good morning and welcome to our first
talk of the day uh
buffy currently works at canva as a
security engineer born on a moonless
night in an undisclosed location along
the cyberley lines
for the past five years they've been
using the
mystical powers handed down by
generations to tame pythons and gophers
manifesting themselves into the security
engineer they are today
they also have the best speaker bio of
anyone
buffy buffy's going to use pretty much
all the time today so if you have any
questions keep in mind and ask in the uh
hallway tracks after the talk
hi everyone um i'm buffy uh today i'll
be walking you through three different
societies exploring their success
failure and perseverance and drawing
parallels between these empires and
modern security culture
i'll also be providing a set of tools to
help you identify modern day issues in
your company's security culture
which brings me to collapsology a
transdisciplinary study of risk that
results in the collapse of empires and
just as a heads up today we will be
talking about some of the toxic parts of
workplace culture so that might bring
upon some bad memories for some of you
our first stop today is the neo-assyrian
empire which at the time was the largest
empire in the world it was located in
the near east and had control over
modern-day lebanon syria parts of turkey
and egypt
the empire was established in the 10th
century bc and ultimately collapsed in
the 7th so let's take a look at one of
the key influences that resulted in the
fall of this empire and lessons we can
learn from their failure and what we can
do to preser prevent the same fate
so after the death of the king of
assyria in 631 bc there was a lot of
political instability and ongoing civil
war
between many of their occupied
territories as they fought to gain
independence from their middle managers
i mean rulers
the rulers of the time even wrote about
their fear of internal danger palace
intrigue and rebellion
what made management's situation worse
was that the assyrians gained most of
their territory through a show of
military dominance and were notorious
for resettling conquered people to other
areas within the empire which resulted
in pockets of resistance
so while most modern organizations don't
collapse after the murder of their ceo
or grow by placing armed militia outside
corporate headquarters we can still see
modern day equivalents of palace
intrigue and rebellion
in the modern day these types of
political threats occur when interests
and agendas collide in a way that has an
impact to the organization's ability to
operate and this is the same for
security teams
one of the most common political threats
i've observed is turf laws
when managers or employees engage in
competition for bureaucratic control of
resources or the advancement of
individual or organizational goals
you've probably seen in the
organizations you've worked in where
silos or particular managers stand above
the decisions of security or decisions
are completely undermined
in other cases security management might
even cease to exist or it may be
relegated to a small security team with
no authority to enforce the securities
decisions
when i was a pen tester i would see turf
wars play out on onboarding calls where
the team in charge of provisioning
access would challenge or cause delays
in getting started because they didn't
like that another team had procured
penetration testing
when i moved into governance i saw
obvious signs of turf wars during risk
assessments when the security team would
lament that security objectives were
being sidelined for product delivery
even when there were clear drivers
the result was always the same though
low risk acceptance with slow moving
security programs
a large and highly risky security
backlog with a prevalent shadow i.t
problem
the other threat that appears when
talking politics is vendor bias and this
can be anyone providing goods and
services so that also includes open
source
this threat can take many forms from
consulting companies pushing products
that aren't adequately matched to the
company to organizations that swear by a
particular vendor or hate a vendor to
the point that it becomes a detriment
it also takes the form of organizations
refusing to buy a product because there
are similar open source variations
forgetting that you can pay in other
ways
and while there is some accountability
required by the businesses seeking out
vendors it can be very difficult to get
unbiased information if you have a small
or inexperienced security team and this
is the same in consulting
the outcome of vendor bias though is
rational security decisions are being
held hostage by forces that might not be
fully articulated or understood by the
business itself
you may end up having to devote
resources and budget to workarounds to
get technology to match security
requirements
and security teams might actually deny
themselves the best solution because
they've decided that they dislike the
provider on personal grounds
internally the organization will
ultimately find itself behind the curve
on skills and innovation by continuously
supporting vendors out of either a sense
of loyalty or animosity to the
competitor rather than sound business
analysis
which it can be a difficult debt to pay
now there isn't much hope for the
neo-syrian empire turning things around
at this point
but for organizations now you can reduce
the likelihood of these political
