0:00 Robert And so when employees appreciate how security protects their own lives, behavior changes permanently.
0:23 Brad All right. Welcome, everybody, to another episode of the How Many CTOs Does It Take podcast. I'm Brad Hefta-Gaub, and our regular co-host, Scott Porat, is not here with us today, but we have an exciting guest, Robert Cigiliano. Hope I got that right,
0:37 Robert You
0:37 Brad Robert.
0:37 Robert did. You did.
0:39 Brad And welcome to the podcast. Maybe introduce yourself a little bit, talk a little bit about your background, and then let's get into the conversation about security. security theater versus real security.
0:51 Robert Awesome. Thank you. So me, I am a Boston-based father of two 17-year-old and 20-year-old girls, married 25 years. I've never parked a car in Harvard Yard ever. just
1:07 Brad Ha, ha, ha, ha.
1:07 Robert you know yeah and i've been doing what i do since i was a teen like professionally for about 30 years and truly for about 40 you know i speak for a living i get in front of you know ctos colleagues and employees and so forth and and talk about security awareness which i don't really talk about security awareness i talk about security appreciation which is a little bit different it's actually a higher level level which is better like when i get off the platform you know people always ask me you know so how did you get into this like what are you former fbi cia secret service like are you law enforcement military like how do you know what you know and i tell them literally i am from the streets of boston that's how i got here literally
1:51 Brad Yeah,
1:52 Robert and
1:52 Brad there you go.
1:53 Robert um like for me it all started off when i was like 12 i got mugged in downtown boston That opened me up to predators. At 13, I met a girl who I was, you know, fond of and she was fond of me and she confided in me one day that her mother's boyfriend assaulted her. I didn't know what that meant. I go home and I asked my dad. He explains sexual assault and the birds and the bees in the same conversation when I was 13. Kind of had a profound effect in the way I viewed the world. From that point on, I just kind of embraced. security and what it meant to me and others and what was necessary for people to understand it. And so I gravitated towards professions revolving around security.
2:39 Robert In
2:40 Brad Yeah.
2:40 Robert my mid-20s, I was teaching real estate agents self-defense because in the U.S. Realtors are murdered. I've been doing that ever since. And in the mid 90s to manage my business, I got my first computer in 95, which was an IBM PS1 consultant, which
3:00 Brad There you
3:00 Robert was go. the make and model of a Windows 3.0 with 150 megabyte hard drive. And I had to buy an additional card so I could connect to AOL for dial up. And
3:13 Brad Good
3:14 Robert right,
3:14 Brad times.
3:14 Robert exactly. My machine was a point of sale, you know, as well as, you know, to manage my business. And I got hacked like within the first month of owning that device. And what that meant was I lost thousands of dollars via credit card fraud, you know, and I didn't know what the heck happened to me. You know, I contacted my bank and credit card company. They explained to me. It was a relatively new thing for them too. My business at the time was personal security as it relates to violence and theft prevention in the physical world.
3:47 Brad Yeah, right,
3:48 Robert I was stolen from via my computer over dial-up internet via AOL. I didn't
3:55 Brad right.
3:56 Robert know that that was a thing. And so at the time and still today, my thing has always been reverse engineering the bad guy's motivations. how they choose their victims you know and basically exposing the the predator's motivations right and so when that happened to me I was like devastated because it was thousands of dollars but at the same time I was intrigued like what they did was awful but it was awesome Yeah, and
4:24 Brad a new frontier.
4:25 Robert so I started to explain that to the Realtors you know and who also handle sensitive information And I've been doing that now for 30 plus years. Obviously, it's evolved. I've evolved. The fraud has evolved. But you know what hasn't evolved? The consumer's understanding of risk.
4:45 Brad You're out.
4:45 Robert The employees today are no more advanced today, arguably, than they were 30 years ago. The most common questions that I get today when I'm on the platform, the CTOs. co-workers is How do I know what link is okay to click when I
5:04 Brad Yeah.
5:04 Robert do a Google search?
5:05 Brad Yeah, totally.
5:06 Robert That's where they're at. So that's me. That's where I come from. That's my background. And we'll also tell a bit about my perspective as we go on.
5:14 Brad Yeah. I mean, it's obviously a very interesting kind of the path that you led to get here. It makes sense that you were kind of like, as you said, you know, formed on the mean streets of Boston. I don't know, you might not have said the means. mean streets
5:26 Robert Main
5:27 Brad but i add
5:27 Robert streets
5:27 Brad i
5:27 Robert of Boston.
5:28 Brad might add it that part so
5:30 Robert Nope, it's yeah
5:32 Brad one of the things that as a cto obviously a lot of times you're like oh you know what's your latest you know what is your organization's sock2 compliant what are you are you you know are you HIPAA compliant um and this notion of like you know kind of having our you know employees do some training watch some videos click some button buttons and do some quizzes and then and force them to do that every year if we haven't grown in you know over the 30 years of your career you're it sounds like you're saying like our awareness of what risk really looks like hasn't evolved much what's the point of all this training
6:12 Robert So you said it, you said it best, force them to take this training, but I don't think it needs to be forced. If you do it properly and that's not being done at all, as you and I know it, cybersecurity is what, 30 years old? Like when did John McAfee do his thing back in the day, late 90s, mid 90s, if that, you know, and 30 years maybe. And so our understanding of. security awareness training today is based on those who figured out how to sell and market phishing simulation training about 15 maybe 20 years ago phish me being one of the first companies and
6:58 Brad Yeah.
