Welcome to the Cyber Traps podcast.
Today we have a very special episode for you.
I am your host, Jethro Jones.
We will be talking about the Inch 360 conference that took
place in Spokane, Washington.
This conference is a must attend event for cybersecurity folks here in
Spokane, Washington, and it was a great opportunity for me to connect with
cybersecurity folks here in Spokane and learn about a lot of things that are
going on in the world of cybersecurity.
Right now, this episode is one of the sessions from the conference.
I hope you enjoy it.
This session is The Last mile of Security: Security Awareness training trends.
My name's Heather Stratford.
Some of you know me, some of you don't.
Um, I am the founder and CEO of DRIP7.
We are a micro learning platform, uh, for cyber security education.
And, uh, we are headquartered and founded in Spokane, Washington.
So I'm going to ask a lot of questions, and I'm going to
ask you to participate in this.
So this is much more interesting than, than you just sitting there.
So, why do people think cyber security is not their problem?
How many of you have felt like this?
That your leadership, your people, all put their heads in the sand.
By a raise of hands, how many of you have felt this?
I think it's getting better.
I think there's more in the mainstream news and general people who are
not in cyber, all of a sudden are saying, Oh, maybe this is one of
the problems we need to think about.
But this is, I love this picture because I, I, I talk to people and they're like,
Well, it's not going to happen to me.
And I'm like, Why are you putting your head in the sand?
Why do you think it's not going to happen to you?
So, here are some current statistics, and I didn't put what the statistic
is for, so let's think about this.
This is your mental exercise.
11 seconds.
Think about what is 11 seconds.
1.
2%.
What is 1.
2%?
3.
4 billion daily and 8 trillion per year.
Think about what those might be.
Alright, let's go through them.
Every 11 seconds, there is a ransomware attack.
Did you realize it was that common?
Every 11 seconds.
So, when your leadership says, putting their head in the sand,
and says, Oh, it's not going to happen to us, here's a statistic.
Every 11 seconds.
1.
2 percent of all emails that are sent are malicious.
This number has increased.
It used to be less than 1%.
Now it's 1.
2%.
That means if you have a hundred emails coming into your inbox,
how many of them are malicious?
A little over one.
when you think about that, you're blocking.
You're blocking a lot of that coming in, but you're not going to be perfect.
That's the problem.
Cybersecurity is expected to be 100 percent perfect all the time,
and you're not going to be perfect.
So, 3.
4 billion phishing emails are sent daily.
And these are the bad phishing ones.
These aren't the white hats.
These aren't the people saying, hey, learn from this.
These are the bad phishing emails.
3.
4 billion.
And over 8 trillion dollars will be lost to cybercrime this year.
That's the estimate that we will be topping 8 trillion by the end of the year.
That's a huge amount and it keeps going up.
So, first of all, you all have a job.
You all have security in your job because this is a continuing problem
and it's not going to go away.
So, 90 percent of cybercrime is due to human error.
How many of you, by a raise of hands, believe this number?
That's pretty overwhelming.
I do have some people that argue with me and they're like, no, I think it's 95%.
And I'm like, okay, okay, you, you might be right.
but let's just all agree that it's a really large number
and it's, it's the main part.
People are the problem.
I keep telling people cyber security is a people issue.
There's great hardware out there.
There's great firewalls.
I'm not going to name them.
There's great clouds, infrastructures.
I won't name them either, but there's great hardware.
And yes, we do have to get faster, but it is a people problem.
So let's look at this family here.
This family includes young people, it includes middle aged, it includes
older people, this is a family, right?
How is this family going to learn about cybersecurity?
How do they traditionally learn about it?
Trial and error, I heard over here.
In the past, the first people to really start educating in
cybersecurity was the military.
If you served in the military, you were forced to learn it.
You also, then, different types of businesses, if you worked government
or if you worked financial, they started to push this education to you.
So, if you were military or work, you started to get cyber education because of
who you were, what kind of job you had.
Not everybody fits into those.
So now, we have all different types of, of areas that are
starting to address the issue.
School.
So, if you go to a university or college, I'm going to pick on Whitworth over there.
Whitworth now is training their students in cyber education.
They're not the only ones, but they're realizing, Hey, if we give them
laptops and we give them access to things, maybe we should actually tell
them what they can do and can't do.
You have work, colleges, you have K 12.
There are two states in the United States that mandate having K 12 education.
Meaning, down to kindergarten and first grade, they're starting to
learn about privacy and cyber.
Senior centers, financial institutions.
Now this is a newer one, right?
If your credit card, your, uh, information is compromised, financial
institutions are starting to say, Hey, how can I better train our people?
