►
From YouTube: More Than Just a Pretty Penny! Why You Need Cybersecurity in... Callan Andreacchi & Michaela Flatau
Description
Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
More Than Just a Pretty Penny! Why You Need Cybersecurity in Your Culture - Callan Andreacchi & Michaela Flatau, Defense Unicorns
Data breaches, ransomware, and spear phishing, oh my! When cybersecurity attacks aren’t addressed properly, it can result in a loss of trust between companies and their customers. This can have a negative impact on the brand, revenue, and even customer loyalty. Humans will always be a part of cybersecurity and humans are bound to make mistakes. It’s not enough to educate your employees, you must empower your employees to not only identify social engineering tactics, but also admit and own their mistakes. When employees feel a personal connection to the company’s cybersecurity, the likelihood of a cyberattack decreases. Join Callan and Michaela to learn about how to integrate cybersecurity into the very fabric of your workplace culture, leading to identifying potential risks faster and in turn, resolving those risks quickly.
B
B
B
All
right,
so
this
new
trend,
my
corgis,
definitely
try
to
to
fish
me
out
of
my
chewy
credential
logins
chat.
Gpt
is
changing
the
game.
It's
lowering
the
barriers
for
cyber
attacks,
to
the
point
that
my
Corey
almost
succeeded.
I
almost
fell
for
it,
but
I
I'm
curious
when
you
think
about
some
of
the
strategies
that
you
all
use
when
you
go
to
look
to
see
if
you're
getting
fished,
think
about
some
of
those
strategies.
B
For
me
personally,
some
of
the
quick
got
checks
that
I
do
right
is
there?
Are
things
felt
wrong
or
is
there
bad
grammar?
You
know
capitalization
and
weird
spots
right.
Those
are
like
the
quick
go-to's
typicals
right,
as
you
can
see
in
in
this
email
right
that
was
sent
to
me.
Those
don't
work
and
it
took
a
little
bit
more
effort
for
me
to
realize
like
this
may
not
be
a
legitimate
email.
So,
with
that
in
mind,
it
got
me
kind
of
thinking
like
dang.
B
If
they
can
do
that
with
chat
GPT,
what
can
they
do
with
fishing
and
schmiching
right
like
when
I
get
that
phone
call?
Are
they
going
to
have
a
better
script
than
they
used
to
with
text
messages?
Sometimes
those
can
be
harder
if
they
get
more
advanced
with
their
text.
Messages
am
I
going
to
be
able
to
tell
if
it's
actually
like
my
bank,
talking
to
me
or
is
it
right?
It's
going
to
get
a
little
bit
harder
and
finally
is
the
social
engineering
aspect.
B
They
get
you
where
it
hurts
they
do,
and
so
with
Technologies
like
chat
gbt
and
things
like
that,
it
gets
a
little
bit
harder
to
think
all
right.
I
love
my
Corgi.
He
got
me
where
it
hurt
right,
taking
care
of
him,
giving
him
his
treats,
but
Michaela
they're
going
to
begin
calling
you
about
things
other
than
your
extended
car
warranty.
So.
A
B
All
of
this
example,
really
to
just
kind
of
hit
home
Technologies,
are
lowering
the
barriers
for
cyber
attacks.
It's
changing
very
rapidly.
It's
really
quick
on
how
these
things
are
changing
and
it's
expensive
to
keep
up
right.
So
it
kind
of
leads
us
to
the
first
part
of
our
title.
The
pretty
penny
right,
cyber
security
or
just
cyber
in
general,
is
its
own
economy.
In
its
of
itself,
you
have
a
Cyber
attack
and
you've
read
the
headlines
right
yeah.
It
can
cost
in
the
millions
more
and
more
expensive.
A
B
Is
getting
more
and
more
expensive
to
the
point
that
a
research
group
felt
that
they
had
enough
evidence
to
write
a
report
going
ahead
and
saying
that
if
you
take
all
the
cyber
security
damages-
and
you
put
them
together-
that
that
amount
is
actually
comparable
to
Global
economies
and
it
would
rank
third,
that's
crazy.