threats manifesting in similar ways so
the first tool we're going to look at
today can help you identify that
political back and forth
it's called the competing security
cultures framework and like its name
suggests it can help you explain the
conflicts and competing priorities that
often create security risk and failure
especially those brought on by politics
but don't be fooled it's not a cure all
and the framework doesn't pretend to
fully describe or explain every
organization's culture
it's a tool for learning and exploration
so people working within the context of
an organization's security culture can
learn more about it assign terms and
concepts and identify areas of risk that
emerge when security priorities and
values come into opposition with one
another
in summary if the assyrian empire was a
modern business we can see how their
management style would have incited turf
wars as management looked to serve their
own goals and by looking at how they
left newly occupied territories
unmanaged we can see how this would have
encouraged smaller teams to make biased
vendor decisions leaving their security
team under skilled and looking after
impractical security tools and most
likely resigning in droves
i also think that they would have had a
massive shadow i.t problem as smaller
teams work to maintain their efficiency
for you though the competing security
cultures framework can be used to help
identify these political issues by
providing you with the ability to
describe and interpret the different
ways that politics is impacting the
security culture
in the next section we're going to look
at some of the successes achieved by
another empire and what a highly
reliable culture can look like and how
we can identify similar qualities in our
own organizations
so by contrast to the assyrians the
romans succeeded for nearly 1700 years
and while they did eventually collapse
when constantinople was taken by the
ottoman turks rome's republican
institutions left an enduring legacy
influencing the italian city-state
republics of the medieval period as well
as democratic republics
the roman empire evolved from ancient
rome and was founded in 27 bc
we're now in southern europe where the
roman empire had continuous territories
through europe north africa and the
middle east so let's take a look at what
distinguished them from the assyrians
and what tool we can use to make sure
our organization thrives like the roman
empire once did
so as i've mentioned rome is what i'd
like to call a high reliability empire
they maintain complex political
structures with a constitution detailed
laws and elected officials such as
senators
however unlike other empires of the time
it wasn't as top heavy and instead they
deferred to people who were closest to
the issues which helped them increase
social mobility
the roman army was also known for their
sensitivity to operational activities
working to balance the political
outcomes of the empire a process of
diplomacy backed by the threat of
military action and their military
engagements in order to defeat the enemy
when needed
in the modern day though organizations
that embody similar qualities are called
high reliability organizations and while
they have less reliance on military
presence they have continued to adapt to
their dangerous and hostile environments
that they operate in
the qualities possessed by these types
of businesses can be grouped into five
principles that explain the qualities
seen in the roman empire but also
distinguish normal businesses to these
highly reliable ones
firstly there's a preoccupation with
failure and in most organizations
failure is universally a bad thing
that's to be avoided at all costs
but in these highly reliable
organizations there is a drive to
identify these failures at all costs and
as early as possible
using small controlled failures as a
tool that can be used to avoid larger
disasters
like the roman empire there was a
reluctance to simplify but that's not to
be mistaken with complex is good
highly reliable organizations maintain a
healthy respect for complexity and
unpredictability of their environment
and seek complicated answers backed by
observation and data
and like their military there is a
sensitivity to operations hros put equal
emphasis on the tactical requirements
that make strategy work and leaders
don't just do the vision thing leaving
everyone else to hammer out the details
instead they focus on gathering data and
knowledge from a variety of sources to
make the links between strategy and
operations which helps drive their
success
the next two qualities are a commitment
to resilience and high reliability
organizations know that they'll
experience failure at some point and
instead of worrying
about that they put time and effort into
imagining how these failures will occur
and what they should do when it arrives
and lastly there's an ability to defer
to experts and so while hierarchies are
important to highly reliable
organizations
they aren't when they are a hinder to
people so they focus on skills and
judgment of the people who are closest
to the systems in question gathering
data and feedback
as close to the source as possible
and so that brings us to our second tool
for today the security force behavioral
model and this measures the qualities we
just discussed and maps them back to a
security program
allowing the business to transform a
