Increase the Effectiveness of Security Awareness Training by Making It Personal

Welcome to Increase the Effectiveness of Security Awareness Training by Making It Personal. This is via protectnowllc.com, and I am Robert Siciliano. Many of you know me. We have lots of friends here today. Colleagues, some clients. Some of you are security awareness managers, others are security experts. We have CIOs, CISOs, CTOs, and soccer moms and NASCAR dads. You are all welcome. Thank you so much for being here. 55 years ago today, I was born. Yes, today is my birthday. And my wife said to me, why are you doing a webinar on your birthday? I said, well, what else would I be doing? This is what I do. Well, live presentations, yeah, I'd be much happier in front of an audience, but I love my people. I love doing what I do. I love speaking to you in regards to how to avoid and remove yourself from dangerous situations, whether it's in the physical or virtual world. My job is to bestow upon you how to protect yourself and your organization from the bad guy. And today we're gonna talk about that and essentially how to make security personal for your people. So I have the honor and the pleasure of speaking to some of the top security educators and CIOs and CISOs in the world. Those who are responsible for protecting our critical infrastructures from the bad guy, wherever they are in the world, whether it's state-sponsored hackers out of Russia or China, or, you know, some dweeb in his mom's basement. Their job is to make sure that their network is protected and their people are adhering to basic security principles. And what I'm hearing over and over and over again from these CIOs and CISOs and security awareness managers is that their people simply aren't caring about their responsibilities when it comes to protecting the data in which they are entrusted with. Ultimately, all of the security awareness training that they're getting is making a difference, meaning like they're getting better at not clicking on that link So they're engaged in check-the-box security awareness training, compliance, say phishing simulation training. And while that's working, they say it's just not making a huge difference in their performance. They're still not into it. They're doing it because they have to. And there's a reason for that, and that's what we're talking about today, and how to overcome that, how to bridge that gap. Over and over and over again, what I've been hearing for years now, and this is what I speak on, is, Robert, we just want them to care. Like, we, we understand that, like, they have a lot going on in their lives. We understand that they have their job responsibilities. We understand that security is low on their priority list. But we just want them to care more. How do we do that? And the way you do that is that you make it personal to them. Understand this: human beings are self-interested, or more aptly, selfish creatures. And we have to be selfish in order to function. You have to eat properly, sleep properly, take care of yourself in order to be effective for yourself and for your family and to do your job. You have to take care of you first, okay? And if you don't take care of you first, everything else falls apart. It's just the way it is. So being selfish isn't necessarily a bad thing when it comes to, you know, taking care of your mind and body, okay? When it comes to security, you also have to be selfish as well, meaning that you have to make sure that, you know, your being, your your physical being, your personal security is, you know, up to par, up to speed. And as an employee for an organization, in order for your employees to care about security, you have to make it about them first. They have to see how it benefits them in order for them to want to engage in the process of phishing simulation training, in so many other aspects of what security is and isn't. So as you are taking this course, this 20, 30 minutes that we have together, look at this from the perspective of how this affects me as an individual, as a mom or a dad, as a brother or a sister, as a son or a daughter, as a homeowner, as somebody who has a bank account, a Social Security number, or credit cards. How does it affect me as an individual? How do, how do I benefit from this? Okay, and And from there, you will see how your employees, your coworkers may also perceive that same information. And I challenge you, those of you who are in the security business, if you learn anything from me today in regards to your personal security, then I challenge you to incorporate that into the way in which you train your people. Because if you're learning from me in regards to your personal security and you're in the business of security, then that tells me that you've got a lot to learn, which means you have a lot to teach as well. Okay. All right. So enough of the rambling. Let me get into it. All right. Just give me one second here. All right. Hold on. Okay, good. All right. A lack of security appreciation contributes to poor security awareness. A lack of security appreciation. Security Security appreciation, a lack of security appreciation contributes to poor security awareness. What does that mean? So our philosophy, my philosophy has always been that most people don't care