This
talk,
luckily,
is
not
to
nitpick
the
validity
of
how
they
came
up
with
their
numbers
or
things
of
that,
but
just
taking
the
quick
acknowledgment
that
somebody
felt
that
they
had
enough
evidence
to
make.
B
That
claim
is
kind
of
scary
in
and
of
itself.
Normally,
when
you
get
attacked
and
things
like
that,
you
kind
of
think
what
about
insurance
right.
There
are
insurances
for
cyber
security
attacks
that
is
becoming
an
area
where
some
insurance
companies
are
thinking.
I,
don't
know
if
I'm
I'm,
crunching
the
numbers
and
they're,
not
in
my
favor.
B
It's
very
unstable
I'm,
not
sure
that
there's
going
to
continue
to
be
insurance
for
cyber
attacks,
that's
kind
of
scary
on
the
flip
side
of
the
economy,
where
there
maybe
isn't
as
much
reporting
as
kind
of
the
idea
and
the
drive
of
well.
Why
are
these
cyber
attacks
still
happening?
There
is
a
whole
nother
side
of
the
market
on
you
know
like
a
black
market,
if
you
will
of
selling
of
malware
zero
days,
access
stolen
credentials
are
really
hot
right
now
and
so
they're
selling
these
things.
B
Actually,
on
my
way
here,
Michaela,
you
said:
you're
a
recruiter,
I'm,
sorry
they're,
cutting
into
your
talent,
pool
I
saw
an
article,
I
didn't
go
in
and
reading
it
as
much
as
I
should
have,
but
it
was
stating
that
cyber
criminals
are
recruiting
six-figure
jobs-
PTO,
oh
oh,
you
know
so
I
didn't
read
it
so
I,
don't
know
if
there's
like
health
benefits-
or
you
know
401K
Investments,
but
the
point
is
the
pretty
Penny's
not
going
anywhere.
Cyber
attacks
aren't
going
anywhere
and
it's
kind
of
scary.
B
A
So
how
do
you
integrate
cyber
security
into
your
culture?
I
feel,
like
that's
easier
said
than
done.
A
lot
of
people
think
that
culture
is
kind
of
like
a
fluffy
thing,
but
it
actually
takes
a
lot
of
work.
One
of
the
biggest
things.
The
most
important
thing,
in
my
opinion,
is
making
your
culture
a
safe
place
to
admit
mistakes.
A
I
know,
I,
don't
know
about
y'all,
but
I
know
that
if
I
thought
my
job
was
on
the
line
AKA,
you
know
the
way
I
make
money
aka
the
way
I
put
food
on
the
table,
I'm
not
going
to
go
forward
and
say:
oh
I,
clicked
on
that
link
or
yeah
I
I
sent
I
sent
gift
cards
to
that
text.
Message
and
I
shared
my
password
here.
There
I'm
not
going
to
do
it
because
I'm
like
I'm,
not
going
to
put
myself
at
risk
and
ruin
this
opportunity
for
myself,
so
I'm
gonna,
zip
it.
A
What
would
make
me
more
comfortable
with
admitting
to
that
mistake
is
having
psychological
safety?
Are
you
guys
all
familiar
with
that
term?
I'm
not
going
to
do
the
whole
like
raise
your
hands
if
you
feel
familiar
with
that
term,
if
you're
not
familiar
with
that
term,
though,
basically
it
means
that
you
are
providing
an
environment
that
makes
people
feel
safe
and
they're
not
going
to
be
humiliated
and
they're
not
going
to
be
punished
for
sharing
ideas,
admitting
mistakes,
bringing
up
concerns
or
anything
of
that
nature,
so
there
is.
A
There
is
something
that's
very
important
to
distinguish,
though,
is
that
are
people
genuinely
making
mistakes
versus
you
know,
there's
a
genuine
their
lack
of
understanding
they're,
not
following
policies
and
procedures,
and
it
is
truly
on
them
so
before
we
show
you
some
good
examples
that
Colin
and
I
put
together
of
strategies
on
how
to
integrate
cyber
security
into
your
culture.
I
do
want
to
touch
on
what
I
consider
a
bad
example
Okay.
