Author: coffeefueled

Like most things, public speaking is a skill. It can be learned, practiced and mastered if you are willing to put the time and effort in. Even so, for many the thought of standing up in front of people and speaking can fill them with dread, meaning they miss many business opportunities.

Throughout my career public speaking has been fundamental to what I do, and I have spoken on all aspects of security, with a strong focus on cyber security, security culture, and disinformation. Whilst now, some people say I make it look easy it wasn’t always this way. It’s something I have worked at and I still get nervous (it’s not fear, it’s excitement).

There’s a lot of advice out there, and it doesn’t all work for everyone. Since I get asked, and some of the advice I apply

Ten Tips to Speaking Like a Bore

Although every speaker is different and may have different styles of communication these tips are universal and will help speakers in every industry.

1. Enough (but not too much) preparation  – This isn’t necessarily about rehearsal. Some advocate for diligent rehearsing, and for some people it works. It can also mean your talk comes off as scripted. Preparation for me is about thinking through the presentation and reviewing it, along with considering what questions it provokes. Having a couple of pre-prepared questions at the end (if you’re going into Q&A) can help break the audience’s resistance to being the first one to ask. I will run through one practice run, but rarely more than that and instead spend hours working through mentally.
2. Know your audience – It’s important to pitch your talk at the appropriate level for the audience present. This could mean asking the organiser who they are, their knowledge level, and equally important the intended outcomes for the talk. Then, adjust your language to fit. Define your terms if they won’t be known, break down difficult concepts as you go through if your audience is unlikely to be familiar with them.
3. Timing – Often when speaking you know in advance how long you have to speak for but sticking to it can be difficult if you haven’t prepared. Through practicing you can ensure you use the time sufficiently as well as not going over the allotted time or finishing too early. Also important when you’re dealing with some events is being able to adjust the length of your talk on the fly, due to other people overrunning or underrunning. Hosts are often very grateful if you can get their event back closer to the planned schedule. A silent alarm set at particular intervals helps to reinforce this.
4. Appropriate Slides – As a guide there should be a maximum of one slide per minute of your talk, I usually aim for less than this. The slides should not have your speech written on them but should include images (or bullet points at most). You don’t want people to be reading when you are talking, and additionally what is the purpose of you being there if all the information is written on the slide? One good test is whether you could present without your slides (this doesn’t apply so much to technical presentations, and even less to ones involving live technical demos).
5. Follow a structure – Think of your talk like a meal, with an appetiser (introducing the topic in a light summary to whet the appetite), a main (the crux of the talk), and dessert (a summary of all the key points). Coffee and mints afterwards covers the Q & A session which you could kick-start with ‘one question I often get asked about this is …’ if the audience is shy (they often are).
6. Appropriate repetition – There is nothing worse than an hour’s talk which could have been completed in 15 minutes and was padded out with redundant points and verbiage (see the House of Commons for examples), but repeating points in a different way can both help to drive them home or relate them to different audience segments. In one of my favourite talks, I use three different end of the world scenarios to support a single point about decentralisation and resilience.
7. Have a drink handy – Public speaking can be thirsty work but more importantly having a glass of water handy can be useful if you need a moment to catch up, have lost your thread, or need to think over an answer to a question. Those few seconds taking a sip can get you right on track. Depending on the audience and the venue, other beverages may be appropriate, but avoid straws, hot drinks, or anything sparkling, sour, or creamy (can stimulate saliva production, which you don’t really want too much of while speaking).
8. Pace your speech – People have a tendency to speak faster when on stage than they do normally, and not breathe enough. Treat it more like a conversation, pauses in the right places give people time to process, faster speech is seen as a sign of nervousness so slowing down helps, and one thing I always want to avoid doing is letting my mouth run ahead of my thoughts – slowing it down means your thoughts can keep up and helps to erase pause words (um, err, ah, etc) and impressions of uncertainty.
9. Interaction – Even if you are speaking in front of hundreds of people always remember you are speaking to a group of people with ideas, reactions and thoughts. Ask questions of the audience, although make it clear at the beginning whether interaction from them is acceptable. Simply asking for a show of hands or a nod can keep them engaged.
10. Admit when you don’t know – Although point one stated it was important to prepare for questions that people may have, you may still get questions which you don’t have an answer for. Whatever you do, don’t blag it. If you don’t know the answer, ‘fess up and say you’re not sure. Better yet, go with my favourite answer ‘I don’t know but it’s a fascinating question and really deserves further exploration’.

