Making Cyber Hygiene a Year-round Conversation

Max Havey [00:00:02] Hello and welcome to another edition of the Security Visionaries Podcast, a podcast all about the world of cyber data and tech infrastructure, bringing together experts from around the world across domains. I'm your host today, Max Havey, and today we're talking cyber hygiene with our guest, Rich Davis, director of Product solutions marketing here at Netskope. How's it going today, Rich?

Rich Davis [00:00:21] Yeah. Hey, Max. Great to be here. Looking forward to today's conversation. Certainly one that's dear to my heart, having previously, in, in great detail, around the human factor and and how humans can affect things. And certainly the today's topic very much aligns with that.

Max Havey [00:00:36] No doubt. So yeah, let's jump in here. So as the year starts off, we tend to see a lot of cyber related awareness days. Things like National Change Your Password Day, which is on February 1st or today when it's coming out is Safer internet day. But in your experience, have you found that these sorts of awareness days are really that effective? Like, what do you see them sort of driving the change that security professionals are really looking for when it comes to dealing with that human element?

Rich Davis [00:01:05] Yeah, I mean, these are of course a bit of a double edged sword. Firstly, we can't fault any publicity. Any publicity in any awareness is great. I think the problem is that, as with all of these sort of things, it can become a bit of a, "okay, I'll do it today and I'll forget it another day." And of course, this needs to be a year round effort, certainly when it comes to our, our users and that people, they're the first line of defense. And therefore they need to be thinking about this and they need to thinking about security and what they're doing day in, day out. So again, great that we focus on it on a particular day. Not so good that, it may then lead to them forgetting about it another times. And this is often seen in data as well. Just if you look at some of the, the historic data around user behavior, you actually see that, if, you know, a week or two after, security awareness training happens, you get a better result, you get lower click rates through, content. There were more likely to do those things. They remember things like DLP alerts drop as well, but then it tails off. And yeah, that's why these sort of things to be pretty effective. Yeah. Organizations really need to be thinking about this is a constant evolution. Day on day, week on week.

Max Havey [00:02:16] Definitely. The half life of security training is pretty low based on everything I've ever heard from our various members of the CSO team here. So finding ways to keep it going in the consciousness throughout the year is very good. But just single day it seems to be kind of ineffective overall.

Rich Davis [00:02:32] Yeah, yeah, most definitely. And I think, I think these, these safer internet days and change your password days really should be in a way resigned to that bin of yesteryear. And really, we should be thinking about this, you know, far more holistically.

Max Havey [00:02:47] Definitely more of a year round cyber hygiene conversation as opposed to, you know, just just single days where they're well intentioned. But the results aren't always exactly what we want.

Rich Davis [00:02:56] We should be calling it safer internet life. Really?

Max Havey [00:02:59] Most definitely. And I guess that brings us to our first real big question here is thinking about cyber hygiene. Why do you find that cyber hygiene can be a difficult, sometimes tedious task for organizations to really take on and make kind of a year round objective?

Rich Davis [00:03:12] Yeah, I think part of it is there a historic aspect. So I we've all been there, we've all had that email through that we dread, and it's that yearly time to go until your training and you think, oh, this is eight hours, I haven't got time for this. And we've automatically got this negative opinion. And I think as individuals, I think we also have this inbuilt sense that we don't need to do this, that yeah, we have common sense, we know what we're doing. So I think those do definitely play a part. And I think that's part of the problem. I also think that all too often it's driven around the benefits to the organization and not the benefits to the individual. And I think there's a lot and we've seen this really be successful is when it's focused around the individual in their families. If you can extend it to, you know, how to keep you and your family safe. Then organizations, I think, have more impact because you make it relevant to that individual.

Max Havey [00:04:01] Definitely appealing to the personal side of the user kind of feels like the way to make it real to them. And it's not just, you know, speaking about broad, abstract, sensitive data. It's your Social Security number. It's making sure that your passwords are safe and your banking information is safe, like it is personal, identifiable information for a reason. In that same vein, here in your roles, how have you found ways to promote better cyber hygiene practices within your organization? Maybe better emphasizing that sort of personal element that is a part of all of this?