So
cyber
security
should
matter
to
everyone.
It
does
not
matter.
A
If
you
are
a
secretary
or
a
cyber
analyst
or
the
CEO,
if
you're
touching
Tech,
then
it
matters
to
you
and
I
believe
that
this
training
didn't
really
do
a
good
job
of
making
people
care
enough
to.
You
know
really
invest
time
and
energy
into
understanding.
It
I,
don't
know
how
many
of
you
have
been
integrated
in
the
Department
of
Defense
in
any
way.
But
if
you
have,
then
you
have
been
subject
to
this
god-awful
training
called
Department
of
Defense
cyber
awareness
challenge.
A
It
was
so
bad
that
PewDiePie
made
a
video
of
it,
and
if
you
want
to
subject
yourself
to
that
torture,
you
can
go
on
YouTube
and
look
it
up
and
myself
and
all
the
comments
on
that
video
agree
that
some
of
the
ways
that
this
training
went
wrong
was
that
it
wasn't.
It
was
a
yearly
requirement,
meaning
that
people
were
not
thinking
about
this
until
they
the
dreaded
training
came
up
and
they
you
know
clicked
through
it
as
fast
as
they
possibly
could,
because
they
didn't
care.
A
They
just
wanted
to
get
it
done
and
get
it
out
of
the
way.
I
know.
Since
then
the
dod
has
updated
their
training,
but
for
years
for
years
the
training
was
always
the
same.
Even
though
cyber
and
these
types
of
attacks
were
evolving,
they
were
still
teaching
us
like
hey.
If
Tina
comes
to
you
with
this
floppy
disk
and
says,
put
it
into
your
computer
and
you're
supposed
to
say
no,
that's
a
bad
idea.
You're
like
okay,
that's
a
little
bit
outdated.
A
The
point
I
want
to
touch
on
with
this
slide
is
the
things
that
went
wrong
were
that
it
was
not
frequent.
It
wasn't
ingrained
in
Daily
habits.
It
was
turned
into
this.
You
know
I,
don't
want
to
say
torture
device,
but
people
just
hated
doing
it.
They
weren't
thinking
about
it
frequently,
and
something
was
that
when
you
got
that
email
saying
you're
due
for
your
training,
there's
a
punishment
attached.
A
They
just
don't
so
I
do
want
to
transition
to
a
strategy
that
we
believe
works
man.
What
am
I
saying
here,
strategy
one
encourage
open
sharing,
so
something
we
do
at
defense
unicorns
is
that
most
of
our
communication
is
in
slack.
So,
let's
integrate
incident
reporting
into
slack.
That's
where
everyone
is
anyways,
it's
easy
to
access
it's
open
and
when
people
report
incidents
it's
openly
shared
to
all
of
us.
This
example
right
here
might
be
our
record
holder
for
the
quickest
Audrey
has
only
been
here
for
two
weeks:
she's,
a
new
employee.
A
She
barely
started,
and
she
already
received
the
text
message
from
our
CEO
Rob
saying
Audrey
available,
and
this
happens
so
frequently
to
us
that
we
consider
it
kind
of
a
rite
of
passage.
Once
you
get
the
text
message
you're,
you
are
now
an
official
employee
of
Defense
unicorns,
but
we
we
are
consistently
updating
that
thread.
Every
day
of
hey
I
got
this
text
message.
I
received
this
email,
so
Audrey
was
able
to
identify
that
and
obviously
avoid
it,
because
she
knew
that
it
was
not
legitimate.
A
Now
imagine
you
have
a
new
employee
who
doesn't
have
access
to
this
information
and
they
get
that
text
message
and
they're
sitting
there
thinking
themselves.
Oh
crap,
the
CEO
is
reaching
out
to
me
like
I
I,
just
started
I,
don't
want
to
mess
up
this
opportunity,
I
should
respond
and
then
bam.
Of
course
we
joke
about
it,
because
it
typically
follows
up
with
a
I'm
stuck
in
a
conference.
A
Everybody
feels
comfortable
posting
in
there.
