Latest / Success Story with Scott Clary / Lessons - Fixing Human Error in Cybersecurity | Theresa Payton - Former White House CIO

Transcript

Lessons - Fixing Human Error in Cybersecurity | Theresa Payton - Former White House CIO · Success Story with Scott Clary

• 0:00
  In this lessons episode, discover how predictable human behavior creates vulnerabilities in
• 0:04
  cybersecurity and why conventional defenses often fall short. Learn why routine security measures
• 0:09
  can be exploited by sophisticated social engineering and understand how innovative personalized protocols
• 0:15
  can disrupt attackers and strengthen digital defenses.
• 0:18
  When, um, and just you met like again, like the human experience we're trying to face because
• 0:33
  I've had other security experts on this show before and they do speak about the human,
• 0:38
  the human problem and the phishing attacks and you just mentioned something that's very interesting.
• 0:43
  Like, everybody hates these super complex passwords but we know we got to do them
• 0:48
  and everybody, uh, two FAs annoying but we got to do it and I guess, you know, you have your like
• 0:54
  Google auth that seems to work well and I personally hate doing like the the texting two FAs not
• 1:01
  for like sim swap reasons but mostly because sometimes it doesn't get it. I don't get a text
• 1:07
  just the pain in the ass and it just seems like it's a lot of effort and again,
• 1:12
  if I got a phone call from an AI voice that said, you know, we, it's your brother and it sounds
• 1:20
  like him and I'm stressed out and he says he was arrested and I've heard stories of this
• 1:26
  kind of fraud and then it just like pulls out your, you know, your heartstrings and you feel
• 1:31
  stressed out and you want to help the person and you go wire the money or whatever. I mean,
• 1:34
  there's a million different types of fraud that I've even, I hope they haven't haven't fallen
• 1:39
  victim to but people have tried to target me for a variety of different reasons. I've had
• 1:43
  employees with spoofed emails emailing me that they want to change your banking information.
• 1:47
  Like I've had a whole bunch of different things, right? Um, however, you said that you made a good
• 1:53
  point so the fraudster is going to understand there's a complex password. They're going to understand
• 1:58
  there's two FAs and they're just going to layer on a human component and they're going to try and
• 2:01
  trick you at doing something but and the answer is not blame the human but then how like,
• 2:08
  how do you solve that? Because humans are humans and they're always going to have an emotional
• 2:13
  reaction to these like the social engineering that a fraudster is going to put together.
• 2:20
  Absolutely. So one of the things that, one of the principles that I have is if you study the
• 2:28
  profile of cybercriminals and fraudsters, nation states, you start to see they have a pattern of how
• 2:36
  you know, attack the different chinks and the armor if you will. And so the goal sometimes,
• 2:43
  you know, you want to do the basics. You know, I mean, you want to have good digital hygiene
• 2:47
  practices. You want to invest in tools. You want good processes. But really oftentimes the best
• 2:54
  thing that stops the bad guys is designing something they didn't expect. So for example,
• 3:02
  having a passphrase that's not easily guessed. So if you're sitting on, you know,
• 3:07
  there was a recent wire transfer fraud where the employee heard of their protocols,
• 3:12
  you get on a video conference with the CFO or the CEO or somebody else and you have proof of
• 3:18
  life and the employee was on a video conference and was told to do the wire transfer. Did the wire
• 3:25
  transfer? If part of the protocol had said, so good to see you, what's the passphrase and the
• 3:34
  passphrase was like something ridiculous that nobody else would know. Yeah. Then you probably
• 3:41
  would have had somebody hang up and it was that from happening. You can use this in your personal
• 3:47
  life. So you were mentioning like the virtual kidnapping type thing. Yeah. I, I don't know about
• 3:53
  you, but like I grew up, my sister and I, my dad would play a little game with us. When we
• 4:00
  walked into a room, restaurant, wherever, I need to say, okay, without turning your end,
• 4:06
  where are the exit doors? Where were you hiding if something bad happens? What were your weapon
• 4:11
  day? Did you grow up and play that game? Yes. Yeah. Exactly. So my dad was in the, I'm Canadian,
• 4:18
  and my dad was in the RCMP and then he moved into Ceasis. So he was, he was always adjacent to
• 4:25
  a lot of all Ceasis's Canadian security intelligence, right? So yeah. So it was very aware.
• 4:30
  You had a similar childhood experience and then it just became muscle memory for you.
• 4:35
  Yeah. Probably even today, I know I do. I can walk into a room and without really looking,
• 4:42
  I know where everything is. I literally was giving a talk, huge place I'd never been there before
• 4:48
  and the fire alarm went off long enough that I said, hey, everybody, I know where the fire exit is,
• 4:52
  please follow me until the fire alarm because stuff. So I get off stage and everybody follows me
• 4:57
  orderly out and the place was like, we cannot, we've never seen anybody do that. Mike, well,
• 5:01
  my dad trained me. So my point in bringing that up is, is have this passphrase,
• 5:07
  play the game with your, your family, by the way, on where the exits. It's really important. A lot
• 5:12
  of you will really underestimate that. But the same thing with the passphrase. So I'll just like
• 5:17
  in the kitchen before dinner, like anybody know the passphrase. I'm like, well, then you're not
• 5:21
  getting rescued if you call me and tell me you're in jail or somebody's got you, like you have to
• 5:26