typical security program into a highly
reliable version of itself
this transformation can help businesses
reduce the number of large security
failures and improve recovery time from
them
but a high reliability security program
isn't a label that the security team can
put on itself it's something that it
does
it's similar to duck typing if it looks
like a duck walks like a duck quacks
like a duck and has the dna of a duck
it's most likely a duck this model just
defines what it means to be a highly
reliable duck
so there are two parts of the model the
first being a survey you can use to
assess whether or not employees not just
the security team believe the
organization has a high reliability
security program
the survey is made up of 25 statements
divided into the five sections each
representing a value that we just
discussed
respondents are asked to state their
level of agreement with each statement
from strongly agreed to strongly
disagree
and like the competing security cultures
framework it is a generalist tool so
it's very flexible in its application
and how results can be charted
and because high reliability security
programs
aren't typically seen in organizations
where security is highly centralized and
isolated
if you use this survey it's really
important that you cast the net as wide
as possible to make sure that you get a
good mix of opinions not just the ones
that will give you good results
the second tool is a set of measurements
for each of these values it's made so
you can gather data regarding how well
you actually embody the behaviors in
practice
the metrics measure things like the
number of security failure scenarios
developed in the past year the average
time to organizational decision from
idea
inception to actual rollout
and the number of security related
training opportunities to pro provided
to people and so on
these metrics are designed to assess
high reliability security program
related traits and compare them over
time
so
as you chart them the metrics will
basically tell a story of behavioral
change and artifact creation
providing empirical evidence that the
organization is actually changing
behavior rather than creating artificial
artefacts to tick a box
i decided that if the roman empire was a
modern business it would be a story very
similar to that of code spaces who
offered developers source code
repositories and project management
services using github subversion
they had been operating with great
success for about seven years and had no
shortage of customers but in 2014 they
had their amazon elastic compute cloud
control panel breached and ultimately
destroyed by hackers
and so much like the roman empire where
they embodied high reliability and
success in some ways when they took away
the ability to be adept at failure or
practicing that value of resilience it's
very easy to see a once thriving empire
topple overnight
because high reliability soft security
programs are less about how
organizations succeed at security and at
the core it's actually about how they
fail at it in very particular ways and
under very specific circumstances
so majority of security programs even
very mature ones will often find
capabilities are strained when it comes
to failure because they rely on being
robust
unlike the roman empire though you have
the security force survey and metrics to
drive change in habits and behaviors
adopting new ones that will make large
failures less likely and to help your
team respond better and faster
so far we've explored how the assyrian
empire fell because of politics while
the roman empire had limited success
because they embodied only some of the
qualities of a high reliability
organization
we're now back in the modern day and the
empire we're actually going to look at
is yours and we're going to look at what
the future could hold if additional
security threats go unchecked
and how we can identify them before it's
too late now make the safe assumption
that you've had some sort of interaction
with security in some way whether that
be with security engineers governance
and risk teams or security consultants
you might even be the security person or
make up a larger security team
so as we go through this section i want
you to analyze how security decisions
you've been a part of have been made or
how decisions you've seen been made have
been handled and see if you can see some
of these threats lurking in the
background
now the security collap
the security culture collapsologists
can't be sure how successful your
organization will be
because the nature of collapsology tends
to be retrospective but we can heed
their warnings to try and avoid similar
fates
we can do this by understanding how
employees at your organization view the
security culture and look to explore
this territory identify threats and
treat them to ensure that your security
empire stands the test of time
one of the most common and threatening
logistical threats i've observed is
incompatible outcomes and i say that
it's the most threatening because it
regards strategy for example how bring
your own device policies are introduced
or managed or how organizations migrate
to the cloud or introduce new features
into their product
when strategy is managed properly by
involving people closest to the problem
and when there's a mutual understanding
and respect for opinions the threat of
incompatible outcomes becomes largely
mitigated
but when product delivery isn't properly