Everybody
feels
comfortable
reporting
and
honestly,
there
have
been
times
where
people
have
posted
and
said:
hey
is
this
suspect
and
people
will
look
at
it
and
be
like?
Actually,
no
that's
that's
legitimate.
You
can
click
on
it
all
good.
So
good
and
bad
examples
are
both
in
there.
A
Now
we
like
to
joke
and
have
a
lot
of
fun,
but
in
some
scenarios
it
calls
for
a
more
serious
tone,
especially
when
there's
been
a
bigger
breach.
So
next
slide
leadership.
Setting
the
tone
and
leading
by
example,
is
huge
in
creating
this
culture,
and
if
leadership
is
not
bought
into
this,
and
they
don't
follow
it,
it's
the
culture
is
not
going
to
survive
that,
integrating
that
cyber
security
into
the
culture
is
not
going
to
work
so
leadership
setting
the
tone.
A
I
have
two
examples
from
back
in
the
day
previous
workplaces,
I
won't
name
but
one
bad
example,
and
one
good
example:
bad
example,
being
there
was
a
breach
handled
behind
closed
doors
swept
under
the
rug.
Leadership
was
not
transparent
about
it
and
then,
when
employees
finally
did
find
out
about
it,
they
were
like.
Well,
nobody
told
me
how
can
I
trust
my
leadership
when
they're
keeping
these
things
from
us,
especially
when
it's
leaking
our
personal
data.
A
Was
in
the
news
it
was
in
the
News
That's
How
employees
found
out
about
it.
That's
not
a
good
feeling
when
you
figure
out
something
about
your
company
through
the
news,
whereas
a
good
example
from
prior
work.
Experiences
is
same
scenario,
breach
happened
and
Leadership
was
upfront
about
it.
They
immediately
came
forward,
they
owned
it.
They
said
we
made
a
mistake
here.
We
are
owning
it,
and
here
is
what
we're
doing
to
fix
this
problem,
and
here
are
paid
paid
resources
to
help
you
mitigate
any
risk
associated
with
what
happened.
A
Another
important
part
of
the
good
example
is:
is
that
there's
a
two-way
street
on
communication,
meaning
leadership
didn't
just
go
up
there
and
say
we
made
a
mistake.
Okay,
now
nobody
asked
any
questions
about
it
like
we're.
Not
going
to
you
know
respond
there
was
employees
could
ask
whatever
they
needed
to
to
feel
comfortable
with
the
situation
that
happened
now.
I
I
thought
that
was
an
amazing
response.
They
were
transparent,
they
were
upfront,
they
provided
Solutions.
A
A
These
are
the
biggest
things
that
we
hope
that
you
learn
from
our
session.
Is
that
number
one?
Cyber
security
should
matter
to
everybody
and
what
is
really
important
about
that
is
making
sure
that
you're
putting
it
into
a
format
that
everybody
can
understand
easy,
easy
access
to
reporting
easy
access
to
show
what
has
been
reported.
So
people
know
what
examples
to
look
for
so
that
if
it
happens
to
them,
they
already
know-
and
you
know
that
yearly
requirement
that
yearly
reminder.
No,
it
just
doesn't
work.
A
We
want
cyber
security
to
be
so
ingrained
in
your
culture
that
it's
it's
not
a
second
thought.
It's
like
looking
both
ways
to
cross
the
street
people
automatically
know
when
I
get
that
text
message
or
when
I
get
an
email
I'm
going
to
screenshot
it
I'm
gonna
go
drop
it
in
the
slack
Channel
and
then
within
10
minutes.
Unicorns
are
going
to
answer
my
question
and
say
yeah
that
that
don't
answer
that
or
they're
going
to
say
no,
that's
a
legitimate
one
and
you're
good
to
go
proceed.
A
Keeping
it
simple
too.
If
you
put
too
many
barriers
in
that
procedure
to
report
it
makes
people
not
want
to
do
it
because
they're
like
God
I,
don't
have
time
for
that.
I
don't
have
time
to
do
all
those
steps
so
I'm
just
going
to
let
this
simmer
and
then
a
week
later,
they're
gonna
forget
and
then
you
know
it
goes
from
there.
