PP131: Making Security Awareness Training Actually Effective; Plus, How IT and OT Overlaps

Drew (0:06)

Hey, everybody, Drew here, just to let you know that today is a double-header episode. JJ and I talked to two separate folks. We recorded these episodes live at the CyberSecCon in Houston, Texas. First up, we're going to hear from Jayson E Street. He's going to talk about how to make security awareness training effective and engaging. It's a really good conversation. In part two, we're going to talk with Jonathan Polay about how IT and OT security overlap.

Stay tuned for two really good conversations coming right up.

JJ (0:31)

Hey, everybody. Welcome to Packet Protector, the podcast at the intersection of networking and security. I'm JJ here with Drew and we have Jayson E Street, the famous.

Infamous.

Swarm fellow from Covert Swarm. Joining us today, you guys probably know Jayson, long history of doing physical security and OSENT in our space. So you've seen his face before. You might be seeing it for the first time on our channel. I've known Jayson a long time. We had some interesting conversation of the night. You had a talk yesterday here. We are recording live at CyberSecCon. I'm really interested in your talk. Talk us through the premise and then let's dive into that.

Jayson E Street (1:14)

Well, 15 years ago, because I'm old, I did a talk at DEFCON 19 And even though it still makes me cringe every time I think about it, it's like because it wasn't the greatest, I think, of my talks. It turned out to be very pivotal in a lot of people's careers. So whenever someone comes up to me at a conference, that is always the first talk they talk about.

It was voted, it's like it's one of the voters, which is biased, of course. It's like one of the top all time talks from Black Hat and DEFCON, which I don't think it deserves, but it's got a lot of notoriety. It's like millions of views. It's like, it's just that thing. And so-

JJ (1:58)

And what was that talk about?

Jayson E Street (2:00)

It was titled, Steal Everything, Kill Everyone, Cost Total Financial Ruin, or how I snuck in and misbehaved, something like that.

Drew (2:08)

Which is what you do.

JJ (2:11)

You get paid to sneak in and misbehave.

Jayson E Street (2:13)

Yes. So I tell people, it's like, I don't care about your compliancy. It's like, I'm not trying to audit you. I'm just trying to eff you up. I'm trying to be the worst thing to happen to you at the worst possible time, the worst possible way. I'm great at parties. It's like, that's what attackers and criminals are doing. They're not trying to rob you versus to compliancy.

They're just trying to rob you.

JJ (2:36)

Right. They're not like, it's a holiday, your security team will be stretched thin, and so we'll wait and hit you on a Wednesday to be polite.

Jayson E Street (2:46)

They never looked at a website and gone, oh, this is PSAC and partner. Okay, I guess I'll move on to the next one. It's like, it's not going to happen.

So I gave this talk. It was like, so it was about how I've actually went in and robbed people and did things. And then I talked about what the biggest problem is.

JJ (3:07)

When you say rob people, can you like give the viewers a little context about what that means?

Jayson E Street (3:12)

I do a thing, I call it silver teaming. It's like I even got a website, silverteam.org now to explain it because I don't do red teaming. Red teaming is an offensive security term when people go in and emulate an attacker, and then they give a report to the executive saying, this is where your failings are.

Purple teaming is where red teamers work with blue teamers and then report to executives about, this is what we've learned, this is what we've done and what we discovered. Silver teaming, I report to the employees.

I go in, I go in and become like, I use red team tactics and I try to be the worst thing I can have to you, it's like at that moment. But then I leave for two minutes and then I come back after I've successfully proved that I could escape and I talk to every single person I compromised and I have to look them in the face and go, you helped me do a bad thing, I was a bad guy, this is where we can do better. And so it's a horrible moment, but I always provide that silver lining. It's like, and that's why it's called silver to me because I provide for every teachable moment, there's a silver lining and I also guarantee with my clients that I will get caught by the end of the, before the end of the engagement is over, I will get caught. I've had to, oh my gosh, some of the things I've had to do to make sure I got caught. You just have to do crazier and crazier stuff until somebody's like, this guy was letting me spin around in a chair for 20 minutes behind the teller line of a bank in another country and he wouldn't, he already let me into the network access and it was the last bank I was robbing and I was like, I need to be caught. This was the one that I was, and he wouldn't let me. So finally, and I have any excuse really bad, so I'm like, I just topped them on the shoulders like, what's the user ID and password for this computer that I'm at the desk I'm sitting at? It was one of the server processing computers, desktop machine.