6:58 Robert they hit the nail on the head they sold no before came about with you know Mitnick in the background or as a you know spokesperson so to speak partner and that's all good it's necessary but It's only solving the problem of phishing. It doesn't really move the needle regarding true human behavior and their worries and their fears and their concerns. And I know this because this is what I do and we can talk about all that. And what's happening right now is what I consider security fatigue, which is caused by the compliance trap. You know, it's bombarding employees with complex and personal rules that trigger security aversion. You know, the
7:38 Brad Yeah
7:38 Robert compliance trap is like this false sense of security felt by meeting the regulatory requirements while the actual human behavior remains unchanged and vulnerable. This is what I see every day. I'm called by the CTOs and CISOs that say, hey, listen, all we want is for our people to care about security. We just want them to care. And that begins with making security personal.
8:03 Brad Hmm.
8:04 Robert to the employee. So my core belief is that all security is personal. So personal security is essentially violence prevention and theft prevention, protecting your person. But what's more personal than protecting your identity, protecting your child's digital footprint, and the core belief that people protect what they love. By teaching someone to secure their child's digital footprint. And their own identity, their own data and dollars, you create more secure employees at work, right? Like that makes total sense to me and it makes total sense to my audiences. When I walk in the room after I am, you know, introduced, I walk into a room of, you know, 100, 200, 500 people doing this. And for those of you who are just listening,
8:51 Robert I'm crossing my arms.
8:53 Brad Shut down.
8:54 Robert yeah they're looking at me with a scowl on their face okay security guy what are you going to tell me that i don't already know i
9:00 Brad Yeah.
9:01 Robert got to get back to work yeah
9:02 Brad Why do I got to listen to this again?
9:03 Robert and this guy who is he you know he's italian he's playing mafia anyways right and so What happens is like I start asking them questions. I engage in a dialogue, which all security training today is a monologue. It's being told what to do. It's do this. Or else, right?
9:26 Brad Yeah.
9:26 Robert And so as I'm asking them questions, like I'm asking very basic questions like, so how many of you like can honestly say that you use a different passcode across all your critical accounts? If I get 15% of the room to raise their hand, that's a lot. Okay.
9:44 Brad Yeah.
9:44 Robert And this is in a corporate setting. Okay. So in their personal lives, they're using all the same passcodes, 85% or more. Right. And studies show that as many as 94% of all passwords are basically the same, you know. And then the next question is like, how many of you are using two-factor authentication in both your personal and professional email and in all your critical accounts? If I get 20%, it's usually a little bit more because it's required more often. That's a lot. So that means 80% are not using two-factor authentication. Okay. So 80 to 90% of employees are engaged in the worst of the worst, not using two-factor authentication, using the same passcode across multiple accounts.
10:26 Brad Yeah.
10:26 Robert Okay. And then I go on to show them, I show them, okay, 15 billion passwords, usernames. usernames and passcodes minimum passwords are on the dark web and show them the examples and i take them online and show them email addresses and how many people using one two three four five six as a passcode and they're and they see like millions and millions and millions of people using password as a password and they're like oh that's why i was supposed to change up our passcodes and i begin to drill it into their heads like this is the risks that we're all facing right now this is why We're so screwed, you know, and and they begin to see like for their own lives why this is now something that they want to deal with. OK, and what happens is as I'm explaining all this to them.
11:11 Robert The faces start to kind of loosen up. Their eyes begin to open wider a little bit, which shows me that they're interested in what I have to say. Now they're curious. And as the arms kind of go down by their side or by their lap, the hands begin to go up and now they have questions because now it's becoming interactive. Now they're like, oh, this is about me. This is about my security. This is about. This is about protecting my information. Oh, I didn't know it was going to be like this. Now I'm interested because I've never had an opportunity to talk to somebody who understands the stuff that I've always wondered about that no one's ever really explained to me, including. their CTO, including their CISO, who hasn't taken the time because they're just fatigued themselves.
11:58 Robert They're not getting the budgets they need. They're overwhelmed themselves. They're herding cats, you know, and they're really just not getting the respect they deserve, to be frank. And like in the end, like they don't have time to, you know, explain to the employee for the 100th time why that email that looks like it's coming from Amazon isn't coming from Amazon. I. I get that. But there's a way to go about it where you engage the human, the employee who's dealing with all of these issues that they don't have the answers to in a way that they begin to understand risk.
12:32 Brad It's so interesting. I mean, everything you're saying resonates, you know, it makes a ton of sense. And I part of me wonders if not just that there's security fatigue, but maybe almost like. security nihilism or something like every week I get some you know paper paper letter you know to the house that says there's been a security breach and your you know information was lost by a third-party data provider etc and I wonder are how do we how do we combat that notion that that some I think some people have of like Look, it's just, it's all going to get hacked anyway. Just deal with it.
13:14 Robert So that comes down to fatalism, right?
13:17 Brad Yep.
13:17 Robert But there's a few other factors that precede that. And so from, you know, your point of view, my point of view, that makes total sense. But there's other biological issues that humans have that where we resist security, okay? And security is truly resisted. And it's resisted due to the fact that it's not natural and it's not normal. And what does that actually mean? Okay, so over 30 plus years, 40 to be realistic, I've come to the conclusion that we all suffer from what I call, and I don't know if suffers the right word, but we all are engaged in what I call the human blind spot.
13:51 Brad Mm-hmm.
13:52 Robert The human blind spot is the psychological and truly biological instinct to trust what's familiar to us.
14:00 Brad Sure.
14:01 Robert And ultimately, it is that cognitive gap where biological trust overrides digital suspicion, leaving the door wide open to all kinds of fraud, AI-enhanced deception, whatever, right? The biological default to trust and psychological shortcuts are the heuristics that criminals use to bypass human logic, okay?
14:19 Brad Sure. Totally.
14:21 Robert Biological impulse versus intellectual understanding. It's that internal conflict between... between our evolved survival instincts and our modern knowledge or lack of knowledge of digital risk. And this is due to the fact that we are what is considered an interdependent species.
14:40 Brad Sure, totally.