about security, that they think it can't happen to me, that they don't want to believe it's going to happen to them, that they function in a state of denial. They would rather believe that these things can't happen to me, that it happens to other people. And therefore they go the complete opposite direction and they do nothing about it. Okay. And they don't appreciate the value that security provides them. They don't see its value in their everyday life. They take it for granted. Okay, let's talk about what security appreciation is. Let's just define appreciation to begin with. Appreciation is the recognition of an enjoyment of the good qualities of someone or something. Okay, so to appreciate security is to recognize and benefit from what it is and how it does its job. Okay, and then number 2 is a full understanding of a situation. So to appreciate something is a full understanding of a situation. Most of your people, including some of you, don't have a full appreciation of security, and that's okay. Right? We're here to bridge that gap. And so that lack of security appreciation is what contributes to poor security awareness, because if you don't really appreciate it for what it is and what it isn't, then you're not apt to engage it to the ability or to the effectiveness that you can and that you should. The way I look at it is security awareness is from the neck up. It's head-based. It's your understanding of your grasp of the issue, right? You see the issue, you understand it, you know you should have a password manager, you know you should lock the doors to your home, you know it would probably be a good idea to take a self-defense class. You understand these basic concepts, okay? Security appreciation is from the heart up. Right? Meaning that you actually emotionally engage in the process of security to the degree where it matters to you and it means something and you do something about it. That you don't necessarily live or breathe it, but you appreciate it at a level where you lock your doors, you probably have a home security system, you might engage in self-defense training, you have a password manager, you have two-factor authentication, You have security cameras. Like, you've done all the things that's necessary, all the layers of protection to make sure that you and your family and your data and your dollars are protected because it matters to you. It means something to you. So I asked this question live in my presentations. I asked the audience, I say, how many of you live in a safe neighborhood? And I'll ask you, how do you live in a safe neighborhood? And usually, like, 80% of the time, people raise their hand. 80% of the audience, I live in a safe neighborhood. And I say, so really, so your neighborhood is safe? And I say, so you watch baseball, right? And you know that in baseball you are either out or you're safe, because safe is an absolute. And if you live in a safe neighborhood, that means that nothing bad ever happens, or ever will happen, or ever has happened, because that's what that means. Safe means nothing bad happens. I say You may live in a safer neighborhood, which is fine, and that's great that you feel that you live in a safe neighborhood, but you really live in a safer neighborhood. But bad things still do happen, which means that you still need to put systems in place to make sure that you reduce risk. And when I say that, and I ask like, how many of you actually have a home security system? And usually maybe 15%, maybe 20% raise their hand. And I say to the other 80%, well, why don't you have a home security system? And you know what the most common answer is? I don't want to live like that. And sometimes that might be in a room of security professionals that'll say that. I don't want to live like that, they say, of a home security system. And I say, what does that actually mean? What does that actually mean? So let me ask you, okay, I'm a guy that has 22 security cameras both inside and outside of my home in total, okay? When I— I just did a presentation in front of 250 CIO and CTOs and lawyers, okay? 250 of them. And I asked them, I have 22 security cameras inside and outside of my home in total. What does that say about me? And simultaneously, 250 of them went, paranoid. And it was funny, you know, because collectively they all said it like one big roar, and I laughed and they laughed. And I said, do I look mentally ill to you? Don't answer that question. And the reality of it is, is that we look at security in this culture as a form of paranoia, that people who are engaged in the process of security must be worried and in fear and paranoid that something bad is going to happen to them. And that's just not true. That's not what security is. Security is not a mental health issue. Paranoia is a mental health issue. If you've ever spent any time with anybody who actually has been diagnosed as paranoia, paranoid, it's very unsettling to be around them. I have family like that, and I mean, the poor kid, you know, they just, they really do believe somebody is after them all the time. And if they're off their meds, it's very unsettling for them, their spouse, their kids, for family. It's awful. That's not what security is. That person— people who are paranoid are out of control. Security is being in