Increase the Effectiveness of Security Awareness Training by Making It Personal

Good afternoon and welcome to Increase the Effectiveness of Security Awareness Training by Making It Personal. I am Robert Siciliano and this is ProtectNow. And thank you so much for being here. We've got a bunch of you on today. So some of you are security awareness managers. Your job is to make sure that your employees, coworkers, company officers, all those that you are responsible for in some way are up to speed, up to par in regards to all things security awareness. Links they click, how they react to requests over the phone, via text messages, somebody knocking on the door, how they react when a bad guy, social engineer, tries to convince them to cough up personal information, passwords, whatever the case might be, give them access. Okay. And for you, it's like herding cats, right? It's very difficult to corral them, to get them all on the same page, to get them all to agree as to how things should be. And really what you want them to do is to know what you know, to look at the world in regards to security the way you see it. Okay. To understand and recognize risk and manage risk effectively. Okay, you might be a CIO, CTO, CISO, and really you just want everybody to effectively manage passwords, not click links they shouldn't be clicking links, not bypass the security you have in place. And so many of you engage in check the box, check the box compliance training. Check the box compliance training is phishing simulation training. Training. And while phishing simulation training is necessary and it is effective when it comes to preventing phishing in most cases, there's still a lot of your employees that are clicking those links. There's still a lot of your employees that bypass the security protocols you have, and you can't always control them when they're on their own devices at home accessing the company network via a VPN. And so on. So ideally what you want them to do is to get it. And time and time again, after talking to security awareness managers, VPs of security, CIOs, CISOs, and so forth, I'm hearing over and over and over again, Robert, we just want them to care. We just want them to care. That's it. Make them care. And you know what? It's not that difficult to do. So in the short time we have together, I'm going to show you a little bit about what I do to make them care. Fundamentally, what I do is I make it personal to them. So how do you make security personal? Well, my perspective is all Security is personal. And what that means is security starts with you as an individual. It starts with your being. It starts with your person. Therefore, it is personal. So it doesn't matter what your role and responsibility is in the organization. All security starts with individual people because, you know, predators, thieves, right? Violence, theft targets people. It targets their person ultimately, even if the goal is credit card data, client information, whatever the case is. In the end, it's targeting people. And the way you get people to care about security in the workplace, or even security at home, is to target who they are and what the risks that they face as people are to begin with. So I'm going to show you a little bit about what I do and how I do it and how I make it personal to them. All right? And it's not that complicated. I'm going to show you a bunch of different examples. Um, the presentation that you're about to consume isn't— it's not going to flow. It's not what I normally do. It's just bang, bang, bang. This is what I do. This is how I do it. These are the examples that I show. This is how you get under their skin. This is how you get them to care. These are the examples that I use and so forth. So it's not like my kick-ass presentation that I deliver. It's— this is how you do it. And so if you want me to do it, then, you know, contact me and we'll talk about it. All right, so, all right, let me get to— you know what, let me get to, uh, my slides and see how that looks, and I might bounce back to the web and see how that looks. All right, so slides. All right, so we'll start with this. A lack of security appreciation contributes to poor security awareness. A lack of security appreciation contributes to poor security awareness. What does that mean? It means that your people aren't going to appreciate security unless They understand the fundamentals, the basics of how it pertains to them, because they are selfish or self-interested creatures. And so you first need to explain to them what security is and isn't. So what security is, it's risk management. What security isn't— for example, in all my presentations, I ask everybody in the room, and I just did a presentation to 250 security experts, CISOs. And I asked all 250, I said, hey, I'm a guy that has 200— I'm sorry, I'm a guy that has 22 security cameras inside and on the exterior of my home in total. So a guy that has 22 security cameras, what does that say about my outlook? What does that say about my disposition? What does that say about my take on the world? What do you think? What does that say about me? I had 250 security experts go paranoid all at once, which was kind of funny. And I said, do I look mentally ill to you? Because paranoia is in fact mental illness. It's a disease of the mind. It is a complete overwhelm and out of control and really believing that people are out to get you. And when you have 250 security experts think or believe or, or phrase that somebody who engages in security practices is mentally ill, how are your people, your everyday frontline employees, your