacked in the face, and even then, they're probably going to misdiagnose why it happened. They'll just say, oh, this is what happened. Make sure that, that rake is moved so I don't step on it again.

So to make good decisions, um, and you talked about tone from the top, leader— getting leadership to understand and make the decisions and then propagate it down in a way where at least you have alignment. You're always going to have some of the individual issues and social issues and and infighting and so forth. But at least if you have a common goal and it's not just lip service, but it's actually, yes, this is important and why, that makes a huge difference. And, you know, I have a strategy that I apply that I want to run by you, and I want you to tell me, yes, I'm doing something good, or no, what the heck are you thinking? Why are you doing that? So when I talk with, with CISOs and C-suites and boards and so forth, Obviously, I'm talking in their language. So if I'm talking to the board, I'm talking about profitability, I'm talking about corporate goals. But when it comes to cybersecurity, there is a narrative of risk. These bad things can happen. I also try and balance that with here's the opportunities. And it's actually becoming easier now because as that trust, right, expectations of privacy or security or uptime or so on and so forth, are becoming more critical to consumers, right, their customers, it becomes a purchase criteria. So security can also be woven, and that's kind of what I do in many cases, as part of that opportunity. So I can go in and say, hey, you've got security risks that could bring your, you know, your service down for 3 days. "Right, you've got some big risks." And they may go, "Ah, yeah, but it might not happen. It hasn't happened yet," right? And they're not convinced. However, if I shift the narrative just a little bit and say, "You and your competitors have this type of vulnerability. It's very common. And, you know, when attackers take advantage of it, your competitor could go down for 3 days. You have an opportunity there." Right? If you fix that, you're gonna stay up while your competitors are down. How much is that worth to you? Oh, hey, I— that's a benefit, right? Or you can upsell your product because your competitors keep going down, and if you bolster your security, you can market that, right? You can get a larger market share. Market share? I like those terms, right? Those are terms I know. I— And so, in framing things about the opportunity and how it supports the business goals, right? We're going to help you get your products out the door faster. We're going to help reduce all those support calls that you're getting, all those kinds of things. Dollar sign, reputation, brand, all these good things that can happen. I tend to get a lot more attention support, and what I'm recommending tends to be implemented with much more vigor for organizations where they see the opportunity versus that, uh, it might or it might not kind of happen, right? We'll deal with it later on, you know, that kind of mentality. Do you think that's a good strategy that we should be balancing those? Bad things are coming versus you could support your entire business goals, opportunities and risks. What do you think?

Yeah, I mean, I could simply say yes, it's a good idea and it makes sense. You used the word upsell and that's what I was thinking as you were talking, right? That you're kind of burying the medicine in the mashed potatoes and you're getting everyone to do like, recognize and consume the positive elements and focus less on some of the other things that they are going to be allergic to or want to push back. And in terms of looking at what are your goals, if you are going to stagger your aspirations with an organization, that makes perfect sense. If you don't get to do anything because you lead with everything, or you lead with all the things that make people antsy, you're not going to get it.

The fear! The fear!

Right. Your strategy is very, very workable. Semicolon, from a sort of a larger kind of ethical social perspective, it's basically saying bad things are happening to your competitor, and to their customers, let's take advantage of that. So there is something about that that is a part of the capitalist ecosystem which is all well and good. And I would like to be able to see on a macro level organizations looking at root cause issues, not just local opportunities and risks. Because ultimately if you have 2 different or 3 different organizations that are operating in essentially the same space, eventually all of you are going to get hit with something, right? So it's not anti-competitive to be cooperative in certain—

Or to service the customer, to protect their data, to do the right things, right? That's ethical in itself, to be able to provide security, privacy, and safety.

And especially as the stakes rise, you know, you mentioned earlier about, you know, the escalating exponentially expanding level of risks. For example, of like, you know, if a computer failed, you lose your data or your connection gets disrupted or whatever. If your Tesla gets hacked, people could die, right? And, you know, it goes on and on and on. Like, you know, elections can be interfered with. There are many, many things that happen on a much larger and more radical scale as technology becomes more embedded in society and we are more reliant on algorithms to make decisions for us, and so on and so on. The concentric circles are continually expanding. And so to only look at organizational issues locally is to, again, implement this kind of denial and disregard to the broader impact that can occur. And so you asked about your strategy. I can't disagree with it. In terms of, you know, selling services or trying to make sure that, you know, certain things are done, you need to get to the low-hanging fruit first, definitely. That being said, I'm especially focused on root causes so that we can actually get to more systemic solutions. And I would like to be able to synthesize those. Often when I have the opportunity in an organization, I start at the margins, you know, and don't look at, you know, where is the gaping wound. I look at the structures that are sturdy and working well and try and build inward so that, you know, it's my version of what you're talking about. Because if, you know, if you lead with the most drastic thing, people are going to freak out and they're going to run away. And that's, you know, that's just the way it is. So you have to use some kind of lure, sugarcoat it or something.