14:41 Robert Okay, and what does that mean? It means that we are dependent upon each other for our survival. We would not survive without each other at all. We require each other at a minimum to procreate. Okay, and the basis of that. is that we need to trust each other.
14:56 Brad Yeah.
14:56 Robert That is our foundation. That is fundamental to being a human being. I need to trust. You need to trust me.
15:03 Brad Okay. Totally.
15:04 Robert And so with that, the people that we correspond with in person, the phone calls, emails, and text message we get, we want to believe that the person on the other end is worthy of our trust, that they have our best interests. And so throughout the day, week, month, our lives, we give. Give the benefit of the doubt. And
15:21 Brad Totally.
15:22 Robert so if we're trusting all day, every day, and we're saying once a year, okay, this is what phishing looks like.
15:28 Brad Right. Totally.
15:29 Robert Pay attention to this. Therefore, you will be good. And if you don't pass, you are fired. That's not how you train security.
15:35 Brad Yeah.
15:36 Robert You train on explaining, listen, we trust by default. Let's start with that. Here's why security goes against our core beliefs because we trust by default. fault. And then there's other issues, myths, cultural myths on top of this that have been built over a lifetime. So as I'm asking the questions, passwords, two-factor authentication, next question is, how many of you lock the doors to your home?
16:02 Brad Yeah.
16:02 Robert If I get 60%, 70%, that's a lot. Most
16:07 Brad Oh, interesting.
16:08 Robert of the time it's a lot less than that depending on the part of the country that I'm in, right?
16:11 Brad Yeah, yeah, totally. I think that's a, I've always noticed that as sort of like a urban rural divide kind of and a generational divide.
16:19 Robert Totally, totally, 100%, right? I talk to Realtors all the time and they say we have often we sell houses the homeowner doesn't even know where the keys are. They haven't locked the door since they own the house.
16:30 Brad Oh, I lock my front door every day. But I do have a key underneath the welcome mat.
16:35 Robert Yeah. Yeah. And so as I'm asking these questions, I say, well, did you know that like every year in the US there's between 1.5 and 2 million homes that are burglarized, which means like in the next decade, that's like 15 to 20 million homes burglarized in the next 10 years. Right. And then I go on to say, like, I ask questions like, okay, so how many of you have a home security system? And if I get 15% of the room to raise their hand, that's a lot. Okay.
17:02 Brad Yeah.
17:03 Robert And then I say, okay, so why don't you have a home security system? Like, give me some reasons why, like, what's your, what's your rationale? And so the common answers are, well, we don't have a home security system because we have insurance, as if insurance is going to protect you from a predator at 3 a.m., you know, not
17:19 Brad Right. Or,
17:20 Robert well not well thought out.
17:21 Brad yeah.
17:21 Robert Right. And then the next answer is, oh, well, we don't have a home security system because my husband says if they're going to break in, they're going to break in. There's not much we can do to prevent it.
17:30 Brad Yeah, I think that's a common, that's a common belief, right? Like, and even in the digital space, I would think that's a common. common belief.
17:36 Robert Yeah.
17:36 Brad That's essentially the fatalism I just mentioned earlier.
17:38 Robert Fatalism, man. Fatalism sucks. Okay.
17:40 Brad Yeah.
17:40 Robert But it's a human trait that people grab onto. And you know why they grab onto it? Because it justifies why I don't need security in their lives. Okay.
17:51 Brad Yeah.
17:51 Robert It's awful what it does. But here's the clincher. I asked them, okay, so tell me again, like what other reasons do you not have a home security system? The most common answer, we don't have a home security system because I don't want to live like that.
18:08 Brad Yeah, interesting.
18:09 Robert And I say, well, what does that actually mean? What does that truly mean? And they say, well, I don't want this constant reminder. That my house can be broken into I just want to I just I don't want to have to worry I just want to be free of all of that
18:24 Brad So these are some pretty fun. Like, I agree with you, Robert, that there's some fundamental aspects of human beings like we're interdependent as a species. We also have these heuristic biases that we easily fall into, you know, where, you know, like confirmation bias, et cetera, you know, so easy. Once you're raising the awareness, you're engaging with your customers in this notion of like I'm going to really I'm not that regular security guy. I'm here to talk to you about to really connect with you about so you can understand this. How once you got their attention, how do you help them break through these these kind of innate characteristics of the way that we operate as humans? I mean, it sounds like a pretty big hill to climb.
19:09 Robert So it's actually pretty easy. But the biggest hill to climb to get over is the fact that when I ask them that question about, well, you know, why don't you have that home security system? And they say, I want to live like that. My next question to them is, okay, so I'm a guy and this is actually true that has. 20 security cameras 20 plus security cameras in my home like outside and inside in total I've got 20 plus security cameras and and here's the clincher right and I said so so what does that say about what what might you think about me as a human like if you don't really know what I do for a living let's just say like you hit this guy's got 20 plus security cameras what might that say about my disposition my outlook like my world view you
19:57 Robert you like I wake up every day 22 security cameras this guy must be what paranoid
20:01 Brad Paranoid. Yeah.
20:04 Robert so so now we're getting somewhere okay and when I ask that question the whole room goes paranoid and they laugh like it's funny right and here's the issue with that we as a culture as a society we directly correlate security in paranoia
20:25 Brad Oh, interesting. What is paranoia? Paranoia is a mental health disease. It is the false belief that people are out to get you. Right.
20:35 Robert That you truly believe that people are bugging your house, that the government is putting cameras inside of you or whatever. They've implanted a chip in your body. I have a first cousin who suffers from this disease. She
20:48 Brad Yeah.
20:48 Robert truly believes that the government has planted a chip inside of her. She's currently, I believe, living in her car because it's the only place that she feels safe. Do you understand?
20:58 Brad Yeah.
20:59 Robert That's what paranoia is.