balanced with security and privacy
controls especially when imbued with
political emotional and psychological
threats they can grow into serious
security issues promoting shadow i.t
people circumventing security controls
and a lack of accountability with lots
of finger-pointing and not even large
technology companies are immune to this
as we saw when apple introduced
client-side media scanning which
concerned a lot of security and privacy
experts and slack tried rolling out its
private message anyone feature
that was quickly rolled back over
privacy and harassment concerns
in your organization this could also
look like sales team promising clients
new features without consultation or
engineers rolling out features without
security or privacy sign off and it's
very common and ubiquitous problem
it's also seen internally when
governance teams enforce controls on
employees without any regard for the
impact on workflow which results in
users relying on shadow i.t to get the
job done
this threat degrades businesses to a
point of creating a sense of false
choice where every concession to the
business is seen as a loss for security
and every security initiative is seen as
a blow to business efficiency instead of
being treated as joint outcomes that
bring value to everyone
but logistical threats aren't the only
ones we need to worry about because we
have emotional threats specifically fear
uncertainty and doubt which i think is
something everyone
which i think is something that
resonates with a lot of people right now
when working as a consultant it was as
common to have clients call about the
latest security news cycle whether it be
soloing supply chain breach a principle
of vulnerability or the exploitation of
public remote desktop services to
ransomware businesses
the media's ability to spread fear
uncertainty and doubt is ubiquitous and
it can have a major impact on business
on a businesses ability to establish and
deliver a long-term cyber security
strategy especially when it's captured
leadership's attention
and it's not to say businesses shouldn't
address certain risks as they become
public but it's not an effective way to
run a whole program and each risk should
be weighed up and if needed the roadmap
adapted
so while it seems attractive to point to
the rising cost of security breaches as
evidence that we need to spend every
moment and every dollar on improving
security it's an incompatible outcome
when running an effective business
because features won't ship and it'll be
easy for a competitor to start providing
better services
fear and uncertainty can become an
excuse for security teams to say no as
well
it'll block every piece of innovation
driving engineers to circumvent security
to get new ideas off the ground
so if these emotions are allowed to rule
it can make unreasonable security
decisions seem perfectly valid and
justified which can make managing
security on a daily basis a lot harder
the last threat we're going to look at
is a psychological one and it's a big
one with lots of dimensions it's bias
it can be introduced by generation
education geography or culture and not
just at an organization level but also
at a national level
and each takes a particular way to
resolve
the jurassic causes becomes more
apparent when leaders aren't
sufficiently managing differences in how
people process information interact with
technology learn and approach their own
knowledge gaps
a really common example is in
communication style which can be
exacerbated by culture gender role and
education
we also see these differences discussed
in how we as an industry write job
descriptions blog posts and engage
people in discussion generally with a
lot of domain specific words and with a
heavy sense of contempt which can lead
to which can limit who can be included
but also who feels included and we can't
forget the impact that the
dunning-kruger effect has
when someone starts to overstep their
knowledge and offer up advice on areas
they know little to nothing about
the threats posed by bias can be
difficult to resolve especially if
people aren't willing to acknowledge it
and management is complicit in
encouraging it
but we have one more tool up our sleeve
to help us chart these threats the
security culture diagnostic survey
it provides a means of visualizing the
tensions between information security
stakeholders priorities and values that
exist in every organization and map back
onto the competing security cultures
framework we discussed at the start
keep in mind like a lot of cultural
based things i can't tell you how to
read the results and the survey isn't
going to tell you what's going right or
wrong because culture is a very relative
and contextual thing
but it will help you understand how
cultures can co-function and collide the
survey is made up of 10 questions each
with four responses that align to the
four quadrants of the competing security
cultures framework with questions
corresponding to the key organizational
activities that influence and are
influenced by norms and behaviors
central to an information security
culture
when you go through the questions you
might also notice that a lot of these
questions don't mention security and
that's deliberate security culture is
about how hidden assumptions under the
surface influence how we do our job not
how the security team looks at security
and so the response choices allow the