company officers, how are any of them going to want to engage in phishing simulation training, in security awareness training, if their sense is that security is about being paranoid? It's about mental illness. It's about being overwhelmed and out of control. It's about people are out to get me. Who wants to do that? Nobody. And so, it's important to dispel the societal and cultural myths that revolve around security first and foremost. So that once you do that, you break down all the barriers, all the resistance that they have to wanting to engage in security. And when you start that process, they begin to see security for what it actually is. And security fundamentally is about being in control. It's about managing risk. It's about understanding and recognizing that security never sleeps. It's 24/7, 365. It is a journey. It is not a destination. It's something we strive for, but we never fully attain. It's something that you need to engage in in order to reduce and manage risk. And that once you do these basic things at your place of business, in your personal life, you reduce that risk to the point where you become a tougher target. So the way I start it off is I start talking about personal security as it relates to them. So I asked them, how many of you have a home security system? And generally it's about 20% of the room. And I tell them, did you know that every year there's about 1.5 to 2 million homes that are burglarized in the U.S. every year? Every year. That's between 15 and 20 million homes will be burglarized in the next decade. And so I asked them, why have you not invested in a home security system if in the next 10 years 20 million homes could potentially be burglarized? And they start to raise their hand and they say, well, you know, I don't want to live like that. Or my husband says, why bother? If they want— if they're going to break in, they're going to break in. Or, you know, I have insurance for that. So now I start to point out their fatalistic attitudes and how— why would you just make it easy for the bad guy? Why would you have that fatalistic attitude and just rely on insurance? Like, don't you know what happens once a home is burglarized? Like, they go through all your stuff. Like, they make it so that you don't even want to live there anymore. It's a really awful feeling once your home is burglarized. And why would you 'Well, I have insurance, and why would they target me anyways?' See, now you're functioning in denial. That's what's happening right now. And so as they're functioning in denial, and as I'm pointing that out to them, they're like, 'Oh yeah.' And I say to them, like, 'When you get in your car, do you put a seat belt on?' 'Well, yeah.' 85% of people put a seat belt on. Why? Because you can get in a car accident and get hurt. Well, when you put a seat belt on, are you putting it on because you're paranoid? Do you not put it on because, hey, he's gonna get an accident, get in the accident? You know, would you tell a law enforcement officer not to put a bulletproof vest on because, well, why bother if you— if the bad guy is going to shoot you, they could shoot you in the head? Well, wouldn't you want to reduce risk by putting that bulletproof vest on to cover your vitals? At least, like, do what's necessary. Like, put layers of protection in place. Like, I point out all these basics, these fundamentals, these ways in which you manage and reduce risk. Like, why wouldn't you lock your doors? Why wouldn't you install that home security system? Why wouldn't you have the Beware of Dog sign? Why wouldn't you have a bulletproof vest on if you're a law enforcement officer? Like, it's all these different things. Why wouldn't you put a seat belt on? Like, why would you not do these basic things? And they say, well, I don't want to live like that. I don't want to be paranoid. Well, That's not what security is. It's not about being paranoid. Those are cultural and societal myths that we have basically perpetrated for decades and decades and decades. And not engaging in the process of security, saying it can't happen to me, is fundamentally functioning in denial. And when you finally break it all down for them and explain all that to them and show them all the ways in which they've been thinking about security all wrong, they begin to see it for what it actually is, as a benefit to them. Now they're self-interested in how it can benefit them. So now they start to say to themselves, well, maybe a security system is a really good idea. I mean, I wear a seatbelt, you know, I— and then you, you talk about other aspects of personal security like self-defense and, and, and, and, and assault prevention and and, and how you can reduce risk for your daughter going off to college in regards to sexual assault and so forth. And like, and you weave all the personal stuff into their physical lives, and then you start talking about passwords and two-factor authentication and how to manage those passwords and how to engage in those basics of security. But first, let me show you a bunch of things first, okay? So let's go to the Google. So let's talk about bad guys real quick, like antisocial personality disorder. It is said that probably about 97% of all people are worthy of your trust. And in the world's population, about 3% are not. And why is that? Because many of them suffer from what we call either nature or nurture. Antisocial personality disorder. So what does that mean? It means by their nature, the way they're born or the way they're raised, something about them, something about the way their brain works, they don't