21:01 Brad We as a culture correlate paranoia, I don't want to live like that. I want to be free. I don't want to have to worry as security, as paranoia.
21:12 Robert Yeah.
21:12 Brad You've got to break down the employees' cultural views of what security is and isn't before you can get them to drink the Kool-Aid of what security actually truly is. And Yeah.
21:27 Robert that's an easy thing to do once we're all on the same page. But the page that we're on right now is that security is a bad thing.
21:37 Brad Yeah, right. So I mean, when I think about the difference between being security minded and being paranoid, you sort of said the definition of paranoia is this belief that, you know, everyone's out to get you, right, or something like that. And I get is part of the answer here to say, well, it's not that everyone is out to get you. Most of us are trusting people and trustworthy people. But there's enough people out there that are out to get you. That you need to you need to you need to be aware of it
22:06 Robert Exactly. And fishing simulation training doesn't do any of that stuff. And so what I explain is, first and foremost, like the likelihood of something bad ever happening to you is actually kind of slim, but there's a chance. And like similarly to like the fact that you put a seatbelt on because it's the smart thing to do.
22:24 Brad Right.
22:24 Robert You don't like put a seatbelt on because you're afraid or you worry or that you're paranoid. You put it on because it's a tool.
22:31 Brad that gives you control and
22:33 Robert Yeah
22:33 Brad all of these various tools that we have at our fingertips that are available to us are just about that about you know having one up on the bad guy becoming a tougher target doing some very basic things that make you a harder target and once they start to understand what security actually is versus what it isn't it's actually not a very difficult hill to climb
22:56 Robert but you've got to get to that point first and foremost and no security training at all does that other
23:05 Brad Yeah.
23:05 Robert than mine to be frankly with
23:07 Brad i Yeah.
23:07 Robert mean to be honest nobody
23:09 Brad Yeah. Right.
23:09 Robert does that nobody does that and primarily due to the fact that they don't come from a personal security background
23:18 Brad Yeah, right.
23:19 Robert Everybody teaching it is coming from a tech background and they're speaking tech. Do this, don't do that or else. It's all compliance based. It's not personal security based. And if you're coming from that perspective, like I come from a perspective that I got a 17 year old and 20 year old girls. How many times do you think that I've sat them down and talked about sexual assault and these are the uncomfortable conversations that I don't know that many people have with their daughter. And I think that's a conversation that you need to have with your daughter and with your son who
23:49 Brad Yeah, totally.
23:49 Robert perpetrates the crime, right? And these are uncomfortable conversations that we should be having in our lives with the people that we love. And these are the types of conversations that we need to be having with our co-workers. who we're responsible for who need to be part of the solution versus part of the problem and
24:07 Brad Right.
24:07 Robert nobody's doing that because they don't know how to
24:09 Brad If I could kind of play this back, what I hear you saying is there's also this sort of like because we're built to trust, because we're an interdependent species, because we have these typical heuristic traps that we fall into with our thinking and one of those heuristic traps is. We are built to avoid difficult conversations, right? This is this is like humans, humans, you know, would prefer to ignore the existence of the potential risk than to actually confront it and talk about it. And that's just kind of, again, like to your point, that's kind of how we're built. Yeah. And so. I think what I hear you saying is a big part of this is get out of the security theater, the compliance theater, get out of that mode of just checking the box and get into the mode of having a real conversation about the potential risks that come,
25:03 Brad whether those be physical or digital, but certainly when you're a CTO or a CISO and you're trying to protect a tech oriented company.
25:11 Robert You know, you have both those things, you have both physical and digital risk factors involved. And just even having that conversation is hard for leaders to do.
25:22 Brad Yeah. Look at you kind of said it like in so many words that humans move away from pain. Yeah, And we move towards pleasure, which
25:32 Robert or avoiding pain for sure.
25:35 Brad is a form of denial,
25:37 Robert okay? Yeah, totally.
25:38 Brad You know, like when you are watching the six o'clock news and something tragic happens in a neighborhood somewhere, something bad happens to the neighbors, right? And the local news team comes in with a camera man, a reporter, and they grab the neighbor and they knock on her door and she comes out and they start asking questions. What does the neighbor always say about what happened?
25:58 Robert Oh, this doesn't ever happen in our neighborhood or something like
26:01 Brad Yeah,
26:01 Robert that.
26:01 Brad yeah, they're going to say it tonight somewhere. Every night, every single night, they all say the same
26:07 Robert thing. So surprised it happened in
26:08 Brad my Yeah,
26:08 Robert neighborhood.
26:09 Brad they're always so surprised because nobody ever wants to think or believe that these things can happen here. Nobody ever does. And because that's what we prefer. Look, denial is wonderful. Yeah. It allows us to function in a world that is on fire. It allows us to get along and avoid threats and stress and anxiety. It's great. It's our comfort, but it's not effective.
26:40 Robert When it comes to security at all,
26:42 Brad One of the things you've already kind of mentioned is this notion of these kind of these heuristic traps that we have as humans. And I assume that one of the things you were going to mention, but I'm kind of curious if I'm reading this correctly, is that perpetrators or predators, attackers are also know how we as humans, you know, respond to things. And
27:03 Robert they're
27:03 Brad so
27:03 Robert experts.
27:03 Brad they're
27:04 Robert They're experts.
27:04 Brad experts at it. at the what's what's one of the classic phishing scams is the spoofed email header to be from a figure authority figure that is your you know your boss right so now you're getting an email that comes from your boss or it looks like it's coming from your boss and it's the quick you know conversational oh hey can you just help me out real quick I left my laptop you know in the office can you go ahead and log into the bank account and quickly you know wire me a thousand bucks or whatever you know these types of common traps i think most of us aren't aware of the heuristic traps that that we are running by default so
27:43 Robert Right.