control, okay? And so when we culturally look at security as paranoia we are apt to run in the other direction. We're apt to do nothing about it. If you're providing phishing simulation training and they're looking at, "Why do I need this? I don't want to deal with that. I don't want to live like that. I don't want to lock my doors. I don't want to live like that. I want to be paranoid." No, that's not what security is, and that is the root of the problem for many of us, for many of us educators, for many of us CIOs and CTOs and CISOs, because if we can't get our people on board to understand what security actually is, what it means, what it does for you, its features and its benefits, how are they ever going to grasp the concept of phishing simulation or any other aspect of security for that matter? So it's very important that we change the paradigm and we go beyond just do this, don't do this, check the box, phishing simulation compliance. We need to get inside of hearts— security appreciation— in order to get inside of their minds to change their behavior. And until we do that, until you do that, you're going to be running on peanut butter and you're not going to get anywhere. You might check a box, you might be compliant, but that doesn't necessarily mean it's going to solve the problem. So the seat belt has been around now for 55 years, actually been required to be installed in vehicles since 1968 in the United States. But it's really only over the past 15, 20 years that we have been clicking it. Why? Because we are required to by law. And that's in half the country, we're required to by law. If you are seen Driving without a seatbelt, you would get pulled over and get a ticket. The other half of the country, if you get pulled over and you don't have a seatbelt on, then you'll get a ticket. Only one state in the entire union does not have laws on the books for adults for seatbelts, and that's New Hampshire. And their motto on their license plate is, "Live free or die." New Hampshire's funny like that. Anyways, it's taken decades for us to understand the value and to appreciate a seat belt, and it's taken laws to get us to that point. The internet as we know it has been around for what, 20, 25 years? And we're still not there yet in regards to all the infosec. The data breaches just keep getting bigger and worse and more of them. And until we change the paradigm, until people understand and value security for what it actually is, it's going to keep getting worse. Okay, I always ask my audiences, how many of you have a password manager? It's such a basic 101 thing. Usually about 10% do, which means that 90% of them are using the same passcode across multiple accounts. And data breach after data breach after data breach shows that millions and millions of people are still using the same passcode even after that same passcode was breached somewhere else. And then I asked, how many of you are using two-factor authentication? I just did a presentation the other day for 500 real estate agents, and out of 500 of them, maybe 60 or 70 of them were using two-factor authentication. Real estate agents are handling millions of dollars in closings for you, your money, and if their email is compromised, you're communicating with a bad guy telling you to wire money to an account that the bad guy controls. So this affects you even if you use two-factor authentication. So many others aren't. And the problem begins with everyone and ends with you and I, leadership, those who are in a position to make change, those who understand and recognize risk in such a way where you took responsibility today to be here because you want to do something about it and you want to— and you realize that you need to do more. Okay, all right, I apologize for my frog. All right, let me move on here. 27 billion records exposed in the first half of 2020. Okay, more than 40 billion exposed in 2021. In the past decade, by my calculations, it's about 150 billion records— names, addresses, phone numbers, email addresses, passcodes. Credit card numbers, bank account numbers, you name it, it's all out there. It's in the hands of criminals. And the idea is to make the data useless to the thief. It's already out there, so what do you do about it? How do you make the data useless to the thief? I'm going to show you a couple things, a couple tricks, a couple ways to protect yourself, right? Protect your family. And you see how the personal aspect of this can benefit your people and benefit you, right? And once they see that They wanna engage more in the process of security the way you will. An astonishing 773 million records exposed in a monster data breach, including 21 million unique passwords. So the last stat I saw was in 2022, about 720 million passwords were exposed. In 2022. Okay, let me show you something. See this right here? Stolen raw data for sale in the dark web. Index of combos. See all those files? And I know that you probably can't see them because it's probably too small on your screen, but I will read to you what it says. All right, it says— these are all files you can click on, open up a folder, and there they are. 1.5M combo email pass.txt. 1.25M HQ combo private gold premium dot text. 100K email pass high quality gaming streaming VPN text. 142,000 fresh HQ private combos. 