The Illusion of Safety: Why Training and Tech Don’t Always Protect Us #46

And welcome to the Security Guy. Hi, Peter. Welcome to the Security Guy and CIA pod broadcast. I am the dysfunctional Robert Siciliano, the security guy, and this is—

if I don't say anything, I cannot make an error, right? This is Peter Wormka, the CIA spy. Robert, how are you doing? Been quite a week, right?

Yeah. Oh yeah, yeah. And, and you just came back from Singapore.

I know. And I don't know if a lot of people, they think, well, somewhere out in Asia, but they don't know exactly where it is. A lot of people think it's part of China, which is not. Uh, but it does take a good 20 hours of flying time to get there, so it's quite a long trip. But it was my first— I've been to over like 70 countries, Robert, and this is my first time in Singapore. I'm already making plans to go back next year, uh, for a project I was working on, and it was phenomenal. I was so impressed by Singapore, and I think one of the great things about traveling is that we have a chance to learn how things are different in other places, and we can decide, hey, I like that, or I don't like that. If the more we travel and, and learn what other people are doing and how the— all different governments, you know, prioritize different types of, uh, things that I think, I think we can benefit from it. Like, for example, in Singapore, I was just amazed by the, the, the level of what I felt personal security. I just felt it so safe, you know, to go around. It's so well organized, so clean, so green. The literacy rate of the individuals is also very high. You know what, the kind of things that we talk about, especially when I talk about human hacking, these things, a lot of these people were so well informed already compared to when I go to presentations here in the United States. I see people with their mouths open. Over there they say, yeah, yeah, we're aware of that. We were, you know, they already received it. They're already aware because their government prioritizes this type of awareness training and programs. I even saw them on TV, uh, spots that are addressing, you know, anti-fraud, anti-scams, you know, at a level that I don't see here in the United States. I was just blown away.

And you were hired, uh, as a, uh, former CIA spy?

That is correct.

By their— by a private company to speak to their government?

Yeah, the private company that conducts a variety of different training courses, workshops, and most of their clients are different ministries of the Singapore government. So yeah, I was, I was, uh, provided the ultimate client where it was the Singapore government, but it was through a private training company.

And you spoke English to an English-speaking audience?

Yeah, I mean, there's multilingual. I mean, almost everybody there is going to speak at least 2 or 3 languages, but English is the predominant language, so everybody speaks it very well. And then it's, um, I think Cantonese, Chinese is probably the 60% of the people speak this. And then there's a few other languages, but English, everybody is very fluent.

What was the nature of the presentation you delivered?

The nature, I mean, we talked a lot about human hacking, but I mean, with the whole scope of basically how a variety of threat actors will target organizations for various purposes to include to include for espionage, right? Whether it's criminal groups, industrial competitors, or even state actors. So we talked a lot about even how state actors are targeted by other— targeted by foreign intelligence services and kind of went through the whole asset recruitment cycle and everything. I mean, a lot of different components of this. And of course, some areas they were more interested in, and that's why I'm going to be developing more courses in regard to Regarding to this, when I go back, uh, hopefully they've already invited me to come back next year, so I guess it was successful.

Awesome, man. All right, so right here at Dark Breeding, um, says, uh, we've, we've, we've, we've all been wrong, uh, phishing training doesn't work.

Good.

Well, um, so a couple of things with that title, kind of loaded. Uh, I haven't been wrong, you haven't been wrong. Because we both know that while phishing training actually does work, it doesn't work to the degree that, uh, the CIOs, CTOs, CISOs wish it would. Is really how this title should go, or at least that's how the subtitle should be.

Well, I would ask this question to you, Robert Siciliano. Why— what is the main reason that organizations can, you know, contract with so many different suppliers, providers of phishing training. And I mean, the number one reason to me is sort of like compliance is something that they can show to their shareholders, regulators. We have this program in place.

Yeah, compliance, that's it, check the box.

Yeah, but they're saying according to this article that it's not really working, it's only like increased Like 1.7%. I mean, it's like crazy that it's such a little impact according to the article.

