Presenter:
Transcript:
All right. Thank you for your, for your patience. My name is, Kenneth Lindbloom, and, I have a foot in two different worlds. Which gives me, a unique, cross-disciplinary perspective. That I'd like to bring to incident response planning and, and training. So, as those, as they were saying, I've been in cybersecurity for, 16 years.
And a variety of blue team roles, including analyst, engineer, consultant roles, in a variety of industries. But I spent nine years in oil and gas. I recently pivoted to OT cyber security. I got my bachelor's in network security from UT. Sand certifications. But I also have a foot in another world. The world of public safety.
Where I've been a volunteer EMT with seven years of experience in search and rescue, which includes ground searches for missing persons, flood and hurricane response, water rescue and high risk teams. And what I mean by high risk EMS is in traditional, emergency medical services. Your ambulance team, they always stage four, for a violent incident in what we call the cold zone or the warm zone.
If there's a violent incident, police go in. First, they secure the scene, and then EMS goes in. I've had the opportunity to, serve on some deployments where my team would go in. It's a nonprofit, statewide agency, and we would get called in by local government and, local offices of emergency management and, some individual agencies.
And one of, one of the deployments we would do every year, was supporting a local emergency services district. When they would be overwhelmed with, basically partiers kind of a spring break situation and, for almost a decade, until a new sheriff, took over Galveston recently and put his foot down. These things would get absolutely out of control.
For a while, there was at least one shooting every year. People getting hit by vehicles, people getting drunk and driving, and just creates this nightmare, high stress scenario, which is very, very different than, normal EMS where you're safe in your ambulance typically. And, you are deliberately staging in the cold zone. This is a form of EMS where any where you could be in the hot zone at any moment.
Is is at in the blink of an eye. So this gives gave me a little bit of a different perspective when I started working on a master's in emergency and disaster management, and I, was doing some research into, skill retention and developing operational medicine programs, specifically for search and rescue dogs. But I spent a lot of time studying skill retention, and also studying human performance under stress.
Performance and retaining skills under stress. And, in addition to the research I did in school, it became one of my favorite subjects for a while. Did, quite a bit of reading. And that is what I'm going to share with you today. So if you're interested in copies of the slides, I'll have them posted on GitHub.
Within a week or so. You can take a picture of that or get with me after the talk, and also reach out to me by email, LinkedIn, or signal. All right. The intended intended audience here is, hands on keyboard incident responders who are trying to lead from the bottom up. And I will give you an example of what I'm talking about there shortly.
The primary audience, the people intended to actually use what I'm going to talk about here today are security managers. Executives, other stakeholders who would be involved in the process of managing incident response but not actually be the boots on the ground doing it. There's also some potential relevance in blended it in OT environments where you're incorporating, emergency management.
Typically in, in it, you know, in a, in a company where you don't have OT that's not very common. But I have come across a few companies who, they have physical safety concerns. They're operating, you know, an LNG plant, something dangerous where people get could get hurt and they take a more comprehensive, approach to, both, cyber and, and safety incidents.
And this could potentially be useful, there, but we're not really going to go into, that use case. This is intended more what I'm talking about today. If you're in a traditional, i.t environment doing it incident response.
All right. What we're talking about today are really overpriced binders. I've got examples up here that, you can come and take a look at if you want, after the talk. These are incredibly expensive. And you could do the same thing that I'm talking about with a binder that you buy from Dollar General. But that doesn't mean it's not useful.
This allows you to leverage magical thinking, to introduce new training and procedures, to your leadership. And there are some psychological benefits. And the majority of what I'm talking about here isn't so much the binders. Although we're going to cover that. What I want to take away, what I want you to take away from this, is the psychological benefits of training leadership to perform under stress.
And my approach to this, as we're going to cover is,
Implementing the battle boards, not just the binders, but combining this potentially with the incident command system, which we'll get into and realistic exercises going beyond your traditional, basic tabletop exercise.
All right. So a little overview, we're going to go over magical thinking, human stress reactions. Talk about what these battle boards are and how they're used, how they can be adapted to, it incident response. We'll go over the incident command system. We'll go over my recommendations for creating realistic training. That increases performance under stress.