Medicine in the mashed potatoes, I like that. Okay, so my last question then to you, and let's bring it down to a practical level for the people watching and listening to us today. How do we, right? It's not just that CISO, it's not just a world leader, right? I mean, how do we help change or adapt to improve that macro societal situation that we're talking about here?

Self-awareness, responsibility, investment. Be like, really be a stakeholder in the Commonwealth, right? Not just an investor in a stock or a company or be a worker. Like, understand that we're all connected. And that we are all in relationships to one another and to our work. And I don't mean just our professional work. I mean that if you're in the software development lifecycle somewhere, or you're a part of developing an emerging technology, you cannot with good conscience just collect your paycheck and ignore the fact that what you're doing may cause harm, right? People do, but then the distinction between a malicious threat actor and a negligent insider is hard to distinguish because there you have people who are misbehaving and justifying it or ignoring the potential impact and the risks. So I think that it's very important for everyone who's involved in cybersecurity or technology development to look around, like be wide-eyed and attentive to the issues. And we can see what happened to Timnit Gebru, and even people who seem impenetrable or invulnerable will be fired, right? It's very, very difficult to confront the industrial technology complex and speak truth to power and think that you can just walk away. You know, you're gonna get bruised and bloodied. You might even get taken down. But what are the consequences if you don't? And, you know, I think everyone has an obligation to him and herself and to our children and to the Commonwealth to really look squarely at some of the things that we are allowing to happen. The structures have been created whereby we are allowing ourselves to be disenfranchised. If there is something that you want to participate in, if you don't click "I agree" to the terms of service, even if you have read it and you understand that you're abdicating some fundamental right to privacy, chances are high that you're still going to do it. And what do we do about that? And, you know, there's no simple answer. I wish that I could answer the question as we conclude the podcast by saying, "And here's what you do." You know, obviously, obviously one thing you can do is to choose not to click yes. But to the extent that that is enormously difficult. You know, once someone is in motion to get something that they want, getting them to retract that is pretty close to impossible, right? So that means that the systemic cause of the outcome of that needs to be adjusted somehow, right? That the whole industrial complex has to alter its frame in some way that does not curtail shareholder value, you know, does not impede capitalist incentives and motivations, but is more socially responsible.

Well, along those lines, maybe we use that, that those capitalist motivations and those financial incentives, because each one of us is a consumer and we have a choice, um, you know, in what products and services we buy, uh, what social platforms we use and things of that sort, is the, uh, a powerful capability that each one of us holds. Should we be looking at the ethics, the security, the safety of those products and services and truly using that as one of the purchase criteria and say, hey, there's, there's 3 different products here. These two, the companies aren't so good at keeping data secure. They don't seem very ethical in the practices that they're working at. I think I'm gonna go with the third option, right? And in doing so, creating those financial incentives for the entire industry to say, hey, yes, security, privacy, and safety, cyber ethics, these are important, and we're gonna lose business If we don't step up, is that our contribution as individual consumers? Is that powerful at an individual and scale?

I would certainly agree with you that it is and that one of the ways to further that would be to utilize more forceful mechanisms than just the consumer. Money talks and if consumers decide to go to A and not B for various reasons, right, A will make institutional adjustments to try to get those consumers back. But again, that's its own version of needing a catastrophe of some sort to catalyze change. So, but what— where I go with what you just said is adding a T to ESG. Which is to say let's create an initiative in which technological ethics are given a seat at the table that is institutionally and socially incentivized to a point of implemented elevation, right? That it's not just left to the consumer to make those decisions, but where corporations understand that they're expected to have a responsibility that's upheld.

That may be a tall order. I like where you're going, but that may be a tall order to put ethics completely in front of profits and profitability.

That's, uh, no, no, don't, don't, don't misunderstand. I mean, okay, okay, even if you, even if you look at ESG, no one is subordinate profits. It's actually, let's elevate some of those other considerations and understand as part of the value proposition, how do you calculate maximizing profit without it being to the detriment or being indifferent to those other considerations.

Makes sense, makes sense. All right, thank you very much. And, you know, as I'm thinking about this, I think we all have to proactively understand those accompanying risks that technology and innovation brings and, and purposely take a step forward to understand what some of those ramifications are and to be accountable. We each play a role individually with our family, with our community, country, society, mankind, and some of these risks are getting to a level that we don't want the catastrophe. And we can all play a role. So let's definitely embrace the wonderful aspects of technology, but we have to do so in a responsible manner with forethought. So thank you for speaking today and sharing your insights. It's always a pleasure. And thanks to our audience, uh, be sure to hit subscribe, hit the like button, and share, comment, give your thoughts, experiences. Would love to hear from you. Thank you much.

Thank you.

Thanks for watching. If you like these cybersecurity videos, please click the like button, leave a comment, and subscribe to the Cybersecurity Insights channel. I put out a video about every week on various cybersecurity topics, risks, ideas, events, and best practices. Let's continue to communicate and collaborate together. That's how we make cybersecurity strong in protecting the global digital ecosystem.