experience empathy, sympathy, remorse, or guilt. And so hitting, hurting, harming, taking from others is normal to them. Like, it's okay. And they look at everybody else as their natural prey. And once you begin to understand that, that 97% of all people are worthy of your trust but 3% aren't, you begin to look at security and its features and its benefits both in the physical and virtual world a little bit differently. So by getting personal, bad guys, predators— and let's, you know, Jeffrey Dahmer, How many serial killers are there in the United States? FBI estimates anywhere from 25 to 2,500 at all times. Okay, let's look at some hardcore serial predators. Larry Nassar, USA Gymnastics, gymnastics, assaulted approximately— what do they say— about 250 young girls in front of their parents while he was examining them in the doctor's office. Literally used his body to shield himself digitally penetrating the young girls with the mothers in the room. I think it's important that you understand how a predator like this works. He just got stabbed in jail, by the way, just a couple of days ago. He's not dead, unfortunately. The fact of the matter is, is like, understanding risk means knowing it can happen to anyone at any time anywhere. And understanding the modus operandi of the perpetrator, of the predator, I think is really important. And most people, when they say, "It can't happen to me," well, why not? What makes you so special? Now, I don't get hardcore into sexual predators in my presentations. I don't do that. It's not necessary. I, I just touch base on it, you know, like, look at this. Boy Scouts of America sex abuse cases, 2.3 million youth members, approximately, what, can't see, over 92,000 sexual abuse claims. Hello, you know, like, this is serious stuff. Catholic Church sexual abuse case, how many? I mean, it was like 3,000, 4,000 or more. Like, it's just nuts. Sex offender registry in the United States— how many sex offenders in the US? Over almost 900,000 sex offenders registered. So, so like, this is like personal, personal, okay? Then you get into the finances stuff, right? Here is one website of many where you can buy credit card numbers. You can buy Western Union accounts. You can buy really anything. You could buy passwords, skimming devices. I mean, you could get anything here. All their sensitive personal information. Fake IDs. Google it. I mean, you could buy fake IDs online. It doesn't get more personal than your identity. And then your passwords. Talking about passwords and password managers. You do a quick search on passwords. Most people's passwords are password, password1, 123456. Like, it's kind of ridiculous. So when you show them that, they begin to understand, yeah, I got some work to do. And then two-factor authentication. What are they doing or are they not doing in regards to two-factor authentication? How vulnerable are their accounts? And I show them all the various passcodes that are in fact available online in the dark web. And then identity. Let's talk about their credit. Their credit is their Social Security number on their credit report. And how accessible is it? Do you have a credit freeze? Most of the presentations that I do, even CIOs, CTOs, CISOs, the top echelon of security professionals, don't even have a credit freeze themselves. What is a credit freeze? If you even have to ask the question and you're a security awareness manager, why don't you have a credit freeze? It's the first thing that you do to tighten up and secure your credit, your identity, from new account fraud. Not doing this— if, if your frontline employees don't have a credit freeze, how are they even going to care about protecting other people's identities? Is this beginning to make sense to you? Do you now have a lot of work to do? Is it a bit overwhelming? Yeah, it should be for most of you. I've given you 8 hours of presentation in 15 minutes. I don't show all of this in an hour and a half keynote. I, I touch on a few things and, and I firehose them with certain things and I, and I just glean over other things. Just so they have like a little, aha, okay, now I understand why that matters to me first. And then from there, they begin to implement it in the workplace. Okay, so let's go back to the PowerPoint, maybe get, uh, all right. So 27 billion records exposed in the first half of 2020, more than 40 billion records exposed in 2021. So that's what, 70 billion records just in a year or two? Studies show that right now it's about 150 billion records that are exposed in the past decade. 150 billion names, addresses, phone numbers, home phone numbers, mobile phone numbers, email addresses, passcodes, usernames, passcodes, credit card numbers, bank account numbers, you name it, street addresses. It's all out there. And I show them all that data, right? An astonishing 773 million records exposed in a, in a monster data breach, including over 21 million unique passwords. So check this out right here. Index of Combos. What is that right there? That is a screenshot of a website, dark web, where I downloaded 21 million unique credentials, usernames, mostly in the form of Gmail addresses, and passcodes of all these unsuspecting victims that have no idea that their information has been compromised. So I download all this data from the dark web, and I have it on the device in front of me. I'm not going to show you right now. If you want to see the data, hire me, because I'm going to show your audience. I, I show your attendees, I show your employees, I show your co-workers, I show them raw data from the dark web. Why? Because it's likely their