And, we'll talk about some of the writing instruments that this company sells and sturdy away from some expensive stuff that doesn't work. And, we'll go through some examples. And if there is time, we will have a bonus slide where I will give you a silver bullet for stopping your users from clicking on links and emails.
Well, if I don't get to it, feel free to come up and ask me. It will work, but you won't like it. Or rather, your bosses won't like it. All right, so harnessing magical thinking. What do I mean by this? By magical thinking, I mean, you've got a situation where, you are imbuing an object or a tool with more power than it really has, and focusing only on the value of that tool and thinking it's, you know, some magical talisman.
A few examples. I worked for a managed security services provider and, cynically on the inside, all of us analysts referred to ourselves as check box security because that's what customers were coming to us for. The bare minimum check box security and, my my favorite story was a customer who, we did a site visit, and they found our intrusion detection system still in its original shipping box, under someone's desk being used as a footrest.
You see this a lot in in cyber security? You buy, you go out and buy a firewall or a Pam platform or something else. You don't really, truly, properly configure it or maintain it. And then you think you're safe. This is magical thinking. Some outside examples. In the firearms community. I'm a firearms instructor.
You see a lot of people who, you know, they want to be safe. They want to protect themselves and their family. They go out and they purchase a firearm and, stick it in their door and maybe go to the range, once, once a year or so. If they're if they're lucky and they think they know how to use it, and that's not the case.
We see a little bit of this in search and rescue as well. We have something we call gear acquisition syndrome, which is especially common among new members of the search and rescue team. You get really excited, and you start buying stuff when you'd be better off putting your money and your time into training. And then, are there any veterans in the room?
Well, I'm sure you've, you've heard, you know, laughed about civilians getting excited about military grade. I wasn't in the armed forces, but my search and rescue team started out using both a mix of POVs personally on vehicles and, military surplus assets like Humvees, five tons, and TVs. We use these for high water rescue.
And the leadership fell into this realm of magical thinking. If the military uses it, it must be good. But these things just fell apart and become, became massive money pits. And fortunately, you know, leadership came around to realizing we'd be better off outfitting some, off the shelf pickup trucks, to do water rescue and water fording than we would military vehicles.
You see that a lot? Magical thinking. Oh, it's military grade. It's got to be great. And. No, no, it's it's not. There's a lot of this, both inside the the cyber security community and outside, but you can use it to your advantage. And that's what I'm going to teach you here is there are training ideas that you could introduce, ways of organizing your incident response plan and giving certain people who, need a job to do a job to do.
So they're not hovering over your, you know, your incident responders and and distracting them. And you can do that by instead of going to Dollar General, you can go on to the Battle Board website and order one of these. And, it will carry a little bit more weight, to the average person than that, Dollar General binder and can be used as a entry vehicle to introduce some of these ideas.
So I'm going to give you a quick example of, what I mean by, a panicky exec. And I am not talking down on this person. Obviously, I'm not going to go into details. I'm not I'm not meaning to to throw shade at them. Most executives who, you know, they've never had any public public safety experience, any military experience.
They you know, most of the time their job is probably pretty calm. There's a kind of stress that can be induced by, you know, deadlines or a micromanaging boss. But that's not be the same as being, put in a situation where you feel like your livelihood and your reputation or the line are on the line, and maybe, you know, the stakes aren't as high as as doing a job where, you know, people lives are literally on the line.
But to that person who's never known anything, outside of, you know, sitting behind a desk. When you have, you know, a ransomware attack and you're a C level and you could be really stress thinking, this could be my job, this could be my career, this could be my means to, take care of my family. Just, you know, ripped away from me.
And I saw that happen with one, c level that I reported to, a CIO, and this person was a great strategic leader. And in a strategic sense, she was very good working with people. But in the course of reporting to that individual, we had several incidents. All of them were false positives, and some of them were obvious false positives from the start, like network traffic.
Going out to Microsoft for updates being flagged by Meraki as, that got flagged by Meraki as, C and C traffic. And it was obvious just looking at the logs right away that this isn't, this isn't a real incident. We're going to follow due process and, you know, do our investigation and and make sure we got our I's and cross our t's.
But it was an obvious false positive, and the sea level just got really stressed and started micromanaging and panicking. And one of my division leaders, in search and rescue, she had the saying, spread the calm, which is what a leader should be doing. If as a leader, you were getting stressed out and you were micromanaging in high stress situation, you're not helping your team.