How can I help not make this happen?
And then volunteer organizations.
I know working with DRIP 7, we're working with some national non profits.
Why?
Because they have all these volunteers who are touching their systems.
Well, you better tell 'em what to do and what not to do, right?
So all of a sudden we have more places because it's a continuing problem.
So 38% increase in 2022, which is the last year, we have complete information for.
38 percent increase globally in cyberattacks.
Now, I speak a lot, and I've pulled this data year after year,
and it's been interesting to see how it's shifted and changed.
What industry or what sector do you not see in that top five list?
And this is in order.
Number one is education and research.
In 2022, they were the most hit sector.
Government and Military was second, Healthcare was third, Communications
was fourth, and the Internet Service Providers were fifth on the list.
Now who is not up there?
Financial and Banking.
Why?
Much harder target.
That's exactly right.
They've been on the top five list for years, and they're finally being
pushed off the top five list because they spend, defend, and train.
So these other sectors, like education, government, healthcare, communications,
they have to catch up, and they have to catch up on the people side.
You know, a Fortinet firewall can only go so far if you hand somebody
your credentials and your password.
So, who at work is targeted?
Sometimes I think we think that it's just a very small segment.
Oh, it might just be accounting.
Maybe accounting is just targeted.
New hires are targeted because they don't know the system very well.
They don't know what to do and what not to do.
Mid level people, they're targeted.
IT staff, who in this room has been targeted specifically, spearfishing,
by, by, uh, a phishing attack.
It's because you have credentials.
HR staff.
Why would HR staff be spear phished and specifically targeted?
PII.
Exactly.
They have access and keys to all kinds of data.
W2s, etc.
Vendors.
Contractors.
And your C suite.
The attack might not be the same, but they're all targeted.
So, once again, 90 percent of cybercrime is due to human error.
So what are we going to do to change that?
What are the trends in the industry that are trying to fix this?
This is a problem that I've been working on for a long time.
I love this picture.
I looked hard to find a picture that It's like, yes.
What's changing in the cyber security industry?
When I talk to people about cyber security education, some of them say, give me
something better, because my people say they want to poke their eyes out.
I'm like, really?
People, they have a hate for it.
They're like, oh my gosh, don't make me do that again.
Some of you are laughing.
So, what's changing that it's not this person sleeping on the computer?
Here's one of the changes.
A once a year training for your employees does not work.
Now, intuitively, we know this.
It's still the most common practice.
Hey, I trained.
You know, Riley's sitting right here.
I gave Riley that training on onboarding three years ago.
Or, I gave Riley that training last January.
How come he doesn't remember, right?
So, it's human to forget, and it's called the Ebenhauser Forgetting
Curve, and that's just, uh, the person who discovered it, and a lot
of research has been built on it.
But it basically, it says, all of you sitting in this room who are
listening to me already have tuned out.
Now I'm trying to keep your attention by moving around and changing my voice,
and I'm really, really trying, but half of you have already tuned out.
So, this is what it says.
If all of you pay attention for a full hour, and then you walk out of this
room, you will retain less than 50%, you will retain about 40 percent of that
content if somebody asks you to tell you what was said just one hour later.
If you go out a full 30 days, a full month, and I go over to Riley
and I say, Riley, what did I say?
He's going to remember this much, about less than 20%.
Now, how do you change that statistic?
And the way you do it is by it's more.
You have to have more interaction.
You have to see it more than once.
I know I can't remember a phone number if I am told it
once I will never remember it.
I have to say it over and over and over again in my head.
Our brains are just not hardwired to hear something once and get it.
So, when it comes to cybersecurity, it's the same thing.
The goal is not to check a box.
The goal is how do you get people to do something different
and actually change behavior.
So, first of all, they have to remember it.
They have to enhance their decision making and they have to use it in real life.
Only by doing that are they going to change their behavior.
Makes sense, doesn't it?
But only a small amount of companies right now are doing it, and
yet they're seeing the results.
They're seeing the behavior change.
So different generations work differently.
How many in this room hit the baby boomer generation?
Who's gonna raise their hand?
Okay, a couple of you.
How many are Gen Xers?
I'm a Gen X, okay?
How many are Millennials?
Okay, and Gen Z.
Any Gen Z's?
Okay, good.
Each generation is interacting with our technology differently.
Baby boomers want to sit down, have, have a lecture, they want to go
through, they want to know their, what they're supposed to cover.
They want it in a traditional format, and they're used to it, and they like it.
You get to a millennial and they're like, ugh, roll their eyes,
like, why do we have to do this?
They do things differently.
there are 71 million millennials in the U.
S.
workforce.
35 percent of the U.
