PeepSec 2019

Earlier this week I went across to Level 39 after I was invited by CybSafe to be a speaker at their annual online summit, PeepSec. The summit is focussed around opportunities and issues concerning people and technology.

They had some excellent speakers that I was humbled to be alongside. Here's the link to the main PeepSec page and a link to my interview with Oz Alashe and Sam Oliver.

Restricted Intelligence Blog Series

I've known the good folk at Restricted Intelligence for a while now, I was in their offices recently as they had invited me in to provide a consultants perspective around information security awareness programmes.

During the visit they asked if I would write a blog series with some tips on how to increase the chances of running a perfect security awareness campaign.

Here are the links to the posts:

Part 1 - Understand your environment

Part 2 - Trust issues

Part 3 - Is you platform ready

SANS European Security Awareness Summit

Last week, I had the privilege of presenting along Denise Beardon (Head of Information Security Engagement at Pinsent Masons) at the SANS European Security Awareness Summit.

Towards the end of 2017 Christian Toon (CISO at Pinsent Masons) asked if I could come onboard as an interim consultant to kick-start their information security engagement stream of work whilst he was searching for a permanent member of staff.

That permanent member of staff turned out to be Denise, we got along like a house on fire and together ran a firm wide security culture study to establish a baseline to measure behavioural change; the premise being that any security awareness, behaviour and culture programme must be built on solid foundations.

At the time I don't believe any other law firm in the UK had developed and run anything similar.

Denise and I got talking and decided we should do a talk together and the most obvious place was the Summit, so we submitted and were accepted!

This is a direct link to our presentation:

"Establishing a Baseline to Measure Behavioural Change"

Here's the link the landing page for the Summit archives

IISP Talking Head Piece - Security Culture

Over the last few years the discussion around security culture has come to the fore and having worked in and around this area for a while I welcome it; particularly when, one of the simplest ways to reduce risk to organisations is to have a security conscious workforce.

However, it is not as simple as proclaiming that you’re going to run a phishing or a digital footprints campaign and be done with it. As with everything in life there are fundamental activities that one need to address before just jumping into things. Here are a few recommendations to keep in mind when building your security culture programme:

Trust and Branding – How is your security function perceived across the business, do you have good levels of engagement or are you seen as the “department of no”? If the security function is not recognised as a trusted brand then you are building on poor foundations. A simple way to do this is (within reason) to share security metrics with the organisation e.g. incidents that you protected the business from and even where you failed. It humanises the team and can reap great benefits.

Understand your environment – A key task in your journey to build security culture is to understand existing attitudes and behaviours across your organisation. You cannot attempt to affect change in an environment where you are not sure on how people feel about security on a day-to-day basis.

Plan and run a security culture study. Typically, this is a combination of quantitative and qualitative data e.g. a survey combined with focus groups and one-to-one sessions with a subset of staff. This will provide insight into localised risk, ways of working across departments and inform your plan of activities.

Scaling your security function – Regardless of the size of your organisation, you can scale your security efforts buy establishing a network of individuals to help spread your message. Commonly referred to as champions, these volunteers are immensely powerful when utilised correctly. If you haven’t already thought about building such a network – think about it now!

Targeted and engaging activities

Lets be honest, asking staff to watch a ten-minute video and then do a quiz after it doesn’t work. Of course, they have their place but if your content, activities and campaigns aren’t targeted, engaging and memorable then you are wasting your time.  This is where a security culture study will help you understand what sort of content is best for your environment.

Looking ahead

Naturally, all organisations are different but fundamentally you should be aiming have some sort of alignment these recommendations.

We have to move away from the status quo security approach – we have to be more open, approachable, enabling and agile. Seek to deliver security-as-a-service, this in turn will help to affect a positive and lasting security culture across organisations.

This piece was included in the October 2018 edition of the IISP's Pulse magazine.

Smashing the Stack but for None of the Fun or Profit: The Importance of Wellbeing

I’ve been meaning to write about this topic for a while and have finally found some time. It’s an important one, why?

Well, because it is about our wellbeing. Most of you will know about the paper that Aleph One wrote back in 1996 entitled “Smashing the Stack for Fun and Profit”. That was about stack buffer overflow vulnerabilities and how to exploit them.