There’s a lot more advice out there about public speaking from vocal exercises to correct posture but keep these ten things in mind and you won’t go far wrong. A lot of the rest comes from experience and finding your own stage persona. Try out different behaviours and techniques while you’re starting out, and see what works for you.

So, let’s take a look at where cyber security certifications are going and their place within small medium sized business.

I’m a big fan of James and I have followed him for a very long time. So, it was an absolute pleasure when he offered to allow me to do a blog on his prestigious COFFEEFUELED blog. Looking for topics, it got me to thinking about lots of discussions that I have with people in industry that say certifications won’t stop you getting hacked, certifications won’t make you anymore secure, and generally there is a feeling that certifications aren’t part of the cyber security landscape but are a necessary evil.

To some extent I do agree with them having a certification will not stop you getting hacked or make you secure but, if done right, it is a consequence of having them that you will reduce the risk.

It’s very very easy to tackle certifications on the premise that you just want to tick a box and get that certification. It also relatively easy to do it. That’s for another blog.

The first thing to do really is to work out why you are going for a certification and where that certification fits in your strategy. Now let’s be honest, 99% of the time, certification is driven by customer requirement and customer need and companies are only going for certification because their customers are asking for it. Hence certifications will make you richer.

But it doesn’t have to end there. You can go about certifications in the right way, and it will have a knock-on impact and a positive impact on your overall security posture. Certification is not there to tell professionals who know what they’re doing how to do their job and at no point would a certification do that. It highly relies on the skillsets of the people that are already in your business.

But what it does do is enhances skills, knowledge and experience with the management structure and governance and management framework that allows us to put in some common operating models that have been proven to reduce risk and increase overall security.

It can only be seen that certifications are going to become more and more important as we move forward into 2022 and 2023. And the reason for that is that the security of the supply chain is one of the most significant risks to any organisation. The risk that your suppliers are not doing the right thing or don’t have adequate security in place. So, this shifts the conversation from the security of your organisation and the certification necessarily addressing your security requirements, but it moves it to ensuring that suppliers that supply products and services to you are themselves secure.

Now the way that you’re going to do that is either going to do an audit of that company and spend valuable time and resources to check that they are doing things to a level that you are happy and comfortable with or as is more and more the case you’re going to ask them for a certificate. The reason that you are asking for a certificate is a certification means that somebody else who is highly qualified and experienced in conducting audits has done the work for you.

You can see therefore that the unintended consequence of that is that the people that you do business with are now wanting to secure their supply chains and they’re going to be asking the same questions of you. Are you certified?

We can have a debate about the value of the various certifications from cyber essentials, cyber essentials plus, ISO 27001, SOC 2 … and the list goes on. But they all have their place and provide assurances back to customers that we’re doing the right thing for information security.

I don’t see certifications going away any time soon.

Cyber security is a complex beast, as to be successful attacks have to be prevented. To do this it’s important to pre-empt the cyber criminals as well as knowing the processes for countering the attack. One way of modelling this is via incident response tabletop exercises to recreate an attack before it happens, to work out how to fight it, and therefore how to prevent it.

How do they work?

Incident response tabletop exercises are interactive discussion groups with different team members from the organisation, where their roles in the case of various cyber attack scenarios are discussed.

The facilitator of the exercises challenges the participants, by presenting different scenarios (from real-life experiences) to see how they would react, as well as present the results of those actions.

These discussion groups not only identify gaps and weaknesses within the organisation and their preparedness for a series of attacks but will also make suggestions which will improve security within the business, increase the knowledge and skill set of the staff as well as their confidence when it comes to preventing an attack and knowing how to handle it should the worst happen. 

How can they benefit your business?

Incident response tabletop exercises can offer a great number of benefits to a business and should be considered an ongoing part of cyber security processes.

·        Forewarned is forearmed – If your IT network was victim to ransomware, would your team know what to do? Or would there be an element of panic whilst everyone worked out a plan? Through an incident response tabletop exercise, the process in place for dealing with a ransomware attack would be tested meaning everyone would knos what to do, so the situation could be dealt with efficiently with minimum downtime.