1 million combo, 1 million combo, 2.8 million combined combos, and so forth. See all those files? Let me click on this. Hold on, let me show you something. Hold on. Again, something you can't see. That right there actually is a folder on my device with all of those records. I downloaded them, went to the dark web, found them all, downloaded 20-something million records. Email addresses and passcodes for everything. Okay, and I show that live raw data to my audience. Why? Because it shows them that their data exists on the web, that while they think that, oh, my password is protected, I can't share with anybody, it's my passcode, no, it's exposed, it's raw, it's out there, it's in the hands of criminals. And you're using the same passcode across multiple accounts, and one account gets hacked Now all of them are vulnerable, and they don't understand the concept of that until you actually show them the raw data on the web and what it actually looks like. And then I go through a variety of those different passcodes and what they actually look like. So let me show you something else, okay? So if we go to the Google, as the kids call it these days, Right. And I go to my website, our website, ProtectNowLLC.com, and we scroll down to the bottom here. We have access to 13 billion-plus stolen records. Check if your email has been breached. Check if your password has been breached. And what we do first is we'll go to check if your email has been breached. And right here, I'll type in Robert Siciliano. Riciliano@gmail.com, and you can email me. You can try to phish me. And you'll see that, oh, your email and possibly your password have been stolen in the following breaches. Most of you know where this data is coming from. In February of 2018, a massive collection of 3,000 alleged data breaches was found online. Including 80 million unique email addresses and passcodes. That's the download that I did with the 21 million unique credentials. In July 2018, 126 million email addresses and passcodes. In 2014— in 2014, Bitly and a Bitcoin forum, 5 million and 9.3, uh, respectively, including usernames and passcodes. Café Mom, bunch of different data dumps. Cove in February 2020, Dailymotion, Discus, Dropbox, Epic. Uh, February 2023, a recent one, 65GB. I for Fraud got breached, including passwords. Forbes, PhotoLog, GitHub, Gravatar, Last.fm, LinkedIn, 164 million. To those of you who are in the business, you understand all of this, okay? So what does all this mean to the rest of It's that all of these data breaches include my username in the form of my email address, and it's exposed along with the passcode for all of these different accounts. So I have to go into each of them individually and change the passcodes so that no two passcodes are the same. And I do that via my password manager, which coughs up uppercase, lowercase, numbers, and characters. It generates a passcode. I train the password manager to recognize the new passcode on the website. And I go through this process whenever I have to, and I never use the same passcode twice. And I point this out to everybody because when your audience, when your people, when your employees see that their credentials are out there and exposed and vulnerable, they begin to care. Why? Because it's about them. Because it's about their identity, because it's about their money. It's about their Social Security number. It's about their passcodes. It's about their accounts. Selfish. It's not a bad thing. It's just normal. It's what it is. And so once they understand that, once they see this, they're more apt to go, aha, oh, all right, well, this makes sense to me. Now I know why I need to do that. Now I know why I need to be aware of these phishing emails. Now I know why I need to have a password manager. Now I need— now I know why I have to have a different passcode across each account. Otherwise, they don't care because they don't think it's going to happen to them to begin with, because they think it's about paranoia anyways. And why would they engage in the process of paranoia when it's very uncomfortable? It's Human Psych 101. Couple more things I wanted to show you. Hold on. So I also show them, you know, talking to C-levels, articles, real-time C-level executives increasingly and proactively targeted by social breaches. Showed us some stats, how it works, what to look out for. Also, to back up my claim, Juniper says 146 billion digital records would be stolen by 2023. Agreed. Further, talking to real estate agents, Suspicious emails from Douglas Elliman chairman Howard Lorber exposed as phishing scam. A phishing scam from Lorber's company email address was detected a week after a data hack at Corcoran. You know, Barbara Corcoran, Shark Tank. So you speak to the individuals in their domain. In this particular case, real estate agents. Oh, if it can happen to Lorber, if it can happen to Corcoran, it can happen to me. Me, me, me, selfish, selfish, selfish. That's how you have to hit them. Make it personal, and then they get it. They'll understand. It will matter to them. It affects their heart emotionally. Okay, and then we walk them through the absolute basics. And I know the clock is ticking here. I talk about two-factor authentication. How many of you have two-factor authentication? 