However, I’m not talking about that stack. I’m talking about the real stack, our minds and bodies and how we need to look after them...a tenuous analogy but hey it’s allowable right? :) 

Why I think this is important, a personal journey.

Information Security / Cyber Security or whatever we wish to call it today has never been a 9-5 role, no matter what anyone’s contract says and most people in this field genuinely enjoy their work; sometimes time flies! Whilst this can be a good thing, in that, we really are into it and will work long hours, weekends or even holidays (guilty), if we don’t manage ourselves carefully it can begin to have a detrimental effect.

A while back I was working in a role where I was the security resource on more than twenty projects. Over half of those were high profile and at least one had a national media campaign attached to it and all the jazz that goes with that sort of thing.

It was one of those roles where I was here, there and everywhere. You know, the one where everyday you feel like you’re in a pinball machine. At the time I came up with the phrase - the calendar games. That’s another topic altogether but think…all projects are important…except some are more important than others. 

To all the newbies...navigating organisational politics is a skill you need to pick up fast, especially in our field. No one wants to hear “Well infosec signed it off!” when the fish hits the tan. Been there. Badness. Not good!

Anywaaaayyy…

To say that I ran myself ragged was a bit of an understatement; at the end of that role I was mentally exhausted. I made a lot of personal mistakes during that time, namely:

• Forgot to switch off - I was always on and thinking about work even at home. When I was relaxing, work issues started to creep into my mind and the next thing I knew I had the laptop out.

• As a consequence of not switching off I didn’t get enough sleep. Which led to not eating properly because I wanted to be in the office extra early “to get ahead of things”.

• I stopped taking my morning walks and I didn’t take enough breaks during the day.

The work was interesting and I was absorbed. However, by the end of it I looked back and thought “man I can’t work like that again!” Not because of what I was actually doing on a daily basis but how I managed myself. How I let go of my usual routine.

In my opinion your personal stack is your mental and physical wellbeing. Over the long term, if you consistently smash away at these and you don’t manage them with the respect they deserve, then you’ll crash. Sometimes in the worst possible way and a reboot might not fix things. Oh and Last Known Good Configurations? Yeh, nope.

I am sponge.

Here’s another tenuous analogy…think of your mind like a sponge. You’ve got to let it loosen up again and be ready for whatever comes next. Now some of you may be thinking…“a sponge wtf are you on about Mo?!?”

Hear me out…

When I’m on a busy, stress-laden piece of work I can get super focussed and with an element of tunnel vision. Like a sponge, soaking everything up, the mind becoming tighter and heavier. If I’m not careful, everything around me can begin to take second place.

Then as the work begins to wind down I slowly return to my normal self, my mind and body returning to its natural form. Relaxed. I find that I have to let my mind be free and loose again so that I can come back refreshed and ready to go.

Look…I know you know what I’m saying so stop smirking!

Ok sponge Mo, I get it. So what’s your routine?

As a visual, these are my fundamentals, where X is my sweet spot:

• Travel - I always feel better for it. If you have the resources you should travel as much as you can. You don’t have to take out months on end; a long weekend away is also good. Even a day trip can help.

• Exercise - Something as simple as a long walk helps a lot. I would like to get back into martial arts; this was more about general fitness and the spiritual side of it rather than anything competitive.

• Creativity - Back in the day I use to while away hours on Fast Tracker 2. However, today the Ableton Push is calling me. I’m still trying to justify the cost and balance it with “Ooh look, another travel option!”

• Hobbies/interests - Building stuff with our hands and having a tangible end result is immensely satisfying, even if it’s something as simple as Lego. I’m planning on getting back into RC models in particular Tamiya and Kyosho, hands up who remembers The Hornet? The act of building the model was always, in some sense, therapeutic for me.

• As I’ve got older, being around green stuff and water helps a lot. If you have a park near you, go for a walk in the mornings. I recommended it.

• Nothing – Yep, sometimes doing nowt, jack all, nada helps you do a lot more. Believe it or not I feel guilty when I’m doing nothing, it’s like we’ve been trained to always be doing something. However, in my experience it is incredibly good for you. Allow yourself a Nothing Day.

Ultimately, you have to allow yourself to rest and rejuvenate or you’ll definitely end up having none of the fun or profit. The profit is your wellbeing and always comes first. It’s the foundation that everything else is built upon - respect it.

Be well, friends.