  give me the passphrase. So that's something you can apply in your personal life as well. And again,
• 5:31
  each one of these things are typically just studying what's our process. How will criminals and
• 5:39
  fraudsters try to interject themselves into the process? And how do we do something completely
• 5:45
  unexpected? That's really it. It's about removing, it's about removing the routine out of, you know,
• 5:51
  our, our, our activity or day to day, so that it can't be guessed. That's really it. Something that
• 5:56
  can never be the hacker, the fraudster. There's no way they're ever going to be able to know this.
• 6:03
  That's the bull. That's really the bull. And make it simple. Make it simple. Not a strong password.
• 6:09
  Because of the purpose is for, it doesn't matter really what the word is. It's just, it's just that
• 6:13
  it's there. That's really the, that's really the goal. Um, I want to ask you some more, uh,
• 6:20
  just questions about some of the, some of your time in the White House, because I find that
• 6:24
  fascinating. And obviously you speak about what you can speak about and, and don't get yourself
• 6:29
  in trouble. But I am curious about some of the, when you, when you walk into the White House,
• 6:35
  you say the general public is not aware of really the threats that are going on. So what are some
• 6:42
  things that the public should know about that they're kind of oblivious to? Like what is coming
• 6:48
  at the US? Why, are we in trouble? Why you, like I think he mentioned at some point, like,
• 6:54
  it's not, it's not, you know, unicorns and rainbows when it comes to cyber security. And
• 6:59
  people know about how their nation states and they understand that, you know, China exists and
• 7:05
  Iran exists and, and Russia to an extent exists. And, but maybe a little bit more clear as to
• 7:13
  what is actually happening that we have no clue we don't pay attention to. Yeah, well, I mean,
• 7:19
  for example, uh, cyber criminals, like, especially nation states and then people who are loosely
• 7:27
  affiliated because for the record, China, Russia, Iran and North Korea say they don't have nation
• 7:34
  state operatives hacking into American infrastructure. So they say that so I'm just going to give that
• 7:40
  disclaimer from them. But what's interesting is is they first primarily focused on what's
• 7:50
  referred to as the defense industrial base. They would go after the US government, US military
• 7:57
  departments and agencies, White House, then they'd go after the vendors. You know, the big
• 8:02
  vendors that provide, you know, airplanes or weapons or, you know, anything else, um, to the
• 8:08
  government. But then they realized, you know, that might be leaving money on the table. Maybe we
• 8:14
  should steal, I don't know, intellectual property trade secrets and then reverse engineer and
• 8:20
  manufacturer own stuff and compete with the US. And you know, kind of even the playing field,
• 8:26
  we'll just steal their R&D, we'll skip that process and we'll just reverse engineer it and
• 8:30
  produce it here. And China for one is really good at doing that. And so that was something that was
• 8:37
  very eye-opening to me at that time because that wasn't really being discussed. And if any companies
• 8:45
  at that time were falling victim to that, they weren't talking about it because they were worried
• 8:50
  their competitors would take advantage of it. So I think that's something, you know, that was a big
• 8:56
  aha moment for me. You know, many people may not realize this. I'm sure most people assume
• 9:02
  attacks against White House are constant, it's a constant barrage and that is correct. But what's
• 9:10
  interesting is, is like, I learned, for example, because we have White House stuff up and White House
• 9:15
  stuff up is not connected like to anything. Like there's not like, hey, the president's secret
• 9:23
  briefing is just right behind White House stuff. It's really just meant to be sort of, here's
• 9:29
  where the executive orders are. And like, hey, look at President Bush's dogs, Barney and Miss
• 9:35
  Beasley. And watch Barney run around the White House. One of the favorite videos of my kids was
• 9:41
  Barney at Christmas time watching things get decorated and running around with a little Barney
• 9:46
  cam on. Probably the paint and household was the like biggest consumer of Barney, but the
• 9:53
  president's dog. And it's really meant for that, but for whatever reason, if there was like a
• 10:00
  visiting head of state from another country who had a beef with somebody else or different things
• 10:06
  that were going on, we would sometimes, according to our vendors and routers and our own monitoring,
• 10:13
  be the most attacked website in the world on certain days.
• 10:19
  Now, if the website goes down, it's incredibly embarrassing, but the website isn't like where
• 10:25
  people get money. And the website's not like, it's not connected to classified systems or
• 10:30
  anything like that. But for whatever reason, that was a kind of a digital representation of public
• 10:37
  face, if you will, of the White House. So a vitally important page to not have
• 10:43
  commandeered and defaced, which was very popular thing at that time. Let's take over this
• 10:49
  department and agencies webpage and put, you know, long live Iran or, you know, something like that.
• 10:54
  So those are, you know, some of the a little bit of an inside ball without giving too much away
• 10:59
  of the types of things that you have to think about and deal with that shape, my thinking when
• 11:05
  I work with companies and people today. Thanks for tuning in. If you found this valuable,
• 11:09
  don't forget to hit that subscribe button so you never miss an episode. And if you want to dive
• 11:14
  deeper into this conversation, check out the links in the description to watch the full episode.
• 11:18
  See you in the next one.