20% of you. Not enough. And I walk them through the process. I take them to Google and I show them Gmail two-factor. Just do a quick search. And how a quick search that anybody can do— it's so easy to do, everybody can do that— it passes the grandmother test. And I walk them through two-step verification on Google, and then I do a quick search and I show them AOL, right? AOL two-factor authentication. And I say, all you people with your AOL accounts, you're adorable. Anyways, here is how you set up two-factor authentication for AOL, and walk them through that basic one-on-one process So going forward, their email is protected. So their client's information is also protected, say if they are a real estate agent. All right, let me get back to the PPT. Just give me one second. Hold on. Okay. Thank you. Thank you for your patience. Okay, so Hackers are stealing closing funds by intercepting lawyer-client email. Experts say they're intercepting emails between lawyers and the clients, as well as real estate agents and the clients, in an effort to steal closing funds. So at this point, it's said that most people will buy between 3 and 5 homes in the course of their life. So you want to make it about them, make it about a big financial decision that they might make in their life, and how if their identity is compromised how— or if their real estate agent's identity is compromised, how that could affect their bank account, their ability to essentially buy a home. Because if they end up wiring money to the bad guy's account, it's over, Johnny. And it's as simple as that. Young family loses life savings of $775,000 in an escrow wire fraud scam. Why they're smiling, I don't know. The victims had received an email asking to wire funds into their escrow They received another email from the escrow company a few days earlier, and all their personal and bank account information lined up. They were convinced it was legit. Little did they know, inside the transaction was a criminal, either inside the escrow company's email or inside the buyer's email, monitoring everything. Everything in the second email matched up in their closing statement, and they did what they were told, which is what most people will do when they're working with a service professional that's guiding and directing them in that process. Whether you are a real estate agent, a lawyer, an accountant, whatever, your clients are looking to you. And if you are insecure and breached, they are toast because of your insecurity. Okay, moving forward. Shark Tank star Barbara Corcoran loses $400,000 on email scam. The book The 70-year-old mogul's bookkeeper received an email about an invoice to approve a payment on a real estate renovation, which isn't all that uncommon given that's what she does for a living. So let's say the bookkeeper's email gets compromised. Bad guys from the bookkeeper's email send an email off— from the admin's email, send an email off to the bookkeeper saying, hey, Bob has got a building in Brooklyn being built up, being renovated. The contractor is threatening to walk off the job if he doesn't get paid. Hasn't been paid in 60 days, and you know how a barber can be. If this guy walks off the job, you're going to lose your job. Therefore, pay this guy today. Bookkeeper's like, I don't want to lose my job, pays the bill, which was actually, you know, fraud. At no given point in time did anybody actually say to the bookkeeper or the admin, hey, before anybody ever asks you to pay a $400,000 bill, pick up the phone and find out if it's legit. Because we've come to rely so much on technology, email, right, that we've forgotten what it means to actually pick up the phone to verify the legitimacy of a transaction. And that is part of the issue that we all face regarding 'it can't happen to me.' That, yeah, email, you just trust it, and trust is overrated. Trust, by the way, as human beings is a default. And if we trust by default, which we do as an interdependent species, we trust by default the phone call and the email and the everything that we engage in on a daily basis is legit. You wouldn't be able to get in a car and drive down the street if you didn't trust that the people that are driving south as you're heading north and the only thing separates you is a double yellow painted line on the ground, you need to trust that they're not going to jump the line because they're texting on their phone. We wouldn't function if we didn't automatically trust, but trust is overrated. And unless you get inside the hearts and then the minds of your people and explain that to them, then they're just going to continue to trust every time an email comes in or the phone rings. You got to shake them up a little bit. You got to get inside their hearts to get inside their minds. It works. It really does. Okay, moving forward, I wanted to actually show you password management in a little bit, but let me keep going. I'll get back to that in a minute. We talked password managers. Passwords are compromised. And by the way, like, passwords for many of you are the biggest, like, issue that you all face with your— some of your people. Regardless of your password policies, some of them, some of your people are functioning from their own devices, uh, and you may not allow password