Teaching employees to detect malicious emails isn't really having an impact. What other options organizations have? Well, I think that phishing simulation training is necessary and still needs to be conducted because it does create a level of awareness about that specific problem. And also, you know, the various phishing simulation firms out there do provide additional forms of security awareness training that does go beyond phishing, but the general, you know, I guess static nature of that training where they are just, you know, watching either, you know, a cartoon or, you know, actors playing something out, or screenshots and so forth, that one-size-fits-all doesn't necessarily affect the learner the way the type of security awareness training that you and I provide, which would be considered dynamic, that in-person dialogue that we provide, That's really what I find, and I'm sure you as well, affects the learner in such a way where it fundamentally changes their behavior regarding what security is, what security isn't, and what risks that they need to be aware of.

You know, it's interesting when I go out and give presentations, the people that come up to me usually not talking about, oh, you know, what's happening at their company, you know, these issues in their company. They're coming with these stories back to me me of how they've been personally victimized by fraudsters and scammers, or, you know, a member of their family all the time. And so I think this is one of the problems with how this is rolled out in the companies. Uh, I mean, it's shown as you, you need to conduct this training, and this training is going to help you protect the, the integrity, let's say, of, uh, the data in a company and protect it from being, you know, being breached. So you're, you're taking this training, it's mandatory, and the end result is going to be helping the company. Versus this being shown as, hey, this is really important to be a benefit to you, employee, in how to protect yourself and your family against fraudsters and scammers. I think it's presented that way. At the end of the day, they're going to accomplish what they want to accomplish. They want to increase the awareness of these employees against these types of threats. But I think, you know, I think the employee has to see there's a personal benefit. What's the buy-in? What's the buy-in that they're gonna get from the employees? It's gonna be because it's something that's gonna be of benefit to them. Right.

I agree. Every presentation that I deliver, there's a line of people at the end of my program just dying to tell me about a situation that occurred in their own personal life, whether it was, you know, them being victimized or somebody very close to them, a family member, a friend. You know, they just, they want me to hear it out and then, you know, get some type of feedback in regards to what could have or should have been done differently or just, you know, simply to tell me, you know, that this is what's wrong in my life. You might want to use this in one of your future presentations. And I get that, you know, overwhelmingly at the end of my programs. But, you know, like the article says, the diagnosis is sound. The overwhelming majority of cyberattacks do occur due to some form of human error. You know, uh, and, and unwisely click link, a weak password. And the cure, uh, which, which is being presented is the occasional cybersecurity training obligations for employees, which is phishing simulation training. It goes on to say that, you know, the big finding is that the standard out-of-the-box industry trainings are not effacious in preventing users from clicking on emails in the future. She says that there's a lot of, you know, nuance there. Sure. They say that the idea of prioritizing awareness was very much predicated on the research itself. There was some studies in the 2000s and 2010s that explored this notion that teaching awareness is the path forward to protecting users. There's so much psychology and cognitive science research that all were bringing it into the security realm and saying, we just need to make users aware. And most companies have, uh, provided, you know, the, the, the, those regulators which you mentioned as that form of awareness training that checks that box, provides that compliance. And if they've done that and they could show that, you know, they have the due diligence, you know, in regards to and the patches and such, that they can show that, okay, you're good. And so this last liability ability. And if that's what you're doing, okay, you'll less actual problem. This article saying no, right?

I've heard, and a few presentations that get me really upset when I hear people that are— nothing against selling technological products, but, uh, selling products saying because the alternative You know, spending time on trying to educate or train employees is a waste of time. And it kind of infuriates me thinking we're just giving up— we're giving up on being able to train or educate people because they just can't learn, or they can't, you know, they can't— they can't. Then let the robots come in. You know, the March of the Robots. Let them come in, we can't learn, we're dumb.

Yeah, robots, uh, I don't give up. I feel like at some level of making certain things worse in regards to this issue, you know. Uh, and, and look, it— this, this ultimately is, is, is not a technology problem, it is a people problem, and it is managing human intelligence And, uh, you know, I'm hearing— I still hear, you know, uh, criminal hackers are so sophisticated. And it's like, well, you know, they, they, they are, um, and, uh, what, what the reality of it is, is, is, is while the criminal hacker is, I guess, sophisticated, what they really are is more organized than ever. Including employees and of course the general public, uh, don't want to deal with these issues. We don't want to look at security as being our responsibility, that ultimately, oh, the government is going to protect me, or that our job— that's not my job, why do I have to do this stuff? Well, because this data in which you are entrusted with, that is primarily to a certain degree, your responsibility if you're communicating it outside of the company firewall, which in some cases the employees do. And of course, being tricked into sharing that data in a variety of different ways, giving access to your passwords because you fell victim to some type of a scheme where you thought you were communicating with your CIO or CTO and so forth. You know, that is your responsibility to recognize risk in such a way where you're not going to be tricked in both your professional and of course your personal life. And if just professionally, which is what most security awareness training including phishing simulation does, if it's only presented in the— from the perspective of professionally, then the employee is just not going to want to deal with that because we are selfish or self-interested creatures that ultimately only care about ourselves. Which, being selfish, uh, isn't necessarily a bad thing to the degree where, like, you need to selfishly take care of yourself, family, Like, you have to get a good night's sleep. You have to nourish your body. You know, you have to put the oxygen mask on yourself first when you're on the plane and the plane's, you know, experiencing an issue in order to take care of those around you. So it's important to be selfish in that regard in presenting security awareness training from the perspective of how this is what affects you personally. Is, is part of how you and I deliver a presentation.