S.
workforce are the millennials.
They are the largest sector.
And you've all heard of the great resignation and trying to hire
people and people just won't stick.
This is one of the reasons.
Because we're not adapting to how the new generation is doing things.
So, Millennials and Gen Z workers find micro learning works for
them and that's what they want.
So, how do we take cyber security education and pull it into
the world of what most of our employer, employees are made of?
They're younger, they're more techie, they want it in TikTok format.
Now you're laughing, you're like, oh my gosh, right?
They want it short.
So, short training sessions are better.
This is what the statistics say.
The statistics say, if you're listening to something for longer than six
minutes, you're sitting at your computer, you're watching a video, if it's longer
than six minutes, you start to lose interest and your attention just drops.
At six to nine minutes, learners become less engaged, unless
highly, highly motivated.
And then at nine to ten minutes They start to think about,
when am I getting off of work?
What am I eating for dinner?
Am I going to work out with someone?
Right?
They start going somewhere else.
So if you are not capturing them, you are not training them in skills development.
So, the new trends, gamification, and microlearning, because it hits what
the new learners are looking for.
So what does gamification mean?
It's kind of a fancy word.
I have people who I talk to and they're like, Oh, you made a game?
I'm like, yeah, yeah, not a first person shooter game.
Like, that is not what I'm talking about when I say gamification.
What gamification means is avatars, badges, rewards, leaderboards,
um, things that are going to engage a learner and reward them.
Now, some of you are rolling your eyes, I can already see it.
You're like, oh my gosh, I've got to reward them for doing
what I'm paying them to do.
And the answer is yes, they want a reward.
They want a gold star.
So, you need to put a gold star next to their name saying, Hey Riley,
thanks for doing your training.
You get a gold star.
And Riley's gonna be like, oh man, I got a gold star.
I should do my training more often.
Okay, so why gamification is surging?
These are three statistics that I think stand out.
They're pretty incredible.
90 percent of employees say gamification makes them.
More productive at work.
Let's say even half of that's true.
Let's take 50 percent of that, 45%, right?
Maybe some of them are just buttering up, right?
That's a huge number.
They're like, yeah, that'll make me more productive.
Okay, 60 percent average engagement increase with the gamification work
experience and then 72 percent of people say gamification Motivates them to do
their tasks and work harder on the job.
Those are pretty staggering numbers so Do you train for each job role?
Here's another trend currently in the cyber security awareness space.
It's not that I, as an administrator, am going to push out the
same training to all of you.
You all are not the same.
I've got this section over here.
You're IT.
I push training to you and you're like, That's wrong.
How come this is said that way?
No, I don't agree with this.
You guys are going to argue with me on every question.
This section in the middle, you guys are accounting.
You're going to get hit in a very different way.
And then I have people over here, you're all.
New.
And you're like, training?
Why should we do training?
Right?
So, the question is, are you currently pushing the same training
to every employee in your company?
Or are you staggering it and making it job role specific?
When you make it specific, people pay more attention.
Nothing is worse than being required to take training
that you know is not for you.
Right?
I know people, healthcare system, teachers who are like, oh my gosh, I had to, I was
required to take three hours of bloodborne pathogens and I'm an accountant.
And they hate it.
So make sure it lines up.
Train.
Specifically for their roles.
Now, some of you are going to say, Oh my gosh, that takes work.
And it's like, it doesn't, because there are solutions out
there that are job role specific.
here's a question.
Does phishing employees work?
Okay, so I have up here, he said, if it didn't, we wouldn't do it.
Okay, so how many of you, I'm going to say yes it works, no it doesn't.
So, first yes, does it work?
Okay, does it not work?
It depends on how it's done.
And here's, here's the question that I put up here.
For phishing to work, training needs to be tied directly to it.
So if I push a training out here to Bill, And I push a phish to him and he
fails it and then three months later I put him in a group to learn about
phishing Is that going to help him learn?
No.
Because it's not tied to the training.
So, a lot of times fake fishing goes out and it's like, well we got a metric.
20 of the people failed.
I'm like, okay, well what'd you do about it?
Did you tell them right there on the spot?
So, thinking about how do you train and use it as an actual training experience.
So these are three different types of fishes that go out.
And also, I was just having this conversation with Mike over there,
where we were talking about it's almost like companies are afraid to fail.
They're like, oh, I want our phishing number to come back as zero.
I'm like, well, what good is that?
If you say, this is a phish, don't click, of course they're
not going to click, right?
If you make it so obvious, I mean, you're not trading them
if you make it too obvious.
You're not trading them if you make it so outside their realm that it's not real.
so training needs to be fluid.