27:43 Brad do you how do you do you once you've got the attention once you've got people saying yes i want to think about security differently do you also feel like you need to teach kind of people what the what the traps we all fall for are or or
27:57 Robert Or sort of the cognitive traps that we have.
28:00 Brad Of course, yeah. And that becomes much easier once again, we're all drinking the security Kool-Aid. Once we're all on the same page, once we agree that security is a good thing, that yeah, it can happen to me, it's unlikely to happen to me, but if and when it does, I become, I have a level of awareness now of security appreciation that I can kind of see it coming. Right. And in this process, talking about those predators, essentially, I explain right prior to getting to the do this, don't do that. These are all the methodologies of the bad actors. As I explain how that 97% of all the people they're ever going to meet in the course of your life, 97% are good.
28:47 Brad that they're essentially worthy of your trust that these are people that like essentially have a good heart right and occasionally like that 97 they lie occasionally occasionally they you know have bad intentions they deceive occasionally right but but in general they're good people and you can pretty much trust them and how like truly and you could do your own research and it's true that About 3% of women and as much as 6% of men, we're talking worldwide, medical communities would call them antisocial personality disorders, that these are truly the sociopaths and psychopaths in our lives. These are the men and women that...
29:25 Robert do not experience empathy sympathy guilt or remorse that they are the ones that truly have no shame and that they would be just as happy to see your mother or father homeless and they've taken all their money you
29:38 Brad Yeah.
29:38 Robert know and you know and people ask me all the time like you know you know like You know, like why is why how come these bad guys, like, why don't they just take what they know and they can cure cancer? And I'm like, they could care less about curing cancer.
29:53 Brad Yep.
29:53 Robert They don't care about anybody but themselves. They are the wolves. We are the rabbits. They are the lions. We are the gazelles. Right. And as and as they begin to kind of sit back in their chair and they begin to like realize, OK, like this is real and this is something like that I can actually do.
30:10 Brad This is something that's within my capacity. This is something that like I want to understand so I can protect myself and my loved ones, my
30:18 Robert Yeah.
30:18 Brad child's digital footprint and my identity and my data and my dollars. Okay, now what do I do? And that's when you begin to explain how the bad guys do what they do and how they choose their victims and all the different ruses that they use. And ultimately. The goal is to become what I call the strategic human firewall, right? So we all know what a firewall is, and you are already a strategic human firewall. I am already a strategic human firewall. We already recognize risk. We already look at phone calls and emails and text messages. We already deduce what's right and what's wrong, where the fraud is. is where the hook is. We already see all that stuff because we've been doing it for so long, it's second nature to us.
31:06 Brad But for most people, they want to know, again, what link is okay to click in Google, right?
31:12 Robert Right.
31:13 Brad And so the strategic human firewall is designed to block deception. You know, it's a proactive governance. It's a mindset that turns consumers, citizens, ultimately employees from passive targets which they all are into active detection layers we Right. see we see it coming we we recognize risk it's the shift from by default i just trust i trust what i see i give the benefit of the doubt to i verify everything you know and it leads to what i call security appreciation Okay. So it's the shift from awareness, which is so dead, which is knowing,
31:59 Brad you know, to appreciation, which is caring, Right. which is caring, right? And so when employees appreciate how security protects their own lives, behavior changes permanently. The security appreciation gap essentially is the chasm between an employee's intellectual understanding of risk, which is awareness, and
32:23 Robert Right.
32:23 Brad the emotional commitment to act on that knowledge,
32:26 Robert Yeah.
32:26 Brad which is appreciation. And I call this the kitchen table effect. It's the multiplier effect where successful training ends when the employee is teaching the concepts to their family at home, cementing those lessons for life. So essentially what we're doing is we are. The horse. This type of training is the horse. You know, the all security is personal is the horse. The
32:58 Robert Mm-hmm.
32:58 Brad cart is the fishing simulation training.
33:02 Robert Right. Right.
33:03 Brad The fishing simulation training comes afterwards.
33:06 Robert Right. Sure.
33:07 Brad Now, when they're taking the fishing simulation training, their mind has been rewired.
33:13 Robert They now appreciate the value in the information that they're consuming and they're looking at it as something that they want and know that they need to understand on a personal level first and then
33:24 Brad Yeah.
33:24 Robert they apply it in both their personal and professional lives. It's a whole different ballgame now. Now they begin to look at the email in a whole different light. Which is what security awareness training should be, but it's not at all.
33:43 Brad Right.
33:44 Robert It needs to be security appreciation training.
33:46 Brad Yeah, that makes a ton of sense. I like that. I like that differentiation in that language, you know, awareness. It just means you know about it. appreciation means you care about it yeah
33:56 Robert Yeah.
33:57 Brad um i you know one of the phrases that i've heard um a lot i agree with this statement um i've seen this in the organizations i've gone through as you know an executive leader where um this notion of like the tone at the top is what really makes a huge difference.
34:16 Robert Yeah.
34:17 Brad If the C-suite doesn't have security appreciation, then it's pretty hard to get. You know, the employee, the rank and file to have appreciation. What's your solution to that problem? I mean, is it is it is it more of more of the same like get them get the C-suite to appreciate?
34:35 Robert I'm going to say something that's going to piss some people off. OK, I.
34:39 Brad Wait a second. Hold on a second. A guy raised on the mean streets of Boston is going to say something that might piss some people off. All right. Hold on.
34:49 Robert Go ahead. Just wanted to clear the air there.
34:51 Brad I don't think a lot of security leaders should be in security to begin with at all, because I don't think that they're congruent. I don't think that they truly believe in security. I don't think that many people that are in the business of security believe in security because and I'm going to say something controversial. OK, if you are a security leader and you don't have a credit freeze, I don't know that you should be in security. Yeah.
35:17 Robert If you're a security leader and you don't have a home security system, I don't know that you should be in security.