information is included in there as well. I know that if I search mine, mine is— my Gmail address is right in there, and old passcodes that I've used, and some of the current passcodes that I've used are in there as well. Okay, and my accounts would be vulnerable if I wasn't using two-factor authentication. So I showed them this. Why? To show them just how vulnerable they are. And when they see how vulnerable they are, they're like, oh, this means something. It matters to me. And I show them, well, all you really got to do is use a different passcode across all your, all your different accounts. Well, how do you do that? Well, you do that with a password manager. Now, you may not be able to use a password manager because of company policy. But at a minimum, you get them accustomed to it in their personal lives so that they know why they should use a different passcode across each account. And their password manager manages it for them and creates an uppercase, lowercase, number, character unique passcode for all of their various accounts and so on. And then show them how even if they do use a password manager and even if they do have a different passcode across multiple accounts, it still doesn't matter if that account is breached and they don't have two-factor authentication, because two-factor authentication is really the next best thing that we have right now at our disposal in order to protect that account, even if the bad guy has your username and your passcode. And the benefit of two-factor authentication and why— but you got to show show them. You just can't tell them. You have to explain it by showing them the data out there. Let them see it for themselves. And once they do, they're like, oh, this is why my security awareness manager, my CIO, my CISO has been drilling this into my head. And maybe you haven't done it to the degree that I do when they go, aha, oh, Now I get it. I can't tell you how many times someone has approached me at the end of my presentation after an event and they've said to me, you know, my CISO, security awareness manager, said we have to do this, it's required. And I didn't want to come. I didn't think I needed it. I thought I knew everything. I just, you know, I'm technically savvy and this stuff really, you know, it's like whatever. And I'm so glad that I came all the time. And I get all the time, I have a lot more work to do than I thought I did, but it's okay because I want to do it. They get it. You take them to a level where they want to engage in the process of security by demystifying it, by getting all the myths dispelled, by showing them the fundamentals of physical and personal security. And how it relates to them by showing them the basics about protecting their own identities, their own Social Security numbers, their own passcodes, their own selves. You know, let me show a few more things. So we have a tool at ProtectNow, right? You've seen things like this before. We have a tool at ProtectNow where you can go and right here at protectnowllc.com That's me. That's our site. Scroll down, right? Employee training, CE training for real estate. This is what you signed up for today, right? Down here, cybersecurity awareness check. Check if your email has been breached. Check if your password has been breached. Email checker, right? So right here, you've seen a tool like this before. Robert Siciliano. @gmail.com, right? And we click search, and your email and possibly a password have been stolen in the following breaches. So you've seen this before, or maybe you haven't. So right here it shows all the various places where my username in the form of an email address has been compromised, right? In July 2018, Apollo 126 million email addresses and some passcodes. A Bitcoin forum, Bitly, CafeMom, the— all these that you don't see a logo, those are all data dumps. Cove, Dailymotion, Discus, Dropbox, Epic, uh, what is this one? i4Fraud, Forbes, PhotoLog, GateHub, Gravatar, Last.fm, LinkedIn. Mine was part of 164 million email addresses as usernames that were compromised. I take them through that. I show them how that works. I run their own email address through here and show them how that works and all the different accounts that are compromised and what that means to them. And the fact that your passcode, because of the LinkedIn account— LinkedIn breach is now in the hands of criminals. And so if you're using the same passcode for LinkedIn as you are for Gmail, they could be inside your Gmail right now, and so on. Which is why you've got to use a password manager to facilitate a different passcode across multiple accounts and so on. Look, I have talked to the, the, the highest of the highest, the top of the top, and you'd be astonished at the people that should be engaging in basic password management aren't. The most basic basic to the highest degree of security professional. They aren't, you know, they're just human. They just, they're lazy, they're tired, they're overwhelmed, you know, it's just the way it is. It doesn't make them bad, it just makes them not really engaged. And my job, your job, is to get them engaged. Okay, what else do I show them? Password manager, uh, all the ways in which passwords are compromised. What time is it? Almost done. Uh, the Equifax breach, which, which affected their Social Security number, and I show them the credit freezes, right? I talk about new account fraud, which is— which you protect yourself with a credit freeze so they, even if they have your social, they can't open up a new account under your name. We talk about account takeover fraud, which generally is