management. That's fine, I understand that, whatever the policy might be. But even in their personal lives, to get into the habit of having a different passcode across each account is definitely a step in the right direction. It gets them thinking properly, right? You know, will you explain the password manager as a tool similar to a mobile phone? I've had a mobile phone since the mid-'90s. And I, to this very day, don't know my mother's phone number. I don't know my father's phone number. If I want to call my mother, I go to my phone and I type— I punch in mom in favorites. If I want to call my father, I go to my favorites and I see Bob, because I call him Bob, and I call my father. But I don't know what his phone number is. Why? Because I don't have to remember it, because my mobile phone remembers it for me. Same way a password manager remembers all the various passwords you're gonna need to have, right? And the, the fact that it's 2023 and we're still having this conversation is amazing to me. Someday passwords are going to be phased out, but that may not happen for another 10 years. And then in that next 10 years, you could be the next data breach. So you need to still update your people's understanding of what that means. So passwords, of course, are compromised via social engineering, via phishing, password reuse— can't do that— insecure, weak passwords, You got to use password manage, two-step verification. And I know that there are people on this webinar today that have devices that do not have passwords, maybe even your mobile phone. And if your mobile phone does not have a password and it's lost or stolen, what could that mean? What do they have access to? Everything. Yes, exactly. And that's a problem. Too many of us, too many of you don't have a password manager and your devices aren't protected by passwords either. And that to me is just insanity. All right, wanted to show you one more thing and then I know y'all need to hit the road. I had said earlier, right, that we're going to check, uh, passwords. Just give me one second. Hold on. Okay. Thank you. Thank you. Thank you. All right, good. Thank you for your patience. Okay, good. On my website, ProtectNow LLC, you scroll to the bottom, you see check if your password has been breached. Now this is kind of a fun tool that you You can show your people again, again, make it get personal to them, right? It's amazing to me every single time I do this and the laughs that I get and the fun that people have and how it's like such a big joke to them. And it's really not that funny when you think about it, right? It's actually kind of really scary, right? So check if your password has been breached. So we have access to 13 billion stolen records. So I type in 123456 as a password. So how many people are using 1 through 6 as a password? And this is in front of 500 people. Oh, how about, um, 37,615,000 times? And they all laugh thinking that's funny because they know half of them are doing the same thing. And then I say, well, let's type in P-A-S-S-W-O-R-D, password, as a password. Password, and that's 9,659,000. Okay, which is still not cool. And then I show them how many people out of 13 billion— I-L-O-V-E-S-E-X— how many people love sex as their password. And that just happens to be 31,914 love sex as their password. So make it fun, make it funny, make it interesting, make it about them, make it personal to them. Security awareness is from the, is from the head or the neck up. Security appreciation is from the heart up. That's how your, the heart affects the mind. That's how we change behavior. That's how you get people to start drinking your Kool-Aid. So thank you. We are 30-plus minutes. You guys have been great. I appreciate your patience. I don't want to take up more of your time. I've got at least another 5.5 hours I could talk to you on this stuff. The same energy level, the same kind of information, the same like spy tricks and techniques that hackers and crackers worldwide are using, raw data on the web, Russian hacking forums, Social Security numbers of Biden and Trump and Bush and Obama and Clinton. And Kardashian and everything. Like, just take them right to the bowels of the web and show them this is what's going on. This is how you buy stolen credit cards. This is how you get a fake ID. And expose all that stuff so they see how vulnerable we all are, how compromised the system is, and how it affects them as individuals first as moms and pops, as sons and daughters, as those who have credit cards and bank accounts and Social Security numbers to protect, how it affects their identity, and ultimately what they need to do to protect themselves first so they begin to recognize risk for themselves. And once they do that, they're in a better position to recognize risk that you want them to see. That's it. So I got for you right now. So we are at protectnowllc.com. So go to Protect— my call to action for you is to go to protectnowllc.com, sign up for our newsletter, email us, say you want more information. We'll engage in some email dialogue. Just, you know, let's change some behavior out there. Let's make a difference. I'm I'm here for you. All right, you guys are awesome. Thank you so much. And, uh, you know, I will see you on the interwebs. Be cool out there. Bye-bye.