35:23 Brad Yeah. You're sort of saying it's a it's a life. It needs to be a life philosophy.
35:28 Robert I don't know that you can be in security and not truly live and breathe security. I consider myself a messenger.
35:41 Brad For the message, okay, Yeah. and I truly believe in security. And I don't know that you can teach security unless you truly engage in the process of security as a lifestyle. But let's say you OK, so I love that perspective that that makes a ton of sense. Let's say you OK, so we got some CTOs that listen to this this podcast and let's say they've got that perspective. They are they really are believers. They really appreciate. But their CEO. or the rest of their C-suite doesn't appreciate it. Do you have advice on how to convert the rest of your C-suite to be believers? It's easy.
36:27 Brad Every one of us has, you know, a family member. Let's just say a mom or a dad. or a sister or a brother or a child for that matter who reaches out to them on a regular basis regarding is this real what do i do here we all have somebody in our life that just can't figure out the whole password thing they can't stop clicking links they respond to frigging pop-ups thinking it's apple and it's not apple you Yeah. know like we all have these people in our lives And when I say all, like security leaders have all those people in their lives, all C-suite executives, including the CEO, has those same people in their lives.
37:13 Brad Every single employee that you have has those people in their lives. We all have the same problems. And when you speak to those same problems to the people responsible for your...
37:25 Robert for your budget, to those decision makers that are responsible for giving you the thumbs up and the green light to actually put the horse before the cart, right? You remind them of all the problems that you as a human face in regards to your own family and the stuff that they're doing, and you begin to tell that story because it's true. And now I just can't get my mom to stop, you know.
37:52 Brad buying things on late night TV that she vitamins that she doesn't need and my dad responds to every pop-up and my sister who's widowed is entangled in these romance scams and begin to tell your own story and tell it like reminding them I'm guessing you probably have the same things too and then explain that's our every single employee that we have that's what they're up against
38:17 Robert And
38:17 Brad Yeah.
38:18 Robert they look at security as a bad thing, as it's paranoia and begin to explain what security is and what security isn't and how the entire organization is up against cultural myths and misnomers that aren't moving the needle or the reason why we're having the problem.
38:39 Brad Yeah.
38:39 Robert You know, and the reality of it is like, I don't know that there's ever been a better time to do this or a worse time, depending on your perspective.
38:48 Brad Why do you say that?
38:49 Robert Well, because.
38:51 Brad Like right now with AI and deep fakes and voice cloning. It only took 40 minutes before we got to AI. Good job. We know we're going to get there eventually. So when I say the best time or the worst time, the worst time because frankly, I think I think you're all effed right now. Okay, because the fact that all you're training them on is fishing simulation training and maybe with like we might start introducing deep fakes. and voice cloning sure but like we're so not prepared to deal with risk as as is based on our aversion to security to begin with now with like voice cloning and the phone ringing and it's your daughter screaming in the background what human being is going to be able to overcome that if they don't believe in Yeah, security to begin
39:37 Brad totally. with okay so so there's that right but at the same time The good aspect of it is that like at least for me and my perspective is that the AI and the deep fakes and the voice cloning and everything that goes along with it and the pig butchering and like the money being made and how awesome these criminals are, they're awesome.
39:59 Robert awesome what they do. They're incredible, right? There's never been a better time because that story is so compelling, right? Like right now, you know, this is like the stuff of 007, Minority Report, like Tom Cruise Mission Impossible stuff. It's
40:17 Brad Yeah.
40:17 Robert awesome. This is Hollywood stuff. And I think this is like the perfect opportunity to engage an audience in security appreciation because this is fun. This is interesting. This is way more than cybersecurity. And to be honest, like cybersecurity awareness, cybersecurity training, none of that is even in any of my branding materials. I don't even talk about cybersecurity anymore because it's so dead. It's been ruined. Like by all the people that do what I do, they've made it boring. They've made it fear-based. Like they've made it ugly. Frankly, they've made it ugly. right but now with ai and deep fakes and voice cloning it's sexy it's hollywood like this is this stuff is awesome and when you start talking about it in in that way everyone's on the edge of their seat like this is like an unbelievable
41:08 Brad Yeah.
41:09 Robert story that has actually come true and it's happening right now and showing those examples they want to know like this is a good time If
41:18 Brad Yep.
41:18 Robert you actually are drinking the Kool-Aid that I'm explaining. Otherwise,
41:23 Brad Yeah.
41:23 Robert if y'all just like compliance-based security fatigue, you're effed.
41:27 Brad Yeah, it's so funny. My I had I had a family incident similar to what you're talking about with the AI where my mom's Facebook account got hacked and they had successfully gotten just 20 seconds of video of her. they use that then to just reel in as many people as they could that were in her network you know where it would look they built the thing that would look like she was facetiming me or my sister my brother now fortunately we all we all didn't fall for it we were like wait a second this is this is suspicious but some of her octogenarian friends got you know sucked into it because it was good it was really good
42:08 Robert In a word, that's awesome.
42:11 Brad Yeah.
42:11 Robert It is. It's awful, but it's awesome. You know, that's a compelling story. And it's true. And that is we are at the very, very beginning of that.
42:24 Brad Yep.
42:24 Robert And it's just going to get worse and worse and worse and worse in the existing training is frankly going to make it worse. People are just going to put the covers over their head. They're going to bury their heads in the sand and then they're going to go into full blown denial. Like it's just going to get worse. Fear, uncertainty, doubt. It's too overwhelming. And all they want to do, all they want to do anyways is they want to go home and they want to watch Dancing with the Stars. with the stars that's
42:51 Brad Yeah,
42:52 Robert all they want to do they don't want to deal with any of this crap but if you make it interesting if you make it fun if you make it about them look at we are selfish creatures or self-interested creatures and actually the word selfish kind of gets a bad rap selfish being selfish is absolutely fundamental and necessary we have to be selfish
43:16 Brad Yeah,
43:16 Robert There's a reason why when you're on the airplane and the flight attendant is providing
43:21 Brad instruction
43:21 Robert instruction and
43:21 Brad right put
43:22 Robert she talks about the oxygen mass coming down. What does he or she say to do with the oxygen mask?
