Jerry 🦙💝🦙I get to speak to a masters in cyber security class at a major university on Monday. They are learning about interacting with senior leadership/BoD on topics of cyber risk. I have many stories to share with them, but curious if y’all have any ideas on what you thank that group should know
I should probably figure out what cyber security means before I go speak to a masters class about cyber security.
da_667
Kluthulhu' XOR 1=1--
Wendy Nather@jerry Nah. I didn’t, and it went fine.
Xavier «X» Santolaria 
@jerry Call it Super Security.
Paul_IPv6
🇺🇦 haxadecimal 🚫👑@paul_ipv6 @jerry
That's the great thing about the word "cyber" – it means whatever the speaker wants it toean.
That's also the awful thing about the word "security."
kwayk42
bagmangood@jerry if it is a professional focus - maybe something along the lines of "it is about influencing people, not saying no to them"
Graham Perrin@jerry too fastidious.
Just say "3.0" at some point.
Simon ZerafaGo with the SANS retro-encabulator video and then ask for questions 😉
Æ Sea F.
Zachary Cutlip@jerry Can you just speak about cyber insecurity and then tell them to imagine the opposite?
Spellucci@spellucci @jerry “Security”
Melroy van den Berg@jerry just ask Ai. You will be fine 😏
fan boy 🪭
johnchiment@jerry cybersecurity means never having to say you’re sorry.
wav3
Davi Muir
Scott 
@jerry relating any recommendations to financial impact is all they care about. How much it will cost to implement, vs. how much it'll cost if we don't implement it.
DamonHD@da_667 @jerry Yes, indeed. Especially the bean counters need to have an NPV waved at them!
But the rest of the board should also care about reputational risk.
So the lesson is that while CxO should care about data security and operational integrity - and the tech and training that that implies - it may need to be translated into money and shame to be salient...
Viss@Viss @DamonHD @jerry I had a music major as my datacenter ops manager.
I want you to understand, I know that sometimes, someone changing majors and/or professions sometimes happens and that these people can be quite good in a totally difference space (edit:clarification), but this dude paid for a cleaning service that does datacenters to come and clean the datacenter. It didn't really need it, and was genuinely a waste.
Now, us replacing all of our network fabric, and re-doing our cable management, which was another huge endeavor, was a big win.
Bill@Sempf @da_667 @DamonHD @jerry sure, its totally possible for people to be nerds and that not match their major. ive just encountered so many people with a 'masters in cybercyber' that dont have even basic experience, like installing an os or configuring a linksys its tainted the whole degree for me
Bradalot “
”@jerry this also relates to budgeting for new tools, and head count. Learn to create proposals for head count and/or tooling. Including cost figures in those figures. I worked tech support at Sourcefire for a number of years, and had team leads who were bitching that we didn't have all the tools we need to do the job. One of them would put a draft together, submit it, the boss would ask "where are the costs?" and it would NEVER progress. It all comes down to cost. If you don't mention cost, they don't care.
Bongoknight
aburtch@bongoknight @da_667 @jerry In my experience, that doesn’t matter as much. Just cite known examples of breached companies who had to pay damages, spend huge amounts to fix any damage, added costs for additional crisis PR management or the money spent on lawyers. Even just ballpark averages for those costs are usually enough to wake them up to the costs of disaster if things go unimplemented.
Jan Eden
J4YC33
sͧb̴ͫƸ̴gͬᵉ@jerry Knowing Corporate only gets you that far, at some point you must know the Individuals.
Risk perception and appetite is a deeply personal trait.
joriki
JP
Alister Bulman@jerry I'd suggest two things: a) Ethics - should you do something, or should you say something when you discover a problem?
b) A couple of stories about why security researchers/sysadmins can be like magicians - because we will spend an inordinate amount of time on doing some tiny thing to absolute perfection in order to find out something that is bugging us:
1/ Clifford Stoll found an unauthorized user who had apparently used nine seconds/75cents of computer time and not paid for it. It was a KGB Hacker. Oh, and "The Cuckoos Egg" had a nice cookie recipe too.
2/ The XZ Backdoor was found by a user, testing SSH, who saw that logins were taking too long.....
Simple Nomad@jerry Let them know that despite there being plenty of anti-AI sentiment out in the world, it is not only NOT going away but it is up to the security community to fix it. Just like we did with PHP when that came out spawning hundreds of vulnerable websites from non-HTML programmers. Just like we did when we moved from server rooms to the cloud. Before HTTPS. And on and on. Whether we like it or not, security pros have to fix things.
Wulfy—Speaker to the machinesGIVE THIS PERSON AN AWARD!!!
🎖️🏅🥇
Josh Bressers@simplenomad @jerry I just make all my prompts end with “and be sure you make it secure” and everything is fine
@joshbressers @jerry I take a step further, repost the LLM’s code in a separate chat, and say “I wrote this code but strongly suspect it is insecure, please show me the flaws and give me a diff to fix things.”
@simplenomad @jerry it’s amusing to me that LLMs are better then the average security bug hunter
But they also can’t write secure code
ɐssǝſ@jerry relaying how their org is doing when compared with their peers. I get asked that on the weekly. Understanding the risk completely and how that impacts the org is really important too, and being able to explain that risk. Don't misspeak either, especially in consulting roles.
Don't be that nervous. They're just people at the end of the day who (hopefully) want to see their org mitigating future attacks. This one I notice a large difference between internal and consulting roles.
Pesky Warlock@jerry For high-level Corp. mgmt., communication governance in an incident is key. They may have to manage confidentiality while allowing the investigation to proceed, and they shouldn't allow info to propagate, even though high-ranked officials will demand access to the info. The story could get out before they could control this, which (obvs) will be detrimental to the stock price.
so1arp0wer@jerry ROI , risk management, and throw in whaling examples. Have them think of a DFIR budget as insurance.
Bob@jerry This is broader than just risk, but my advice on talking to top leadership is to pay very close attention to the questions they ask. They are trying to make decisions about what the company should do, and if you are talking to them, it's likely because someone thinks you have information that could help them make that decision.
Have understandable answers and plan for the follow-up questions. Identify the key points you think the leaders need to know but may not know to ask.
@jerry Also, it absolutely has to be established that Infosec runs the investigation, and can be allowed to turn things off. I once ran an incident communications workshop where the PR dept. said flatly: we will be running the investigation, as if they knew anything about systems. They wanted to govern the story completely.
KevinFlynn 
@jerry
Risk, as a cost
Risk, as a cost
@jerry Also generally, security risk frameworks don't align with financial risks. To quote Jacquith, how do controls relate to business value? This is the problem they're going to have to solve.
noplasticshower@jerry have you read the CISO Report?
https://www.garymcgraw.com/wp-content/uploads/2018/01/CISO-2017.pdf
@noplasticshower I had not. Thank you for the link.
@jerry ping me on @cigitalgem identity if you have questions or just want to talk about it