You need to be spreading the calm and the way we would deal with a problem like this in In Search and Rescue in EMS, if you have a have a patient who's hurt and there's family members or bystanders nearby and they're freaking out, you give them a job to do. For example, maybe it's really hot. The sun's out.
You say, hey, grab the shirt or blanket and hold it up to create shade. I've experienced this, tending to a patient, a child who got hit by a vehicle, on the beach. And a parent got involved when we were trying to take spinal immobilization, precautions, and just interrupted our whole process. And we had to be like, here's a job for you to do.
You can't take that same approach, obviously, with your manager or an executive that's not going to work. Well, but you can slip the idea in using tools like these. So this person, they couldn't handle the stress of an incident, weren't good at managing their people during an incident. But that's not that person's fault.
At least not the way that I look at it. Performance under stress can be built, by repeated use of skills and procedures, building muscle memory, realistic training that induces stressors. And I'm going to go into that. And I feel like it's important to note from my, my research in emergency management that didactic testing proves nothing by that.
And by that, I mean, I reviewed a lot of scientific papers. Studies on, on medical skill retention, and it was consistently shown that high that high scores on tests do not at all correlate to someone's ability to actually use those skills. In the real world, so you can have a degree hanging on your wall. Maybe you got a bunch, you know, sand certs stacked up or whatever.
That doesn't mean that you can perform a complex task or series of tasks under stress. And scientific research proves that, memory and performance under optimal conditions. Also, if you're doing like a tabletop exercise in a normal calm environment, I facilitated and developed some, that that memory and performance shown under under those circumstances may not be the same as someone's performance, under stress.
If you are interested in learning more about human stress reactions, I can recommend a few good books. The unthinkable, by Amanda Ripley. The Gift of Fear by Gavin de Becker, blank and, The Body Keeps the Score, which is a, which is a really good one.
All right, so what are battle boards? Like I said, they're overpriced binders. There are many varieties for different use cases, which range from military, law enforcement, EMS, search and rescue and some other professional disciplines like, aviation. There's only one company making products like these, that I'm, aware of. I have experimented with them, a couple of these, on search and rescue missions.
This is used in search and rescue some, but my team doesn't use it. I did my own testing, though. Had some interesting, results. The examples that I brought that are relevant to you are the battle board scout. This one, we won't be giving examples of how, this would be used in incident response.
This is this is more of a personal note taking an organization thing. I love it because I could keep it in a, in a cargo pocket, when I'm in the field and, keep track of my notes and maps. We've got the, the field folder, which is one of the lower cost options. It doesn't have as much in the way of functionality.
But it still takes advantage of that magical thinking component. And the battle board fist, which I don't have enough desk space to do this up here. But you'll see pictures. It opens up. And this one was designed, for a military use case, specifically, coordinating indirect fire like artillery. But it has other applications, like, in EMS and in fire and search and rescue and in particular in search and rescue.
This one is useful for, battle tracking, for keeping track of your, your assignment areas, your search areas, your teams and where they are, where they're at, what areas you've searched, what areas you haven't. But I'm going to show you how this can be adapted to cyber incident response.
All right. Incident command system. If you haven't heard of it, this is something that is worth looking into. Incident Command System is a system, as the name implies, for managing incidents and events. What do I mean by that? An incident being something like a, a hurricane, a flood, a fire, a car accident, an active shooter situation?
Those would be considered incidents. It's also a system that can be used to organize teams for events, you know, so if you are planning medical resources and police and security for a football game or a concert, that would be an event where the incident command system, could, can be used. And this is a way to organize your teams and create a command structure, that has some flexibility.
It originated, after, some wildfires in California, I believe it was in the 80s, if I'm remembering correctly. Maybe before then. And they had a whole bunch of fire departments, from different places, show up to help put out this wildfire, and none of them could communicate with each other. They didn't know what the chain of command was.
And it was a huge train wreck. And after nine over 11 with some, you know, changes that were introduced, federal, federal grants became contingent, for local agencies on adopting the incident command system and much of it you can take for free. A little warning. It is very dry, at least the first four basic classes, but is 100 is 200 is 708 hundred.
Those can all be taken for free online ICS 304 hundred. These are each, two day in-person classes. They don't court cost much to attend. You just have to find a class and, you know, do the take care of your travel expenses. These, these go into a lot more depth. They're instructor led, and they have, hands on exercises.