either credit cards and what you got to do to mitigate that, and/or, um, password management, you know, bank accounts and all that stuff, and how to set up two-factor authentication and update your devices and update your software and update your operating system and so forth. All of that prevents account takeover. Explain to them how their bank accounts and investment accounts can all be compromised. When they understand how it affects them personally, then they will care about how it affects them professionally. You got to start with them. You got to start with you, right? Child identity theft. If they— if you have kids, their identities, your baby's identity is vulnerable. How do you protect the baby's identity? How do you protect the baby's identity? Do you know? Credit freeze. Okay, do all these absolute basic things. What else? What else? What else? You don't get more personal than taxes. Taxes. So every year, millions of tax-related identities are at risk. They get your Social Security number, they file taxes under your name, they file in your name, they have the refund go to an account in which the bad guy controls. You show them all these basic fundamentals about how the bad guys are paying attention to them 24/7, 365, via their social media accounts, via their personal accounts, and so on. Credit card protection, uh, how to mitigate their spam folder, right? Going, going into their Gmail account and automatic email forwarding— what does that mean? I just got hired by one of the largest shipping firms in the country because she saw this, right? Talk about social engineering and what that means. Social engineering is a collection of techniques used to con— manipulate people into performing actions or divulging confidential information. A con-fidence trick. And talk about trust and how we trust by default. And if you trust by default, that means that you consider most people worthy of your trust all the time. And only when you are hoodwinked, only when you are scammed, You go, oh, I should not have been so trustworthy. And they don't understand that trust is by default. You may not understand that trust is by default. And as long as you just go through life automatically trusting by default, you are going to get scammed. You are going to give it up to the bad guy. Look, we're at half an hour. This isn't— this isn't complicated, all right? All you need to do is just engage in the basics, the fundamentals, uh, show them how it all affects them personally, and then ultimately talk about hardware and software, security software, Wi-Fi security, VPNs, encryption. Talk about tracking devices, backing up, how passwords, two-factor, social engineering. This is all stuff that's very personal to them, to you. And if you— if they have all of the fundamentals in order, then they're going to have all the corporate stuff, all the professional stuff, all your stuff in order. Once they get their house in order, there's no way they're going to be fully effective at preventing phishing or protecting the data in which they are entrusted with until they understand how to protect themselves first. So how do you get in touch with me? It's not that complicated. Uh, you can Google Robert Siciliano, and I'm— I own the first 2 pages of search. Other than that, just go to— where we at— protectnowllc.com. Uh, you can call us, which Who calls anybody? Just protectnowllc.com. Robert@protectnowllc.com. And listen, I'm happy to share this presentation with you. I'm happy to, like, help your people. Whatever it is that you need to increase the effectiveness of security awareness training, I'm there for you. That's it. Anybody wants this webinar, just connect with me. We'll send you off a link, send it off to people, any decision makers. That might be required to watch this to get it before they allocate a budget towards security awareness training. I'm happy to help there as well. Okay, we can do it virtually, we can do it in person. I prefer to do in person, but I give a kick-butt virtual presentation as well. I make it fully interactive, which means that I am interacting with the audience the entire time. I know we didn't do that today, But generally, I answer questions as I go, which means I have a moderator generally that will answer those questions and say, "Hey, Robert, by the way, Jim has a question in regards to—" "Oh yeah, Jim, that's a really great question. Let's talk about that right now." And we just stop. And when you make it about the attendees, by the way, whether live from the platform or live virtual, you make it about them. When you are actually interacting with your audience from the platform, they're paying attention. If you're just droning on for 45 minutes or an hour and a half, if the speaker you hire just talking for an hour, an hour and a half, that speaker sucks. You want a speaker, a presentation, a trainer that is interacting with your audience, that is actually engaging with your people, finding out what their fears are, what their concerns are, what gets them going, what gets them motivated, what is what is it that they are worried about? What questions do they have? And when you interact with them in such a way where you are addressing them, right, you're getting to their heart. The way you change minds is you affect their heart, right? And that's what we do. That's what I do. Okay, that's it. That's all I got for you. I got plenty more for you, but that's all I got for you for today. Uh, any questions, comments, feedback, by all means. Stay in touch. You know how to contact me. I'm outie. Talk to you soon. ProtectNowLLC.com. Peace out.