Steel Con 2015

Last week I presented my "Popping the Bubble" talk at Steel Con - The North's Premier Hacker Con - https://www.steelcon.info/ - I think it went down quite well and there was some spirited discussion after the talk.

Robin (@digininja) and the crew put on a great conference at an amazing price of only £20 - The goodie bag really does have some goodies in it!

One thing that Steel Con does differently to other conferences is that they encourage children to come along as they have a specific "Kids Track". This is a great initiative especially when you see youngsters having fun learning to code, building robots and even making music with vegetables!

I'm looking forward to Steel Con 2016!

The Security Culture Conference 2015

So the Security Culture conference happened! On an Island…no really…it was on an island…look…

The journey there took about twenty minutes via a ferry and a small boat to get to the island called Lille Herbern. The venue was actually a restaurant – the only one on the island.

The day began with Roar Thon’s key note – He explored what security culture is and what makes it an important tool for organizations. Roar is the Specialist Director at the Norwegian National Security Authority – You can find him on Twitter as: @secdefence

Next up we had Wolfgang Goerlich – He looked at how to apply the Security Culture Framework to a software development team. I think Wolf was about to get he’s Bollywood groove on there. Wolfgang is a Cyber Security Strategist at CBI Inc, his Twitter handle is: @jwgoerlich

The second half of the morning we saw Kai explaining how you can build and maintain a security cutlure using the framework. He’s Twitter handle is: @kairoer

The final talk before lunch was by Waldo Rocha Flores who works for Ernst & Young. He’s work has a lot to do with measuring the behavioural outcomes of security culture. Waldo also held a workshop after lunch. I couldn’t find him on Twitter.

Then it was time for lunch – yum!

Some lunch time conversations and networking…

Waldo’s workshop discussions – after lunch Waldo held a workshop which delved deeper in to his talk.

After the workshop we stretched our legs and got ready for the final part of the day with Shan Lee Head of Information Security for Just Eat. Shan told us about his security culture story at Just Eat, he gave us great insight into what it’s like to build a security within a dynamic company. You can find Shan on Twitter as: @secwaza

Turns out I was last on the list to present, I don’t like being last. Especially when you’re preceded by such quality. I spoke about how you can pop your bubble in the corporate environment. I’m on Twitter as: @infosecmo

With the talks over and everybody ready to chill we headed back to the boat and on to the post conference dinner party – much fun was had here.

I was going write a long post but then I went through the pictures from the day and I think they explain it all. The first Security Culture Conference had speakers with real experience and insight and I think everyone took something useful away at the end. Yes there were a few niggles but no conference out there is ever without those – it’s how you handle things that matters. It was a small and intimate affair with great conversation and a stunning setting.

Thank you to Kai, Eli, Kristina and Lars for making us all feel welcome.

See you all at the next one…I wonder where that will be?

Book - Build a Security Culture

My good friend Kai Roer has written an easy to digest book on security culture. Anyone who has been in security for a while will know of Kai and his work on security awareness and culture.

He was very kind give me a mention in the book, cheers Kai!

It's a short and accessible book and you can find it here on Amazon.

Phishy cyber-criminals 'go corporate' with social engineering

I met Doug Drinkwater from SC Magazine at 44Con he asked if I would comment on an article he was writing about phishing. My comments can be found in the article here

Thanks Doug for reaching out to me!.

Tools Don't Change Behaviour People Do

What makes an information security awareness programme effective? As in most cases the answer is “it depends”.

Let me elaborate; if your goal is simply to obtain that magic compliance tick then maybe you’ll use some form of computer based training (CBT) coupled with some quizzes and possibly a few videos on your intranet page and bingo you’ve ticked the box! As an industry we are still heavily reliant on tools or packages to train or educate staff and make them security aware. However, these are rarely used within a defined and structured manner. Don’t get me wrong CBT’s, quizzes and videos are great tools but they should be used as part of your programme, not be the entirety of it. Actually, I don’t believe most environments need to train or educate their staff on security issues – I think that’s outdated approach. What they need to do is elevate their current level of security awareness to foster a more security conscience approach to their work and ultimately work toward building security culture.

Changing behaviours and building security culture is only possible when you understand and appreciate your existing organisational culture, look at how the different personalities within your organisation work and use a structured and measured approach and building security culture is no exception. Below are a few points that I think are important when you're seeking to influence and affect change:

Buy-in - It's become such a cliché because it's true. You need “the trust from the top” Yes it's about the funds but more importantly it's about the support, the belief that it will make a difference and that ultimately it's about enabling the business.

Understand and respect your current organisational culture - If you step back and think about the different departments in your business, the tone management sets, the different roles and responsibilities, you'll see the different personalities that exist. The key is to appreciate the daily activities that go on, what their key motivations are, what they need to deliver, and what their objectives are. When you appreciate this you can then look at how best to tailor security messages for them.

Know where you want to get to - Look at your current level of security consciousness and think about what's ideal for your environment not anyone else but yours. Define and set achievable goals, use campaigns that you can use as measures of success and target them at a particular department. Ultimately your campaigns can become your programme. A small campaign is easily structured, managed and measured and when that’s a success at you can replicate across different departments

Involve the right people - Odds are that you already have the majority of skills and experience you need in your organisation it's just a case of building relationships, being transparent about your objectives and working together. Seek assistance from departments such as HR, Marketing, PR and Legal these are departments that can help package your activities in line with corporate standards.

Prepare, plan, execute, review and repeat - If you already run projects and maybe even programmes you've already got the skills there to utilise and work with. Odd's are that you already have a security improvement plan of some sort or something similar is about to be launched, it's a great place to start aligning these activities with that

Understanding that it's an ongoing programme of work - When you're building security culture in your organisation be appreciative of the fact that it needs to be a dynamic activity, it should adapt to business and staff needs. If you use the ITIL framework you'll know about Continual Service Improvement think of this activity in the same manner – Continual Security Culture Improvement.

In essence what I’ve described above is the Security Culture Framework it’s been developed by Kai Roer of The Roer Group. It’s an open framework that consists of four elements namely; metrics, organisation, topics and planner you can find out more about it here - https://scf.roer.com/

A company that has been using the Security Culture Framework as part of their awareness activities is Just East. I caught up with their Head of Information Security, Shan Lee at 44Con and we got chatting about awareness, changing behaviour and security culture here's what he had to say:

“You absolutely have to tailor any program not only for your organisation, but for parts of the organisation. What works at JUST EAT probably wouldn’t work in a bank, and I don’t speak the same language to our developers that I do to our call centre agents or finance people.

A central theme with a strong message is essential, but it has to be varied according to the target audience, and that theme must be consistently and constantly reinforced through the widest range of media that you can efficiently manage.

Divide the program into manageable chunks, put a clear objective around what each chunk is trying to achieve and find a way to measure its success. You’ll soon know what’s working and what isn’t, then its rinse and repeat. “

To summarise, I think we as an industry need to appreciate that what may have worked in the past doesn’t work in the present and definitely won’t work in the future. In fact I think we should ditch the term information security awareness and call it security culture.