And from personal experience, like I said, some of the original the early is classes, they're they're dry, but the concepts really come to life when you have an instructor leading you through practical exercises and you, you get a much better sense of how to organize a team for an incident and how to scale things up, to, to respond to the size of your of your disaster.
Another free training resource you could look at is FEMA's Community Emergency Response Training. There's an ICS component and that and, hands on exercises as well as lectures and a textbook that's typically, I believe, like, taught over eight weeks, one night a week. And it doesn't cost you anything. You just have to find a, a local class.
All right. Training like you fight. So I realize it's not realistic for every organization, you know, corporation to adopt an incident command system. But it is something worth considering. We see this more, you know, in companies with an OT environment, with safety concerns, but it's something worth exploring. With ICS, everyone knows their role.
They know you know, the chain of command. And you would think, oh, the chain of command, it just goes off of, you know, the, the org chart. What they teach you in ICS that that's not how it typically works when there's an incident. The first person on scene is the incident commander. And then as more resources arrive, it is the person with the highest level of relevant skill and experience.
Typically, that's put in the incident command role, which, probably wouldn't go over well in a lot of corporations. But it's it's a very effective approach. Next component is the battle boards. If you have someone who is a manager or an executive or another high level stakeholder and they don't have an actual role to do, during the incident response process other than ask your technical guys, you know, every five minutes, where you at with, you know, the incident, you know, is it resolved yet?
Rather than doing that, you can give them a job to do. And basically what you're having them do is almost in a sense, being a scribe and a scribe is a role that we use in, and various public safety roles and search and rescue. A scribe is someone on an individual team who keeps track of everything that's being done and takes notes, and this goes into a formal report.
Of course, we do stuff like that in cyber as well. You should be keeping notes, during an incident and compiling those into an after action or a hot wash, to discuss improvements that could be made. If you just came out and told the manager, hey, why don't you be the scribe? They're not going to like that.
But if you go, hey, this is military grade binder right here, and this is this is how we can stay organized. And why don't you keep track of the checklists of, who on each team has been, you know, called, after hours to get them start, you know, spun up on the incident. Who's responded? You keep track of the other stakeholders, like insurance and the board and when they need to be notified, etc. I won't keep going into detail there.
But this gives them, you know, a shiny new toy to play with that ties them to a task that helps them manage, without floundering and inducing stress. It also keeps everything in one central, physical location. So ideally, my approach to developing an incident response plan is you have not just, digital copies, but a at least one paper copy kept in a central location, usually with, you know, my, my, my C levels office.
And this should be, you know, replaced with an updated version at least annually because the incident response plan should be, updated annually. And if you make, you know, a shiny new toy like this, your central repository for your IR plan, and everyone knows where it is, and you incorporate it into, into annual, hopefully more than annual tabletop exercises or simulations.
This ensures that you're keeping that up to date. Because once a year, you know exactly what you're grabbing. Open it up, run through a scenario, and you are confronted when you open up this book with, is this the most recent version? Hopefully. And, you should be replacing that with the current version as well as you can keep some, USB drives in here with, break glass, passwords, accounts, wife boot images, for forensic response, things of that nature.
And you can keep it all together in one place, where, you know, where it's at. You're also building muscle memory with standard operating procedures, in, in regular tabletop exercises. And you can introduce realistic training that goes beyond a tabletop exercise. I'm not going to go into detail here, but if you have the chance to Google femur evaluated exercise.
This is the public safety approach to tabletop exercises. I had the opportunity to participate in one for a nuclear power plant. The South Texas Power Project, where they brought in all the local agencies. The county judge was there, FEMA was there, and they did a tabletop exercise on steroids. They're they're really cool. The way you could take a similar approach, for one thing, is to add stressors.
Some, some of the ways we see this in, like, the E-m-s side is I've taken, tactical emergency casualty care classes, where you learned it, provide medical care under fire, like in and, active shooter situation. And in that, in that setting, they are introducing stressors in the form of pyrotechnics, sound, fake blood imagery that is meant to, you know, to get your heart rate up, your adrenaline spiking and, and really test you.
