Latest / CYBR.Signal / 'Energized Cybersecurity Culture' Book Review with Michael Farnum

Transcript

'Energized Cybersecurity Culture' Book Review with Michael Farnum · CYBR.Signal

• 0:02
  SPEAKER_00: Hey everybody, Michael Farnum here, CEO of Cybersec Community, and glad to be with you on another episode of Cyber Signal.
• 0:10
  SPEAKER_00: Usually I'm out and about somewhere in town or at a car dealership or something, but I want to do something a little bit different today.
• 0:16
  SPEAKER_00: So I want to do a review of a book by Brian Perkola, who's a local CISO here in the Houston area.
• 0:23
  SPEAKER_00: This is the book right here.
• 0:25
  SPEAKER_00: So Energized Cybersecurity Culture by Brian Perkola.
• 0:29
  SPEAKER_00: Great book.
• 0:30
  SPEAKER_00: Brian is a senior VP of information security at First Community Credit Union.
• 0:35
  SPEAKER_00: Been around a while, have known him for a while.
• 0:37
  SPEAKER_00: Real, well-respected CISO in the area.
• 0:40
  SPEAKER_00: Obviously, like I said, lives in Houston.
• 0:42
  SPEAKER_00: So give him a little extra credit for that.
• 0:44
  SPEAKER_00: This is a book on cybersecurity culture and security awareness.
• 0:49
  SPEAKER_00: And I know there are a few of those out there.
• 0:51
  SPEAKER_00: I get it.
• 0:52
  SPEAKER_00: You might be thinking, why are you doing a review on something like that?
• 0:55
  SPEAKER_00: We've read a ton of those.
• 0:57
  SPEAKER_00: I I really do think there's a difference in this book and how Brian approaches this problem.
• 1:04
  SPEAKER_00: And you'll get that right out of the gate, actually.
• 1:07
  SPEAKER_00: So if you're if you if you start reading this book, and normally when I do book reviews or I read a lot of books, I good or bad, I tend to skip over the introductory chapter or anything that's in the beginning when I do these.
• 1:21
  SPEAKER_00: But I really think you'll you'll do yourself and the book a disservice and Brian a disservice if you don't look at that first chapter.
• 1:29
  SPEAKER_00: Because that's really where he talks about how he works at deep levels with marketing and graphic design teams, comes comes at this with some unique perspectives for cybersecurity awareness and cybersecurity awareness training.
• 1:43
  SPEAKER_00: That that marketing background that he has has been really a large influence on how he approaches the security awareness and building that security culture.
• 1:52
  SPEAKER_00: So it makes a lot of difference.
• 1:53
  SPEAKER_00: Definitely worth the time to read that first chapter, because if you don't, you're not really going to get a sense of how he's approaching the rest of the book.
• 2:03
  SPEAKER_00: As for the the book as a whole, very approachable, very honestly entertaining.
• 2:11
  SPEAKER_00: Brian, he just he does a really solid job of explaining the methodology that he has, using a really good blend of engineering with that kind of engineering mindset with a creative mindset.
• 2:25
  SPEAKER_00: So there's something for all of us.
• 2:27
  SPEAKER_00: We tend to all be geeks and everything in cybersecurity, but a lot of us also are very, very creative.
• 2:32
  SPEAKER_00: So it blends that very well.
• 2:34
  SPEAKER_00: I think it's worth the time to read it and get that first chapter and to see how he approaches everything else.
• 2:41
  SPEAKER_00: An example of that creativity and engineering mindset comes right out of the gate in chapter one.
• 2:49
  SPEAKER_00: He he starts talking about employees as part of the security stack, which which they are.
• 2:55
  SPEAKER_00: I don't think anybody would argue with that.
• 2:57
  SPEAKER_00: But he talks about how you have to update their firmware, their quote-unquote quote-unquote firmware by training them.
• 3:04
  SPEAKER_00: And if you haven't read the rest of it or if you don't have context in it, that can seem kind of cold and calculating a little bit, like he's treating people like machines.
• 3:14
  SPEAKER_00: But he it's really clear throughout this whole book that he approaches that with empathy.
• 3:19
  SPEAKER_00: He's he admits people are different than machines.
• 3:22
  SPEAKER_00: And he says, because of those differences, you really have to do things differently.
• 3:27
  SPEAKER_00: You have to approach this differently because every person is different.
• 3:31
  SPEAKER_00: So you can't just approach this wholesale in the same way.
• 3:35
  SPEAKER_00: But the coolness about marketing, what marketing gives you from an advantage perspective, is you are approaching that differently for different people.
• 3:45