43:28 Brad it on yourself first before you help others
43:30 Robert And that is because you cannot possibly help others until you take care of yourself. And so all security being personal start with the human where they're at in their lives. Focus on them and their wants and their needs and their concerns, what's important to them first.
43:48 Brad Yeah.
43:49 Robert and then provide them compliance-based training. That's when they'll understand it. But until that time, you're just talking to somebody who's not listening to you because your CISO is paranoid as far as they're concerned.
44:03 Brad Right. Exactly. We're just flipping the bozo bit on the CISO because that person is just paranoid or falling into that trap.
44:09 Robert Yeah.
44:09 Brad I am curious, do you see a correlation with security appreciation or kind of let's call it security literacy maybe to get to your appreciation do you see a correlation with that and media literacy or even just sort of like education and fundamental, you know, kind of critical thinking? Like, is there a, do we kind of have a bigger challenge here as a culture if we're struggling on those aspects as well or not related at all?
44:44 Robert So you're a smart guy, and the words that you're looking for are digital literacy.
44:49 Brad Yeah.
44:50 Robert That's it. It's digital literacy. And we are sorely, sorely lacking in digital literacy in this country. It's awful. We are only beginning to teach it in schools. My kids have learned digital literacy in the private schools in which they attend. It's only now that municipalities and statewide are beginning to ban cell phones in school. And that tells you point blank that the entire states are digitally illiterate, allowing phones in schools completely.
45:25 Brad Yeah, yeah
45:26 Robert That is like caveman stuff. Right. And because we significantly lack digital literacy in this country, security literacy is like it's taken up, you know, it's the it's the caboose. It's
45:43 Brad Yeah.
45:43 Robert back of the bus, you know, it doesn't even show up on our radar. It's not even a thing. And so I teach digital literacy revolving around cybersecurity, but in that same presentation. If I have like a six-hour day, which I often do, which isn't going to happen generally in a corporate setting, but in like a full day training, I'm talking digital literacy for a good portion of the day, you know, about how I've raised my children in regards to their own devices and how I react and respond to misinformation and how I do my own research to determine what's real and what's fake and how I, you know, manage my own digital life. and how I see others getting in lots of trouble in regards to their own digital lives.
46:30 Robert And I speak to firefighters and teachers and law enforcement officers on social media and online reputation management. And what's okay and not okay to say and post and like and share because you are in the public eye. And what you put out there has gravity. It matters, you know, and when a real estate agent, if I do a quick search on realtor. fired post three words realtor fired post you see thousands of articles on a realtor who was fired because of what she posted you do the same exact thing for a firefighter for a police officer for a teacher you know like that what does that tell you it tells you that digital literacy in this country is non-existent in that regard you know when somebody likes or thumbs up their buddies you know
47:17 Robert you know anti-semitic post
47:19 Brad Yeah,
47:20 Robert because it's his buddy and he you know wants to support his buddy and he gets in trouble for that he doesn't understand why well i mean it doesn't take a rocket science to figure that one out but
47:31 Brad yeah.
47:31 Robert but that's all part of it and you're 100 correct that is the fundamental issue that we face here but like I can't totally do that in a 90 minute presentation. And the interesting thing is like, sometimes they won't even give me 90 minutes because they got to get back to work. And it's like, you really
47:48 Brad Yeah.
47:49 Robert think you're going to solve this problem in 60 minutes? I mean, at least give me 90, you know, 75 to 90, like at least give me that, you know, but like it's a real, real problem, but not one that we need to, that we should just throw our hands up in the air and be overwhelmed by. It's one that we should actually. address and
48:07 Brad Yeah.
48:08 Robert it's addressable it's solvable you know and it is truly solvable I do this over the course of a presentation whether it's a 90 minute or a six hour and you would be amazed when at the end of the day people come up to me and they're like I did not want to be here I truly only came here because my boss told me to be here. I really didn't think I needed any of this, but I'm so glad I came and I really wish that my spouse was here because he or she would have loved it. And do you do programs for high schools because they need this too?
48:38 Brad Yeah, totally.
48:39 Robert That's what security appreciation should be.
48:42 Brad Yeah, you're right. Your point is like if you can get people to start to appreciate it for themselves. if they if you can if you can help like overcome the the sort of like heuristic biases and the sort of like built-in biological interdependency to get that person to click into a selfishness state around their own safety and their own you know kind of safety in the world in general then you've got them into appreciation mode and once you get them in appreciation mode they become a team member and an acolyte to help proselytize to the rest of them, like, yes, we all need this.
49:23 Robert When this podcast is done, I'm going to go back to the video or the audio and I'm going to take what you just said and include that exactly in my sales presentation because you hit the nail on the head. That is exactly what the CEO, what the CISO, what the CTO needs. needs to tell their boss so
49:42 Brad Yeah, totally. So how do we how do we summarize this, Robert, other than other than get people to to become selfish so that they can start to appreciate it? What else do we need to know as CTOs and CSOs and and CSO executives?
49:59 Robert look at i think that the majority of the people that are listening to this watching this are already a form of the strategic strategic human firewall. Let's get that straight. Even though there might be a few people who might not be congruent, I think that based on my chastising, they may pick up a credit freeze or maybe consider a home security system. Apologies, nothing personal. That said, I think we all understand risk, but we may not be effective communicators. You know, we may not be the best communicators and that might be a skill that some of us might want to adopt if we're going to like take this to the those in the organization that matter or that, you know, in order to move the needle.