Rich Davis [00:04:30] Yeah. And I think it really comes down to a couple of things. Firstly, kind of how you're designing that training. And yes, we're focused, you know, specifically on identity and passwords to an extent, but of course much broader than that. I think it's about that, as you say, making it personal. And that means giving real life examples that may happen to you both in a business sense, but then releasing it to something that they can understand, maybe in, in a personal sense. So relating that stealing of your own personal credit cards to stealing of company PIA or, intellectual property. And the effect that can have. Because again, you make it personal, you make it real, and you make it kind of linkable to what they think about day in, day out and what what they might personally, care about. I think if we think about it in terms of, the other side, which is the time. And when we do this, I think this is really about just drip feeding it through the year. I think organizations only have a certain amount of time that they can spend training their users in a year, and too many organizations will go "Okay. Right. Eight hours. We're going to do or once you on this date." And actually a far more effective way is to break that up. Yes, you might have, for compliance reasons, the need to take certain training on a yearly basis because you have to meet those requirements, but outside that far better use of time. It is to drip feed it and have that just in time training, but also make it relevant to situations that the company is facing. If you can actually, inform the, the, the user, your people as to the types of threats that are relevant to your organization rather than making it too generic. Then again, it gives you that link to the organization. They can understand why they're being asked to take certain training. And therefore you're going to get an overall better response to that training. And I've seen this, you know, firsthand in my past life working with organizations and trying to track the changes in the behavior, moving from this kind of once a year to, a much more targeted training program that rolls over the period of the year where you drip feed content, you just be training, and you make it much, much broader than just that, e-learning that occurs, once a year on that portal.

Max Havey [00:06:44] Definitely. And just to dig in a little bit more, as you sort of talked about, you know, finding ways to make these sorts of trainings relevant to the specific user in their family, in their daily life. Well, can you give us some sort of examples of what that sort of looks like and how that sort of how that sort of plays out?

Rich Davis [00:07:00] Yeah. Let me give you a relevant example to myself. I've got, children that have just turned to become teenagers for the first time they've started to have control of their own bank accounts. We've gone from looking after them oueselves to giving them access to having apps on their phones and, be able to use Apple Pay. So this is personal to me directly, but this then focuses around, well, how do you protect that? You don't want your hard earned money that may have been earned through chores in the house disappearing overnight because you've been careless with your information. And therefore, you know, at a young age, we started to talk to them about staying safe. They both got password managers that they can store their their key credentials in. I've talked through why this is needed and, and tried to make it relevant to that situation they're in. So I think it's just, you know, one great example of where you can try to, to make that relevant. So they're now using password managers day in, day out. It means that they've only got that one credential that they need to remember. It can be complex because there's only that one thing to to remember. And this is a 13 and a 15 year old. So if they can do it then, you know, there's no reason why every person from a business perspective can't do the same thing. My daughter now forwards me, smish through and she's like, oh, dad, look how obvious this one is. And, you know, it's just a great example of where we can actually see, you know, the benefit of what we're doing. I think another great example is making it relevant to what people understand day to day. So, if you look at YouTube, there's been a huge series of hacks on really very well known YouTube channels, including some of the biggest tech and security channels out there. Linus Tech tTips. One of the biggest kind of tips that a lot of people watch in this area. They they had their YouTube account compromised, and they're very much somebody that has the best security practices that uses password managers, uses 2FA, yet there's still a way around it. And this is where that human element, again, has to come in, is that this isn't just about protecting and stopping people gaining access, but it's about spotting and informing that organization very quickly. And in that particular case, somebody spotted some unusual behavior. And instead of trying to covering up and thinking they've done something wrong, they contacted somebody within the organization straightaway and they were able to deal with it much, much more quickly. And again, that then gets into the realms of, well, what is your exposure? Even if somebody has managed to breach an organization, what other tools have you got in place? Because this isn't just about authentication alone. And certainly when we're talking to users, this isn't just about identity aspect. It's other things that they can do to make sure that they're safeguarding information.

Max Havey [00:09:50] Definitely. And to to double click on what you just brought up there. How do multi-factor authent