  SPEAKER_00: You're you're using a different methodology that tends to work for a large number of people, but you're also hitting that creative mindset where people are having to think about it instead of just being bored by security awareness training.
• 3:58
  SPEAKER_00: So I think that's really important.
• 3:59
  SPEAKER_00: He's got a lot of empathy in the book.
• 4:01
  SPEAKER_00: Definitely a good way for him to approach it and not just be in this engineering mindset.
• 4:06
  SPEAKER_00: And that's how we tend to approach all things in cybersecurity, but it just doesn't work as well with cybersecurity awareness training.
• 4:13
  SPEAKER_00: I will say one thing that is typical about his book is he asked the question of why you should develop a security culture and a security awareness program.
• 4:23
  SPEAKER_00: He does that in chapter two.
• 4:25
  SPEAKER_00: He starts off with a simple quote: humans are one of the most attacked resources you have in your environment, and they can be either a liability or an asset to your cybersecurity program.
• 4:37
  SPEAKER_00: It's extremely true.
• 4:40
  SPEAKER_00: I think we all know that that have been in cybersecurity.
• 4:43
  SPEAKER_00: If we've been in cybersecurity a while, we know everybody says humans are the weakest link, but they are going to be attacked.
• 4:50
  SPEAKER_00: But you have to answer that question, and it has to be something that you put in a book like this, even with all of the other creativity around it, because a cybersecurity awareness program, a cybersecurity culture, building that costs money.
• 5:04
  SPEAKER_00: So you've got to be able to convince your management that that program is needed.
• 5:09
  SPEAKER_00: So when I say typical, I don't mean that negatively.
• 5:12
  SPEAKER_00: It has to be there and you need justification.
• 5:15
  SPEAKER_00: And Brian's got a ton of stats you can use.
• 5:17
  SPEAKER_00: So don't skip that if you read this book.
• 5:19
  SPEAKER_00: Don't skip that chapter because it can give you a lot of ammo to justify building a program like that.
• 5:25
  SPEAKER_00: So after getting through that necessary stuff, Brian returns to the marketing angle by explaining marketing fundamentals, given that many people in our industry sometimes tend to look down on marketing.
• 5:37
  SPEAKER_00: It really, to me, stands the reason that those people also don't have a good grasp on marketing terms, on basic terms.
• 5:46
  SPEAKER_00: So he goes over things like campaign, target audiences, market analysis, brand positioning, all that stuff.
• 5:53
  SPEAKER_00: Really good to go through that and get a basic understanding of marketing terms.
• 5:57
  SPEAKER_00: Very important to read this, especially if you're gonna go with his methodology for building your program.
• 6:05
  SPEAKER_00: So I'm gonna wrap this up.
• 6:06
  SPEAKER_00: I'm not gonna keep going chapter by chapter in the book.
• 6:09
  SPEAKER_00: There's a lot there.
• 6:09
  SPEAKER_00: I really just want to summarize this by saying that Brian he sticks with the marketing approach throughout it.
• 6:15
  SPEAKER_00: He gives great explanations and tips along the way.
• 6:19
  SPEAKER_00: I've worked in marketing in various roles over the years.
• 6:22
  SPEAKER_00: Don't judge me for that, but I think a lot of people should not look down.
• 6:27
  SPEAKER_00: Most people or anybody really shouldn't look down on marketing.
• 6:30
  SPEAKER_00: It's a it's a hard job.
• 6:32
  SPEAKER_00: And when you apply it to cybersecurity awareness training, I really think the approach and the concepts that Brian brings are really good.
• 6:40
  SPEAKER_00: It he makes unfamiliar territory of that marketing very approachable.
• 6:45
  SPEAKER_00: I really don't think anyone should shy away from the approach that he's taken.
• 6:49
  SPEAKER_00: If you're still hesitant, he but he also brings back the very familiar territory for most cybersecurity leaders by going into KPIs, measuring overall success of the program, grading, got some even pretty solid mathematical, mathematical approaches in there.
• 7:04
  SPEAKER_00: So if you still get you still get to geek out if you read it, even if the marketing part makes you uncomfortable.
• 7:10
  SPEAKER_00: So definitely want to say thank you to Brian for putting the time and effort into writing this.
• 7:15
  SPEAKER_00: It's really worth your time if you're working on a cybersecurity culture and awareness program.
• 7:20
  SPEAKER_00: If you've struggled putting one together in the past, or if you need a new approach, or if you just want to see how Brian does it and he does this in his organization, that it is definitely well worth your time.
• 7:31
  SPEAKER_00: All right, everybody, see you on the next Cyber Signal.