·        Fail Safely – If you do have a process in place for how to deal with a cyberattack, it is best to find out its flaws and vulnerabilities in a safe environment rather than ‘live’ when such vulnerabilities could cost your business. By testing the plan, you can iron out any problems and plug any gaps without the immediacy of an attack hanging over your head.

·        Cost saving – Although there is a financial investment with implementing incident response tabletop exercises as part of your security assessment it is marginal to what a ransomware attack could cost your business in computer downtime, lost business, lost reputation and potential fines for lack of security compliancy.

·        Teamwork – Keeping your cyber security recovery plan up to date is essential, as a robust security plan relies on teamwork, multi-disciplinary skills and the cooperation of everyone in the organisation. However, if your plan is outdated, and there have been numerous changes in staff the plan may not run as smoothly as you would like.

Training using incident response tabletop exercises ensures that everyone within the organisation knows what to do in the case of a cyberattack (as well as how to prevent one happening).

·        Peace of mind – Whilst no-one is 100% safe from a cyberattack the more you are able to do to prevent one from happening, as well as knowing how you would respond quickly and with minimum disruption can give you peace of mind knowing that your business is covered.

If you think your business could benefit from our ‘Fail Safely’ exercises, or you would like to assess the vulnerabilities within your cyber security recovery plan, or you just want to have a chat about how to improve your cyber security drop us a message today. You can never be too secure, but you can be under-practiced. 

Yesterday I ran the first, to my knowledge, security coffeehouse. Based on the ideas I’ve taken on from Cafe Scientifique, where years ago I had one of my first public speaking experiences (on the science of cyber security), the security coffeehouse is about bringing people into a conversation on a security-related topic.

I have to admit, the positivity of the response has been a touch overwhelming. I can’t help but feel this has tapped into something that’s needed as much as Cafe Scientifique was. To explain I guess a little background is needed.

The Cafe Scientifique movement was born from the idea that science should be brought into the open and discussed in the public sphere. Somewhat based on the ideas of the Parisian Salons of the 17th and 18th centuries, Cafe Scientifique is about letting people talk on scientific topics that they have researched, and letting an audience engage in the discussion.

The Security Coffeehouse idea is somewhat based off that, with a touch of the London Coffeehouses of the same period (if you’re wondering if they went anywhere, Lloyds came out of one of those coffeehouses). It’s about open discussion of security between people who know or are interested in something about it, and about making that available. Not about it being a peer to peer forum, or a vendor session, or a conference, just giving anyone who’s interested the opportunity to talk about it.

The feedback suggests that there’s a definite appetite for these sorts of events, so I plan to keep running them. Unlike the coffeehouses (or penny universities if you lived in Cambridge at the time), a relaxing drink in the hands of the panellists is strongly encouraged to help encourage the right relaxing atmosphere. I hope I’ll see some of you at one of these in future, whether on the panel or in the audience, going by the inaugural event future ones are going to be good.

Last mention – a huge thank you to the panellists from the first event, you made it possible, and you helped me realise it’s a viable idea.

Between various speaking gigs, running online events, writing for the Circuit, work, and some side projects, it’s been a while since I posted. Given that, I want to reactivate this with something that might be controversial and talk about pen testing.

Pen testing, or penetration testing, is the (usually) manual assessment of a system by experts in technical security. It can encompass, or be part of, red teaming exercises where physical vectors are also used, phishing testing, and similar activities, but the USP is usually that it’s done manually by experts (for a given definition of manually – any commercial pen tester who doesn’t script 90% of what they do is doing it wrong and wasting their time and your money).

Why?

There’s no denying the value of a well-scoped pen test performed at the right time in a product lifecycle. In the perfect scenario this pen test is comprehensive, with enough time to thoroughly delve into the system and provide proof of exploitation for all discoveries. Mostly, there isn’t enough time given for a fully comprehensive and thorough test, but there’s still value in this kind of deep delve.

Even if the test is short, and poorly scoped, it’s better than nothing so long as it isn’t taken to give a false sense of security around a product.

The findings of a good pen test can provide an organisation with a final check before going live to decide whether to accept, mitigate, or transfer any risks which are made visible. What a pen test cannot provide is assurance that the outcome of a project is secure, any more than any other testing. A pen test with no findings is like a house that hasn’t burned down – it’s no reason to skip having a fire alarm.

When?

The pen test should be the last step of your security testing stack. It’s the most effortful, and most expensive, form of testing you can undergo and so wasting it on false positives and easy-to-fix vulnerabilities is not a good way to spend your money. Ideally you should pen test when you have a production-ready candidate, in parallel with your last round of release testing.