A
Second
step
I
feel
like
it
just
honestly,
just
incorporated
into
what
I
was
just
saying:
I
feel
like
I,
didn't
do
a
good
job
of
like
separating
those
two
that
open
sharing
is
so
important
and
everybody
needs
to
be
on
the
same
page,
whether
whatever
role
you
play
in
the
company,
if
you're
touching
Tech
it
matters
to
you
too
and
then
the
last
one
and
honestly
one
of
the
most
important
ones
is
that
leadership
needs
needs.
Needs
needs
to
be
there
and
it
applies
to
them
too.
They
admit
mistakes,
they
own
it.
B
Yeah
and
it's
important
to
to
know
because
some
of
these
things
you
may
be
sitting
and
thinking
like
if
I
were
sitting
there,
I'd
be
like
well
I'm,
not
a
leader,
so
I
guess,
like
you,
know,
I'm,
not
the
CEO
or
I'm,
not
the
CTO
right.
You
know
fancy
C
and
then
letters
right
so
like
some
of
these
don't
apply
to
me.
B
But
that's,
that's
not
the
case
right
that
it
should
matter
to
everybody
because
we're
all
touching
things,
but
you
have
a
personal
investment
right,
because,
if
they're
going
through
you,
you
know
your
own
personal
dad
is
important
as
well
right.
Some
of
the
breaches
that
Michaela
talked
about
right.
That's
your
data,
identity
theft
does
affect
us
all,
and
so
right
we're
all
touching
technology,
but
the
encouraging
open
sharing
can
be
as
simple
as
even
if
you
don't
have
a
slack,
Channel
or
you're
you're
a
much
larger
organization.
B
It
could
be
as
simple
as
asking
your
your
teammate,
hey
I
got
this
message:
did:
did
you
get
one
too?
Or
do
you
know
if
this
is
something
like?
Is
this
legitimate
or
not?
It
can
be
as
simple
as
having
those
conversations
like
Michaela
said:
we
want
it
to
be
second
nature:
the
reflux
of
crossing
the
street.
You
don't
even
think
about
it.
It's
just
a
simple
double
check
that
you
do
right.
You
can
do
that
today.
B
It's
just
little
simple
things
like
that
that
anybody
can
do
and
then
the
setting
the
tone
when
we
think
leaderships
there's
a
vast
difference
and
there's
been
a
lot
of
Articles
gosh
linkedin's
full
of
them
right
leadership,
isn't
a
title
right.
It
also
goes
down
to
the
role
you're
playing
on
your
team.
It
doesn't
require
a
title
right.
There
are
those
influential
people
that
I'm
sure
everybody's
worked
with
that
you're
like
dang.
This
person
really
leads
the
team
and
they
make
a
difference,
and
they
do
these
things
and
people
just
naturally
kind
of
Follow.
B
That
person
you
may
be
one
of
those
people,
and
so
everybody
can
set
that
tone
where
there
can
be
leadership
in
different
areas
as
well.
Maybe
you're
going
to
be
the
leader
in
making
the
environment
feel
safe
right,
you're,
openly
mitting,
hey
I
made
this
mistake:
I
want
to
learn
for
it
from
it
and
making
that
environment.
Okay
to
do
the
things.
Those
are
other
things
where
you
can
today
be
a
leader
without
that
title.
B
So
these
are
things
that
should
that
can
apply
to
everybody
that
you
can
begin
doing
to
slowly
and
Grading
it
into
your
culture.
Doing
a
little
bit
is
much
better
than
doing
nothing.
Yeah
and
that's
one
of
the
big
things
and
the
idea
of
the
hit
home
of
integrating
it
into
your
culture
do
a
little
bit
at
a
time
versus
it
being
something
that
Giants.
A
A
We
understand
that
the
first
thing
that
people
think
about
in
cyber
security
attacks
is
that's
going
to
cost
our
company
a
lot
of
money,
but
here's
the
deal
and
I'm
just
going
to
read
it
straight
off
of
here,
because
the
query
is
saying
it
and
I
want
it
to
solidify
with
all
of
you.