There are other ways you can add stressors, outside of that, that that doesn't apply in, in, in this setting, time, you can give people, you know, a time target and make it, you know, a little on the short side just to stress them out. You can introduce a scoring system and introduce accountability. So not just, you know, you reporting to your boss, but get your boss's boss involved.
And if that's possible and it may not be in your organization. But I think back to that situation where I was dealing with the sea level and the way I would train her to perform under under stress is to bring in someone above her to, deliberately play a part to induce stress every five minutes. Hey, where are we at?
Where are we at? In inducing stress and see how they perform. And then after the end of the exercise, do a hot wash and say, how can we fix this? And it's also it's also experience, that is going to acclimate, someone to working in stressful situations. And I would also consider doing exercises off hours, which won't be popular.
But if you're going to go be on a basic tabletop exercise to actually doing like a full blown simulation of an incident, and you are having to call in your, you know, your technical teams, not just the on call, but subject matter experts and analysts that you need to assist with incident response and notifying, you know, other, other stakeholders that need to be informed.
If you were to do that during business hours, of course, everyone's going to respond. If you can do this off hours, that's a lot more realistic. An incident isn't going to happen when it's convenient for you, not a real one. So this could be this can be a bit of, of a big ask for, a lot of companies.
But if you can do a more good beyond the basic tabletop to a simulation. And do this after hours, you're going to get a much better idea of how you perform as a team. You know, do does most of your team, they don't answer their phone. They're not paying attention to their email. And you're calling them after hours and they're not, you know, spinning up and connecting to the to the bridge.
Well, that's how they would probably perform during the real thing. So might be good to test that before you get into the real thing.
All right. We're going to go over the, examples. And, if you want to take a look at these, afterwards, you're welcome to I have put some, sample material in here for illustration, a, incident response template from next, and some other, like, appendices and, reference information that isn't doesn't belong to an actual organization.
So there's nothing sensitive here. The first battle board, we're going to go over is the, the fist, the orange book. You can see when you open it up, it has, to two surfaces. And these are meant to be used. As, like a dry erase kind of thing. And the way you would do it is, you know, most of the time it's meant for maps.
We're not working with map maps here, although, you know, you could have a network topology map if you wanted. But you can have a basically a portable mini whiteboard, if you're not in a setting where you have a, traditional whiteboard on the wall, you can have it, you can use it as a way to track like, you're a have an example of, an incident organization chart, and you're filling out the, the command structure.
So I would use these two surfaces for either collaboration, or for some type of form where you're going to be checking things off, checking things off, and then needing to, the, needing to go back and change it. So, for example, if you're doing some kind of team assignments or other individual assignments and you want to record, who is currently assigned to a specific task, and then you're going to have to change that or make notes, a dry erase surface, could potentially be useful for that.
It also has an interior clipboard for checklists, reference materials, a three ring binder for a full copy of the air plan, and let's take a look at that. This is the, one of the dry erase services. I was, speaking of this is the incident, organization chart, where I have, written down who is filling specific, specific roles, during a specific operational period.
And here's a collaboration surface just using it as a whiteboard.
And on the interior, you can see on the left hand side there is a clipboard where I've attached, some reference material, like a, a checklist, some contact lists, things of that nature. And then there's a pocket underneath that clipboard, where you can put more reference material. And you can see on the right hand side is my incident response plan, which should be changed out when it's updated every year.
It's a close up of the EIR plan. And on the other side of the three ring binder, you have a little mesh pocket where you can keep, a notebook right in the rain is probably overkill for, it, but that's what I had on hand. You can also see I kept a couple USB drives in there with break glass information, break glass passwords, live images, things of that nature are kept in a central location.
You can see the reference material on the clipboard. The checklists.
Projector. There we go.
There we go. A reference material.
And this is the, the field folder right here. A lot more simple. Like I said, it has a pocket, which you could write on if you wanted to. I've got reference in a network topology map in there for, for reference, a copy of the incident response plan. And then. A notepad for taking notes for scribing.
And when it comes to writing implements, if you go to the battle board website and you, order one of these, you'll see some recommendations for writing implements that they sell. Starting on the left hand side, they have right in the rain pencils, and pens. Those are probably overkill for it if you're not going out in the field.