On top of that findings picked up by a pen test will be far, far more expensive to fix (both in terms of effort, delay, and financial outlay), so you want to minimise the chances of things being picked up this late. Earlier development lifecycle stages should progress from concept testing (threat modelling is great for this, and making sure requirements incorporate security), code analysis tools and secure coding practices, vulnerability scanning, fuzz testing, and/or any other testing that fits your model.

Where is it going?

This is the bit that might be controversial, and I want to be absolutely clear that I am in no way denigrating the value of pen testing, or the expertise of pen testers. This is speculation based on what I’ve seen in the security industry, and what I’m expecting to come up.

Pen testing benefits hugely from being the sexy, hyped-up side of security. Red teaming and pen testing tracks get far, far more attention and excitement than the more reactive incident response side, and both get more hype than the fully defensive planning and design stages.

I can understand this. I’m a big fan of heist movies myself, when I want to relax and do something professional I’d rather do a bit of CTF or play around with something from vulnhub than review architecture diagrams and project requirements, and I know from experience that I can get far more attendees and interest at a workshop or presentation on lockpicking than I can one on threat modelling (caveat: based on personal experience and anecdotal evidence rather than comprehensive data collection).

This is a problem. The attacking side may be the sexy side, but it only has limited effectiveness when you’re trying to defend a system. Pen testing done well is a simulated attack, and a simulated attack is not a comprehensive, long-term, defensive strategy. A pen test is, at its basic level, running through a series of tactics and seeing if they work. The reason a lot of it can be automated is because the vast majority of pen test findings are known vulnerabilities already, and the pen test is just discovering them and showing they can be exploited.

So I genuinely believe that as (or if) we mature the blue side more, pen testing is going to become both less important, and much, much more frustrating as a career. In fact security overall is (hopefully) going to become less of a thrill-a-minute experience if we do it right. In my ideal world, pen tests will become more and more a case of continuous security research into discovering new attack vectors and vulnerabilities, and pen testing for existing vulnerabilities will disappear.

That’s a utopian world and will never be fully achieved, but the automation of pen testing as we mostly know it today is here and that poses a threat to pen testing companies. While it’s an uncomfortable truth for both attack and defense sides, penetration tests are mostly compliance driven rather than arranged out of a genuine awareness of security needs. With the growth of automated testing, I am reasonably certain that it won’t be long before automated testing platforms and frameworks are accepted for compliance purposes.

Forward-thinking pen testing companies should doing two things if they want to survive and thrive. Preparing to shift into a different way of working (and honestly, a more interesting one than running through a list of the OWASP Top 10 for a few days – this is hyperbole but does have a grain of truth) is the first. Educating customers that they can add value beyond achieving ISO27k, PCI-DSS, SOC2, CBEST, etc is the second.

Last year, along with writing a jokey little analysis of Santa’s GDPR situation, I put together a Christmas card for friends and family to enjoy.

This year, for anyone with an equally poor sense of humour, I’m putting it up here for anyone to use as they wish.

Christmas-Card-GDPR-2018

I have been neglecting this blog recently as finishing off my master’s thesis (now done, passed and everything), working on various tasks in a new role, and finishing off a contributed book chapter have been priorities. With two of those three taken care of I am hoping to have time to write a bit more on here again.

In that spirit, and as nice piece of synergy with the book chapter, a quick word about an incident reported today. I predict it will be the first of many.

Impersonation of senior executives via e-mail has become a well-established, and profitable, practice among both organised and disorganised cyber criminals. Some of the most advanced attempts go to extreme lengths of surveillance and co-ordination. Even the most basic mass attempts have seen some success. Whether to include this as insider threat is more a philosophical debate than one where we can draw a clear line, but I choose to include it.

With the advent of Deepfake algorithms it was inevitable that impersonation would go beyond email. Deepfake pornography created for blackmail or revenge purposes appeared shortly after the technology became available. Using it for impersonation has mainly been for entertainment purposes, until recently. As far as I know, this is the first published case outside of fiction of an attacker going this far in impersonation. That they did not think to spoof the source phone number, leading to early detection, is surprising.

There are possible solutions to this. Since we have yet to effectively solve the problem of impersonation by changing only the display name on e-mails I suspect they are a long way from widespread adoption.