Cyber
security
is
more
than
just
the
pretty
penny.
Providing
your
employees,
the
knowledge
to
identify
cyber
threats
are
going
to
save
you
Millions
on
the
back
end
and
that's
a
fact
all
right,
we
are
done.
B
So
we
purposely
kept
a
little
bit
shorter.
We
are
right
before
lunch.
We
wanted
to
be
aware
and
empathetic
to
that,
but
we'd
love
to
hear
if
you
guys
have
any
questions
or
anybody
has
strategies
that
you
guys
have
been
seeing
that
do
or
don't
work
in
the
environments
that
I'm
sure
we
all
can
think
of
good
and
bad
examples,
but
we're
here
to
talk
the
QR.
A
B
B
C
B
B
No,
that's.
That's
really
sad
and
I
have
seen
that
as
a
common
tactic.
Unfortunately,
of
the
to
the
point
that
you
get
so
paranoid
that
you
don't
want
to
even
there
there's
a
joke
that,
with
some
of
my
colleagues
that
the
more
and
more
I
learned
about
cyber
security
and
breaches
and
attacks,
the
less
and
less
I
want
to
be
on
my
technology,
like
that,
that
is,
that
is
100
real.
B
But
it's
so
in
ingrained
in
everything
that
you
do
today
the
successes
that
I've
seen
in
that
area
and
if
others
have
seen
other
strategies,
please
feel
free
to
share
and
I'll
open
it
up
in
a
second.
But
it
does
go
with
that
safety
of
the
idea
of
that
you're
going
to
make
a
mistake:
it's
not
a
matter
of
if
you're
going
to
get
reached.
If
there's
going
to
be
a
cyber
compromise,
it's
a
matter
of
when
and
then
understanding
and
feeling
comfortable
that
you
have
resources.
You
know
what
to
do
afterwards.
B
You
know
that
you
have
a
support
network
and
that's
very
hard
when
the
culture
unfortunately
has
been
set
into
a
fear
mentality.
But
that's
where
I've
seen
successes
of
you
take
care
of
your
fellow
co-workers
right
and
you
started
on
a
very
small
scale
of
let's
talk
about
it,
making
it
regular
you
know,
and
just
because
that's
the
message
coming
up,
there
can
be
a
lot
of
goodness.
A
They're,
no
matter
what
like
one
of
the
biggest
risks
in
cyber
security,
is
going
to
be
humans,
and
if
your
leadership
does
not
understand
that
and
prepare
for
that,
then
they're
failing
their
employees
and
they're
failing
their
culture.
That's
like
why
we
put
this
together
and
why
we
feel
so
passionate
about
this
topic
is
because
it
doesn't.
A
It
doesn't
matter
how
much
training,
how
much
money
you
soak
into
training
if
you're
coming
at
it
from
a
fear
perspective
and
like
I,
said,
if
I
think
my
job
is
on
the
line
or
I'm
going
to
be
humiliated
or
feel
stupid,
I'm
not
going
to
say
anything,
I'm,
not
sure
what
your
role
is
at
the
company
of
you
have
influence
on
that.
I
do
believe
that
leadership
has
a
huge
part
to
play
in
that
and
if
you
can
have
any
influence
on
leadership
or
providing
that
feedback
like
hey.
A
This
needs
to
be
different,
whether
it
be
this
annual
training
needs
to
be
broken
out,
or
we
need
to
start
this
forum
where
we
can
all
come
together,
even
if
it's,
if
it's
physical
and
it's
on
a
bulletin
board.
If
that's
where
you
know
your
office
is
and
you're
posting
things
like
hey,
this
is
the
most
recent
one.
This
is
what
the
text
message
looks
like.
D
A
Yeah
and
that
treat
treating
it
as
a
learning
opportunity,
as
well,
not
only
for
the
person
who
made
the
mistake,
but
for
everybody
in
a
non-humiliating
way.
You
know
it's
not
like
everybody
look
at
Michaela.
She
made
the
mistake,
learn
from
her
because
clearly
she's
not
doing
it
right,
any
other
questions
and
you
guys
might
be
going
to
lunch
early.