But they, they work just fine. They have to the right of that. You'll see, Luna color, permanent markers, which they recommend. But you notice that there's alcohol pads underneath them. I think maybe for, you know, a military use case, it makes sense to use that. But for in just my experience testing the stuff in the field and search and rescue, I found I found that to be undesirable, because it is a pain in the butt to clean off.
They give you those alcohol pads, to try to wipe it away, off of these writing surfaces. The the clear ones, and it is not as quick and easy as just using a dry erase, pen. It works. If you want something that's mostly permanent and you can take off, if you need to. But if you are going to be, you know, using and reusing and changing things constantly, it's just too much of a pain to clean up.
So I would stay away from the Luna color permanence, to the right of that, they have mechanical grease pencils. I'd stay away from those too. They have a very broad point, and it's it's difficult to be precise when you're writing with them. To the right, they have just regular grease pencils, which I think work much better than the, the chubby mechanical kind.
And to the right of that is, for the dry erase surfaces. If you actually intend to use something like that for collaboration. Little regular dry erase markers. Work a lot better on these, surfaces than, those permanent markers. Do. So, in conclusion, what we've been talking about is introducing a training strategy, and the incident command system, the training strategy being, introducing, realistic training that goes beyond a basic tabletop exercise, where you have only, you know, the biggest stakeholders sitting in a calm, you know, calm, collected, air conditioned room with, you know, food and beverages provided, going beyond that to something that feels a lot more realistic and
brings in, more stakeholders, both at the higher levels and the lower levels, and seeing how they respond when they're put under stress, seeing how they remember procedures, how they adapt to changing situations. And using the incident command system, if that's something your organization would consider to be better organized as, as a team. And if you have been in a situation like I have, where you have someone who needs a job to do, during the incident response process, this right here could be a way to do that.
And because it's military grade, you might be able to convince, a stakeholder that, these new approaches that, you're wanting to take, are worth it because it's it's used in other disciplines. That is the strategy for introducing these ideas. All right. Bonus slide. The silver bullet for getting your users to stop falling for phishing attempts.
I would love to do that, but people need to send emails. No, the silver bullet for getting, people to stop clicking on, links in phishing emails is to implement a good understanding of human nature. We like to talk all the time about how security is a team sport. And, you know, when I've looked at know before trainings, they all talk about how we're one team and security is a team sport.
But I think it is awfully naive to think that your average office worker, actually thinks of it that way and takes it seriously. I know that some of them will. But that that's just not realistic. You need to you need to factor in a person's, self-interest. So the way you would do this and I came to this conclusion after being in one position where I was managing.
No, no. Before training and no before phishing, tests for an enterprise. And I saw that there were a lot of individuals who you could tell just by looking at the stats for their grades and the time they took to do training, that they weren't taking it seriously. You had people who took an hour plus to do something that should have taken ten minutes.
You had people take, you know, 60s to do something that should have taken ten minutes. You had people who kept failing and failing and failing the training. You had people who kept failing and failing the exercises and not learning. It became clear to me just from seeing this, this data, working with. No before that, no one actually cares.
Not not outside of our bubble of thinking about security. You can't expect them to care the way you fix this. Especially if you have, you know, something like. No. Before in place is to tie, performance reviews, bonuses and promotions to performance in phishing exercises, compliance with, security training and actual, you know, did you fall for a real phishing attempt?
Now, a lot of managers and execs would be horrified at this idea. But at the same time, when stock prices dips, dip, you know, people are getting laid off after they've, you know, they've come off of maternity leave two weeks ago. So I think if you're going to be, you know, kind of that cold and how you deal with people, you might as well be smart about it from a security perspective.
And if you introduce this idea, there would be a lot of people who would freak out and complain and be like, that's not fair. And you people worried about losing talent? But if you want people to take security seriously, you need to give them a stake in it. They need to have skin in the game, and that's how you do it.
If there's consequences for not just a little mistake, but just for sheer incompetence or not or apathy, if there's consequences for that. And that's clear, and you make expectations clear, people are going to change their behavior. Or if they keep failing and failing and failing, you know, multiple phishing tests, maybe it's time to move them into another role.
So that's my silver bullet.
I hope you enjoyed that. Are there any questions?
Okay. If there's no questions I'm going to pack up here. But if you'd like to take a look at any of these with the, the sample incident response plan set up, you're welcome to come up and take a look. Thank you so much. Kind of. We appreciate you.