I guess if we go back to that title of this article, you know, we've, we've all been wrong. Maybe we just take out the word phishing, we replace it with awareness training, you know, because it would work. But phishing training, maybe not the way, the way it's being done doesn't work. But awareness training itself is something we still have to do. You still have to really in my opinion, uh, put a lot of more emphasis on.

Yeah, and most trainers are out there, you know, scaring the heck out of people, and they're saying, you know, here are all the risks, and this was what you need to be doing or else. And that fear will, uh, move the needle. It just, it just makes most people put the covers over their head and function in a state of denial, like, okay, well, yeah, yeah, I just don't want to deal with that. It's just not going to happen to me anyways. 'Why bother?' And they just kind of shut down.

Yeah.

And that doesn't work, you know, it doesn't. It, it, it never has. Security awareness training from, from a very empathetic point of view, that like, okay, so like, here's the reality of this, you know, there, there always has been, there is, and there always will be this criminal element out there. It's just the way it is, like, you know, since the beginning of time. Uh, there's always been snake oil sales, but there's always been, you know, Ponzi schemes and fraud given instinct to trust one another based on being an interdependent species. That's how we roll. And they exploit that trust in such a way that, um, you know, they, they twist the truth ever so slightly because we want and need to trust others. And as long as we understand that that's how it works and, and evolved to recognize risk in such a way where, you know what, the likelihood of these things happening to me is— it isn't like overwhelming, but, but it's, it's, it's possible. And so if I recognize risk in such a way where, okay, if I, I begin to see risk around us, and so we just have to be just paying that much more attention, small little changes in our behavior and our awareness, so that when that risk comes to us, we understand what those signs are and we do something about it, opposed to functioning in a state of denial.

Right, right. There's no—

it's really like just holding the learner's hand in such a way where we walk them through it without fear-based training, without screaming at them, without worry and, and, and, and, you know, consequence. That like, this is like how it's always been, and empathetically, then they're much more likely to embrace that in such a way that, you know, they want to do something about it because ultimately they, they themselves, they want to protect their data and their dollars and their loved ones, their spouse and their kids, you know. And then once you present it from that perspective in the workplace, they're more likely to actually, you know, be receptive to phishing simulation training.

I think it'd be interesting to calculate on average how many times a day we, any one of us, is approached by a scammer. You know, how many times a day. And then clock back pre-internet, let's just say, How many times a day would people be approached by a scammer? How many times a year? Maybe less than one.

I mean, it's like daytime all the time.

It's just because we're so now accessible, right? Information about us is so accessible. Also, for a scammer to, you know, devise something that's going to maybe, you know, um, pull upon our emotions to, to act upon something that they present to us. And so it's just crazy.