respondent to differentiate between the
relative importance of stability and
standardization external validation and
review
adaptability and freedom of choice
and having a sense of shared community
and responsibility
when grafton overlaid with the competing
cultures framework you can see what the
perception looks like when compared to
reality
and the thing that i love about this
survey is that it's so versatile and
depending on how the results are charted
you can tell a million different stories
to the right you can see how the results
of an organization-wide survey can be
mapped onto a radar graph to show which
factors people see as the most prevalent
and where there might be room for
improvement
so in this section we looked into the
future and saw how unmanaged logistical
emotional and psychological threats can
manifest and what outcomes they can
result in
logistical threats impacting how people
interact and craft strategy
emotional threats defining how we assess
emerging security vulnerabilities and
handle them on a day-to-day basis and
psychological threats affecting every
aspect of how we interact with the
people around us and encourage
groupthink
but the security collapsologists have
armed us with a tool that can help us
identify these things in the form of the
security cultures diagnostic survey
which asks respondents to express how
they see key security operations
balanced by the business
this gives us a chance to map out and
present a plan for the future
so we've talked about a lot of different
tools and what they can do to help us
but how does it fit together
the culture framework and survey gives
us a top-down view of the security
culture allowing us to orient ourselves
amongst the organization's values and
assumptions
it tells us areas of competition and
cultural risk it also allows security
leadership to look at where the
organization currently is and decide if
directional change is needed but it
won't tell you how to make this change
because there is no one way
and using methods that work for one
organization can have a devastating
effect on yours
in comparison the security force
behavioral model is designed to provide
a bottom-up perspective
analyzing how security behaves in
practice and influences how this
translates to group-based values
this behavioral analysis is important
because as an organization can't
redefine its security culture by only
changing behavior it also needs to
understand the drivers behind them at
the same time the organization has to
have some idea of what behaviors to look
at and improve if it's ever to know
whether transformation is going to be
successful or not
and this consistent cycle between
culture and behavior is at the heart of
the relationship between the competing
cultures security framework and survey
and the security force behavioral model
that we discussed
influencing culture requires a lot of
work to get right and as they say rome
wasn't built in a day or by one person
and so depending on the state of the
existing culture there could be a lot of
work and there might even be pushback
from your co-workers who value the
status quo or managers who benefit from
existing power imbalances so if you're
the primary advocate in an unhealthy
culture it may not be possible for you
to change much and that's not a failing
on you
before starting though it's important to
make sure you have the capacity to
manage those internal and external
expectations and to make sure you set
firm boundaries about what is and isn't
possible
once you're ready to take on the job of
influencing cultural change i challenge
you to go and talk to your engineers
developers and designers about what
problems they see with security don't
argue with them don't justify these
behaviors just listen
focus on their needs and critically
analyze how security is impacting them
and start monitoring that informally at
first
in most cases i've seen security often
loses out in decisions where the
decision makers are far removed from the
people who have responsibility for
security and so part of this job is to
bring those decision makers back into
the fold and to help
get buy-in into a project like this
and once you have that you can start to
measure and analyze the security culture
to a level where you know enough about
it and how it works to make changes that
will stick and collect metrics that
demonstrate these changes have stuck
culture requires someone to look around
and identify those behaviors and threats
that have beared witness to the rise and
fall of empires and it's things like
this that undermine every decision that
we make without knowing it
it's the reason management protocols
like rdp end up on the internet and even
on the good days within the best
companies these factors are still a
massive force which is why culture is
one of the biggest security threats
that'll face the industry
it will persist regardless of code
analysis firewalls and third-party
assessments
i'm buffy this is collapsology and why
security uh white
ah no this is collapsology and why your
biggest threat is an exposed rdp thank
you and have an amazing conference
thank you so much that was such a great
talk it was
really good to get sit here on the
sidelines and watch the whole thing
um if you have any questions for buffy
please jump into the hallway chat um
buffy will come in and out and i just
want to say yes ducks are very cute
thank you everyone we'll see you again
in about 15.