50:44 Robert Right. Just maybe communicate a little more effective in regards to, you know, what it's going to take to actually solve this problem. And then from there, like to actually do it, like I presented not too long ago. go in you know certain part of northern california to a company i'm not going to name but they're responsible pretty much for what mobile phone technology is today you
51:10 Brad Mm-hmm.
51:10 Robert know and they've essentially created the backbone of what we know as mobile communications and i spoke in this beautiful beautiful auditorium that i know like orchestras play there and such like like inside this company's headquarters it was amazing but not everybody has that but everybody has an all hands event right and i did an all hands event in front of maybe like 200 employees that's all it was was 200 employees in the room but there was about 4 000 people connected for
51:44 Brad Mm-hmm.
51:44 Robert that event you know they were all watching And many of them actually asking questions because my presentation is a dialogue. It is the same way that you and I are talking right now. It is the same way that I communicate with my girls and my honey. When my girls come home upset, you know, disillusioned, you know, overwhelmed, what do we do? We sit down.
52:07 Brad Yeah.
52:07 Robert and we have a dialogue well I ask them questions they tell me what's going on I respond with more questions they tell me what's going on and then you know when the time's right I ask them I'm like okay so can I can I like give you a little bit of information like stuff that I've learned and let's talk about it like let's discuss like what's worked for me you know we have this dialogue and they walk away like not so upset with like some tools they can use going forward so they can actually like solve the problem on their own you know like that's how we raise our families that's how we should be talking to our our co-workers and i'm not asking a single cto to start holding your you know employees hands and kumbaya or any of that stuff i'm just saying a little more empathy might help you know
52:54 Brad connect with i mean well in some sense that's like you know to your point like like humans are an interdependent species if we connect with each other then that's the gateway into influence right and so if the goal if the goal is to influence them to become you know to appreciate security then connect first
53:14 Robert And so at this all hands on event, like I'm speaking to 200 people, but they're asking the questions of the 4000 people. people they're engaged in the dialogue of those 4,000 people that are watching because when I when they start raising their hands which often go up pretty quickly and now like 10 people are raising their hand right and I point okay sir what was your question and he asked that question and then I point to the woman you know five seats down you had a question oh he just asked it we
53:46 Brad Yeah
53:46 Robert all have the same cares and concerns we're all the same same in that regard you
53:51 Brad Yep.
53:51 Robert know so those 4 000 people watching are the 200 people that are in the room it's the same thing and so now i've just affected 4 200 people's appreciation of security that's an easy sell that's an easy thing to do you
54:04 Brad Yeah.
54:05 Robert know you just gotta make it more human and make it less you know you got to affect the wet wear what's the wet wear
54:14 Brad Yeah.
54:14 Robert versus the software the Yeah. wet where's the human brain yeah right there like you just got to affect that and and and and and truly my perspective is in order security appreciation is from security security awareness is from the neck up security appreciation is from the heart up and in order to change minds you need to affect and change hearts first that's
54:41 Brad Yeah, that makes
54:43 Robert easy
54:43 Brad sense.
54:43 Robert if
54:43 Brad It makes
54:43 Robert it's
54:44 Brad sense.
54:44 Robert easy if you are I guess you know not a sociopath or a psychopath
54:50 Brad Right. Yeah, this is super, super interesting stuff, Robert, and I appreciate you kind of like your perspective is really compelling. And so I think that. Yeah, it's definitely given me something to think about as a fractional CTO who's working with multiple teams and helping them go through their SOC compliance. And I literally just had a meeting a couple days ago with one of the CEOs who was like, wait, what happens if? And I was like, yeah, well, we did have everybody sign that agreement, right? But I love how you're presenting it that if they aren't really connecting it at a human level with their heart, then it's just in there. It's just in their mind and that's not enough. This is fantastic, Robert. I'm going to say like you've given me a fresh perspective.
55:36 Brad Hopefully the listeners of the podcast have gotten a fresh perspective. They're going to. Turn away from compliance theater and the drudgery of the annual renewal of the watch the video that's a one-way thing and they'll look into the idea of working with you or at least approaching the philosophy that you've brought to the table of connecting with us as human beings in order to get from security awareness to security appreciation.
56:05 Robert It's not turning away, it's in addition to.
56:08 Brad In addition to.
56:09 Robert Yeah. Yeah. You still got to do that. It's still necessary, but you put the horse before the cart and all of a sudden you start to see, because I know when I, I have friends that are, you know, CIOs, CTOs, CISOs, and their thing is like, I need numbers. I need metrics. I need results. I need this. I get it, but you're going to get better results once. Once you add an addendum to your existing training, then you'll start to see different results. But as is, you know, you're just going to get the same results that aren't necessarily, I'm seeing too many people getting fired, too many people getting shamed. I don't know that that's going to be effective with AI and deep fakes going forward.
56:56 Brad Yeah. Totally. Well, thanks a lot for joining the pod, Robert. This was an amazing conversation. We'll make sure that we include in the show notes links to your services and so people that are interested can reach out to you.
57:09 Robert You can also find me at protectnowllc.com. Is that cool?
57:14 Brad Yeah, protectnowllc.com.
57:16 Robert Thank
57:16 Brad That sounds
57:16 Robert you,
57:17 Brad fantastic.
57:17 Robert sir.
57:17 Brad All right. Thanks, everybody, for listening and remember to rate, review and subscribe. Let's subscribe and we'll see you guys next week.
57:25 Robert This episode of How Many CTOs Does It Take podcast was edited by Safran Epigal. Our theme song was AI Generated by Brad. Please follow us on all the social media platforms at, at HowManyCTOsPod. You can find us on YouTube, LinkedIn, Instagram, Facebook, Threads, X, TikTok, and Patreon. Or at our website at HowManyCTOsPod.com. And remember to rate, review, and subscribe on the podcast platform of your choice. Thanks for listening.
