Latest / CYBR.Signal / Everything is Everyone's Responsibility

Transcript

Everything is Everyone's Responsibility · CYBR.Signal

• 0:01
  SPEAKER_00: So I'm here at my favorite place, it's a training camp.
• 0:05
  SPEAKER_00: I've got to record this now because very shortly we're not allowed to do video or audio recording.
• 0:11
  SPEAKER_00: And in fact, the announcer for the stadium who started riling up the crowd, you can hear him in the background, is the guy who just said it, so tell everybody.
• 0:18
  SPEAKER_00: And it makes me think about when we say that security is everyone's responsibility or is everyone's job.
• 0:24
  SPEAKER_00: But often when cybersecurity professionals say this, we we don't really understand what that means.
• 0:36
  SPEAKER_00: Rather, what we are sort of saying is, oh, it's your job to not screw up.
• 0:41
  SPEAKER_00: That's not interesting security.
• 0:42
  SPEAKER_00: So I'm like quickly running through, like just getting here today, all of the people who are sort of doing security, right?
• 0:49
  SPEAKER_00: You've got you know, these guys you are standing around here, and their job technically is to just make sure nobody rushes the heel.
• 0:56
  SPEAKER_00: Okay, that's a security job, but they're also hospitality crews.
• 0:59
  SPEAKER_00: You go ask them questions, they're here to help you.
• 1:03
  SPEAKER_00: Because that's part of what they're doing, is they're making us an experience for people, right?
• 1:07
  SPEAKER_00: Announcer is a guy who is telling you, hey, by the way, here's the security rule.
• 1:11
  SPEAKER_00: They can't see them right now, they're not out here.
• 1:14
  SPEAKER_00: The PR staff, who normally handle the media, the media all sits right here uh when they come out, but I think they're doing uh interviews right now.
• 1:22
  SPEAKER_00: Uh, you know, when they come out, like there's going to be PR folks who are supporting them.
• 1:25
  SPEAKER_00: PR folks will also be watching to make sure nobody is reporting, because they don't want things to get out.
• 1:30
  SPEAKER_00: And it turns out the media also has a responsibility there, uh, which you wouldn't even think of.
• 1:34
  SPEAKER_00: They don't work for the football team.
• 1:37
  SPEAKER_00: Because if somebody, say me, stealthily recorded video and posted it on social media, if you're credentialed media, you're not allowed to read there, reference that at all, because they'll be taken and they're covered by it.
• 1:51
  SPEAKER_00: If they share it, they'll get yelled at.
• 1:53
  SPEAKER_00: So the PR folks, whose job it is to display in the rest, are actually part of the security establishment.
• 2:00
  SPEAKER_00: There's folks doing hospitality that are just making sure you get to the right place, but they're also a failure.
• 2:07
  SPEAKER_00: And it really makes me think that maybe it is not that security is everyone's responsibility, gifted everything is everyone's responsibility.
• 2:14
  SPEAKER_00: And I think that's one of the things that cybersecurity professionals need to think about, which is you have all these people here that are doing security, but they're also doing other stuff.
• 2:23
  SPEAKER_00: You know, maybe the folks who are doing the you know, the detectors when you come in are exclusively doing security, but everywhere else you're doing a lot of things as well.
• 2:32
  SPEAKER_00: So as we think about being cybersecurity professionals, then we have to understand what is the everything that we're not kind of doing?
• 2:40
  SPEAKER_00: What is the stuff that actually matters to the business?
• 2:43
  SPEAKER_00: Because let's be honest, cybersecurity doesn't matter until it breaks.
• 2:47
  SPEAKER_00: And so you want to be seen, being visible on everything else.
• 2:51
  SPEAKER_00: How is security helping make sure that we, you know, and Steve Zelski's terms that we're selling G or whatever a business does.
• 2:59
  SPEAKER_00: So think about what your business does and think about how does security help advance what the business does.
• 3:06
  SPEAKER_00: Because if you're a football team like this, you have two different businesses.
• 3:10
  SPEAKER_00: The football team themselves is in the business of winning football games.
• 3:14
  SPEAKER_00: That's their job.
• 3:15
  SPEAKER_00: Play football, win games, that's it.
• 3:17
  SPEAKER_00: The rest of the organization is also an entertainment business, they're in the business of entertaining a lot of people.
• 3:24
  SPEAKER_00: Whether or not you win or lose football games, you want to be in a place that has humans showing up.
• 3:31
  SPEAKER_00: And this is literally the first day of training camp.
• 3:34
  SPEAKER_00: And because they're doing their job as an entertainment business, so everybody in security is here, and their job is to entertain people, right?
• 3:43
  SPEAKER_00: So take care of them.
• 3:44
  SPEAKER_00: Figure out what are you doing that makes people really excited to be here.
• 3:49
  SPEAKER_00: Uh, and so think about that for your business.
• 3:51
  SPEAKER_00: What is the business of your company?
• 3:54
  SPEAKER_00: What are the things that your team is doing to advance the business?
• 3:58
  SPEAKER_00: And what are the security things that other people would naturally be inclined to do as part of their role in the business?
• 4:05
  SPEAKER_00: And that's what's their responsibility.
• 4:07
  SPEAKER_00: Their responsibility is not to be like, oh, I'm not supposed to click this, I'm supposed to click that.
• 4:12
  SPEAKER_00: If you're worried about what somebody clicks, you have actually already failed with the cybersecurity professional.
• 4:16
  SPEAKER_00: What you should be doing is saying, hey, it's your job, comp controller, to make sure money goes to the right place.
• 4:23
  SPEAKER_00: Your job is to pay people.
• 4:24
  SPEAKER_00: As part of that, you need to make sure you're not paying those long people.
• 4:27
  SPEAKER_00: So let's talk about business email compromise and how we're gonna build processes with you to protect the business because that's what our responsibility is.
• 4:37
  SPEAKER_00: So, wrapping it up.
• 4:39
  SPEAKER_00: What is the everything you need to do in cybersecurity?
• 4:42
  SPEAKER_00: And then what is the natural cybersecurity that is part of everyone's job?
• 4:46
  SPEAKER_00: Now, I am gonna hang out here and I'm gonna watch some practice.
• 4:50
  SPEAKER_00: It's gonna be a blast, and I'm looking forward to a really great football season and a secure one as well.
• 4:56
  SPEAKER_00: Peace out.