Bring this back to a personal level, right? You know, like, if, if companies understood that this is the direction things are going and these are the concerns that people have and why, something like this wouldn't be such an issue. But it is, because sharing thing, where parents share everything about their lives with the world is insane to me, right? Uh, New York Times, uh, discussed their children online. And look at— I've got a 16-year-old and a 19-year-old, and if I've shared their information online, it might have been maybe 3 to 5 pictures in the course of their lives, in their entire lives, that I've shared. And I think the majority of those photos, they had sunglasses on. Artificial intelligence apps generate fake nudes amid other privacy concerns, make sharing far— talking about this issue pre-AI. Parents, you know, have joined the— many parents have joined the Never Post campaign because of a more recent threat Apps that can automatically generate fake, deepfake nudes with anyone's face using generative artificial intelligence, the technology powering popular chatbots. And again, I have not— since birth, you know. The so-called nudifier apps are simple and cheap for anyone to use, with some even offering free trials. Uh, the author took a look at some of them. These apps are being widely used by students in schools, and for victims, having artificially generated nudes of them out in the wild has been as traumatizing as it would be if the photos or videos were real. Uh, the— to post non-consensual fake nudes online, uh, there is nothing stopping people from using the Nudifier apps which have proliferated on the web. Dozens of the nudifier sites making in millions of dollars a year. And once something like that is shared online, even if it's AI, the doubt is then, uh, instilled in the viewer. The doubt meaning like, uh, you know, Was this AI, or did that person actually allow themselves to be, you know, videotaped or photographed? Was it AI, or did they just do it, you know? And then if it was a child, then the doubt goes back to the parent. Well, where is the parent when, when their child was engaged in this behavior? What kind of parents would allow their kids to do that? Why didn't their— why didn't the parents have access to the kid's device. Like, and now the family is canceled in their community.

It is, you know, I think on another level, but I don't know if they've ever approached it this way, he said that there's a law that, that criminalizes individuals that— unless you are in some of these cases, if this is a minor, and now And, you know, now they have created images of videos of them, you know, nude. That would be considered, uh, child porn. But then I suppose it could be argued, well, it is not real though. It was— it's not a fact, you know, it's not real images of real people. And so from a standpoint of being able to prosecute it, I just think the laws— there's so many loopholes in these laws also that make it difficult. To really prosecute the producers and/or the consumers of this type of thing?

Yeah, one of the sources, you know, says it's everywhere. Any kid with access to the internet can deepfake. There are more risks to photo posting, like potentially exposing other people's sensitive personal information to bad actors. That may discourage parents. You know, to be clear, whether or not, you know, to publish family photos is a personal choice. So this, this article isn't a condemnation of parents who do post. You know, like the author says, you know, I like seeing photos of other people's children on social media. Instead, you know, let this be an explainer on what to consider when posting children's— a really good in-depth exposé of it and what the risks are. And but But, you know, the fact of the matter is, is that this, this has and will continue to be an issue. And parents who just, you know, without thinking it through, post, you know, videos and photos of their kids online, there's risks there. And, you know, some people say when you discuss those risks with them, they go, oh yeah, I'm not worried about that stuff. I don't want to be paranoid. Exactly. Is that what this is? Is, is, is, is, is, um, understanding what those risks are, um, being paranoid, or is it managing risk? You know, and as long as we use those excuses and function in a state of denial and look at recognizing risk as a form of paranoia, no one's ever going to take this stuff to heart. They're not going to recognize risk effectively. They're not going to consume security awareness effectively, and they're gonna continue to be part of the problem from what I understand.

And the, I mean, the real, I mean, this, this is a very, very ugly sort of, you know, how, how, how people will utilize these images. But the thing is, once it's out there, it's not gonna go away. You know, you could, it could be maybe harder to, at some point, harder to find this, but once it's out there, out there. People are always going to— people who are victimized are always going to have this fear, you know, my image is out there, who's seeing it, how is it going to— how might it resurface again?

Peter, what do you got going on? Where can people find you?

Well, I'm just trying to recover from this trip. I'm still sleepy, not caffeine, but anyway, I'm working on a lot of things, a lot presentations in the next couple of months here in the United States. And so you can find me on Counterintelligence. And, uh, if you haven't got them yet, there's two books out there: Confessions of a CIA Spy, The Art of Human Hacking, and Why Are You Messing with Me, which is becoming more and more popular now because it's geared really for seniors and helping them to better understand how to protect themselves against fraudsters.

Yeah, and, uh, there's Peter's LinkedIn page, uh, uh, 72. All right, so, and me, uh, I am at, as most of you know, protectnowllc.com. Uh, fall has, uh, filled up quite a bit. Uh, I actually just, um, booked a really nice gig for the speakers bureau, the 3 consecutive events in September, October, November, to a large, um, distributing company and all their distributors.

That's pretty cool.

Yeah, yeah. Uh, so protectnowllc.com, and you guys can check out any e-learning, uh, contact me and so forth.

Peter, uh, be safe, protect you, look out for yourself, and look out for, for others around you, because, uh, many times people are not really paying attention, and we can really help them, you know, be empathetic And, uh, watch out for this. Watch out for each other.

And like, as my dad says, be good, behave, and be careful. And we'll talk to you all later.