This is another trend within the cybersecurity awareness space right now.
Fluid.
What does fluid mean?
Fluid means when you see something, let's say you have an attack coming in, you can
immediately turn around and train on it.
Now it seems pretty simple, right?
Hey, we see something, let's train on this.
Most companies are not set up to be fluid.
They're set up to say, hey, add that to our onboarding for next year, right?
and Brant brought this out in the panel, we have to get faster.
We cannot sit around and wait for the next reiteration of our training
to catch up to the current attack.
one of the things you can ask your cyber security awareness.
Person is, are we fluid?
Can we push out content when we see things?
Can we be adaptive?
Because it helps.
So what kinds of training should I train on?
Many people ask me, they're like, okay, so what, what should be in this list?
Let's go through a couple of things that should be in your, your training.
This I love, you've probably seen a different type of chart like
this, where it's for passwords.
When you tell somebody, and I'm going to pick on Kim over here.
If I tell Kim, hey Kim, you need to have a secure password.
Kim's looking at me, and maybe she's not in IT, she goes, What does that mean?
Like, Oh, I'll add a one to the back of it.
Or, Oh, I'll add an explanation point to it.
Right?
Kim doesn't understand what I'm talking about.
So, if you look at here, number of characters, if I go down to, let's say,
ten characters, and I go across, and I include numbers, lowercase letters, and
upper, I'm at one month to crack that.
If I just add two or three more digits to this, if I go down to 14, and I go
across to upper and lower case letters, and numbers, I'm at 800, 000 years.
Now that's random.
That's saying it's random, and most of us put, you know, known words in.
but the number is exponentially harder to crack.
Like, it, it's just, it goes off the charts.
So, when I talk to people, I'm like, Kim, hey, you have a ten, ten digit password.
You need to make it fifteen digits.
Kim gets that.
And if you show her why, Kim's like, oh, well that makes sense, I know why.
So, you need to train, and you need to help explain why.
Alright, you also can train on things that are a little more technical, like OWASP.
So many of you know this, but, Mark created this in 2001, uh, Mark.
Ker fee, I think that's how you pronounce it, and OWASP is an international
organization now, and it stands for Open Web Application Security Project.
Now, why I put this up here is because if you have technical staff,
you want to be training on this.
From 2017 to 2021, There were changes in the OWASP top 10 and what they're seeing.
Things were added, like for example, down here on the bottom, server side request
forgery is one of the new top 10 areas.
Have you trained your IT staff on that yet?
If you haven't, this is one of those areas that you can do training with.
Okay, third, ransomware attack.
if you were to pick a random person in your organization, Just a regular
employee, not an IT employee.
And they had a ransomware screen hit their computer.
Do they know what to do?
Raise your hand if you think your random employee knows what to do.
They don't.
They're going to freak out.
Many of them are not going to tell you because they're afraid
they did something wrong.
They're going to reboot.
Thank you, Brandt.
Yes, they're going to lose the forensic evidence because they don't
know not to turn off their and un, not reboot their computer, right?
So train them.
So this is one of those areas you can say, this could happen.
If it did happen, here are the three things I want
everybody to know what to do.
So, three different areas that you can train your employees on.
So, you want to nurture skills development.
You want to make sure you're covering everything from physical
security, mobile and home computing.
Many people, if you ask a general employee in your company, do you have
a password on your router at home?
They'd be like, oh.
Routers all have passwords, right?
So, so you have to train them.
Social engineering, phishing, passwords, privacy, and current trends.
These are some others over on the other side.
Piggybacking, cloud computing, uh, data classification.
These are all areas to train on.
So, I want a raise of hand for somebody to tell me what this number is.
What percentage of cybercrime is due to human error?
Go ahead in the back.
Ninety percent.
Thank you.
Now why did he remember that?
Why?
Go ahead, Nolan.
Why did he remember it?
It's written on the bottom.
because he's cheating.
Okay.
He must have really, really good eyes.
Okay.
Why did he remember?
It's been less than an hour.
I said it, so you heard it, said it, and he saw it multiple times, right?
So when you train, he's going to remember that.
So in a month, if I ask him, what did Heather talk about?
He's going to be like, Oh, I remember 90 percent of.
Cybercrime is due to human error.
It's the one thing he's going to remember because it was said multiple times.
That's what microlearning is.
So, train your employees in cyber security.
If you feel your employees are not valuable enough to train, you should
rethink having those employees.
Training will reduce cyber risk.
You need to train not just yearly, but weekly or daily.
Training should adapt to changes.
When you see it, you should be able to turn around and train on it.
Training should be engaging and short.
Training should be reward focused and not fear focused.
Thank you.