Security Confidential S3 E5 Dr. Calvin Nobles

Manoj Tandon: Good afternoon, everyone. Welcome to another episode of Dark Rhino Security Confidential. Today, we are really honored to have Dr. Calvin Nobles join us. Dr. Nobles has a very deep background in cybersecurity that spans many years. He is an esteemed speaker and has given many talks on the topic. His knowledge of finance in cybersecurity is absolutely at the top, and he has some great ideas on national security. We’re really grateful to have him on the show. Thank you for joining us, Dr. Nobles.

Calvin Nobles: Well, sir, thank you for having me on the show. I look forward to the discussion. I love spreading the gospel of cybersecurity and seeing how we can make it better, because this is a never-ending battle and we must position ourselves for the long haul to win.

Manoj Tandon: One place I thought it would be very interesting to start this conversation, because you have such a great background in finance and financial institutions in our industry are often looked upon as some of the best-guarded institutions out there. To us at Dark Rhino, the conversation starts with understanding risk. When you invest in cybersecurity, you really should do it in alignment with the risk that your organization has. What’s the likelihood and magnitude of loss from a given attack surface that you might encounter? You really need to guard the crown jewels, right?

Calvin Nobles: Right.

Manoj Tandon: How can you give some thoughts on how organizations should go about assessing risk, or what are some approaches there that would guide them in their investment decisions for cybersecurity?

Calvin Nobles: Absolutely. I think one of the first things that organizations can do regarding risk is address it from a cultural aspect. It is an enterprise-level effort; it’s not something that should be just relegated to the IT department, the Chief Information Security Officer, or the Chief Information Officer. We are in an “all hands” evolution here regarding risk. It should be driven not necessarily just from the top down, but also from the bottom up because sometimes throughout the different layers of the organization, they see things and they need to have the ability to raise those issues without fear of some type of reprisal. I always say that people are sensors, and they can be some of the best information finders and give you some of the best—what we called when I was in the military—early indications and warnings of things going on. You have to learn to incorporate that into your risk calculus. At the end of the day, as you will hear me say numerous times, you can buy the best technology, you can put in the best security controls and the best countermeasures, but what’s going to really get you there is really making people an active element of your risk calculus and also understanding the human factor associated with that. When I was on the speaking circuit in 2018, I traveled around to many industry conferences talking to a lot of senior executives in the industry. I would always ask the question: “How many of you have completed a risk assessment recently?” and everybody’s hands go up. That’s the correct answer. However, my second question was a little more rhetorical, and not too many hands went up on this one. That second question was: “How many of you accounted for the human-based risk factor in your risk assessment?” That is where we stand to improve because today we are dealing with security fatigue, burnout, and stress at unprecedented levels that we’ve never seen before. The cybersecurity threat environment is hyperactive; it’s also a very diabolical entity. We’re dealing with a lot when we talk about risk management. So it really requires an organization to be on their toes, be flexible, and understand a lot of different moving parts. That’s why I mean risk management, at the end of the day, is an all hands evolution.

Manoj Tandon: I agree with you completely. When it comes to risk, you mentioned people. We always try and preach the gospel that people are your biggest cybersecurity asset, actually. They are the most underutilized asset in the company when it comes to cybersecurity. In fact, you go to most companies and you ask the average person if they know what’s going on in cybersecurity or if they have had training on it. Now, some people may have had some phishing training, but by and large, it’s like a nebulous term to them. It’s like a bunch of people sitting in a dark room somewhere doing something. I think those people, if we can empower them and get them involved in the conversation, they have a lot to say. The culture that you bring up is absolutely key because, if we can have an environment where people understand the “why”—not just having a policy, but understanding the “why”—then they will proactively look out for certain types of behaviors and actions. They might be the earliest indicator of compromise.

Calvin Nobles: Absolutely. The people element is so critical to what we’re doing in cybersecurity. That’s why you hear me talk a lot. I’ve been a real advocate for the human factor in cybersecurity. Part of that is because I just recently finished a PhD in human factors, but I’ve been studying human factors in cybersecurity for years. I like to compare cybersecurity to aviation, and in some cases, what they’ve done in medicine regarding the human factor. Those are two different domains where we’ve seen a lot of errors. We’ve seen people go into a hospital to have a procedure done, and when they come out, they have had the wrong procedure performed. In aviation, we’ve seen countless incidents of crashes and other hazards dealing with airplanes and people. There’s a lot to learn from those domains. In cybersecurity, we kind of trail behind those industries regarding placing people at the center of our operations. I’m a huge advocate of human-centered operations, meaning placing people at the core and everything else is built around the people. At the end of the day, people and cybersecurity are inseparable. No matter what we look at in cybersecurity, you can’t separate it from the people. So having a well-trained staff who are securely aware of the environment, threats, and risks can go a long way. Now, that’s easier said than done. When you start talking about the daily tasks that our people are responsible for, there is a lot of wear and tear on the person. We need to start not only thinking about it from a risk aspect, but also from a human aspect with a lot of attention paid to human performance. Over time, if you’re not careful about how hard you’re pushing your cybersecurity professionals, you can really burn them out and wear them down to where there’s a degradation in their efforts.

Manoj Tandon: You set that up for my next question: What are some lessons we can actually learn from the aviation industry where fatigue has played a role in so many crashes? The industry has actually stepped up to the plate and has started to really address some of those factors. We see some of that in our own industry in cybersecurity. What are some tips or guidelines you might be able to give on those lessons learned?

Calvin Nobles: Right. One of the things that I love talking about is called “The Dirty Dozen.” A group of aviation researchers came together and highlighted 12 dangerous attitudes that can degrade aviation operations or make aviation more inherently risky than it already is. When I looked at “The Dirty Dozen,” they were parallel to cybersecurity. Some of them are like complacency; some are like over-reliance. There are 12 of them, and I don’t remember all of them off the top of my head. One of the things we need to do is identify dangerous attitudes in cyber. That helps us understand mitigation strategies for those different attitudes. For instance, in aviation, when I was flying—when I was much younger than I am now—one of the dangerous attitudes was “get-home-itis.” Everybody was ready to get home, right? So you bump up the throttles, you start cutting steps out, you start doing things, and when you start doing that, you have to take a step back and say, “We are making what we’re doing more inherently dangerous.” In cyber, you see some of the parallels because people just want to get things done at the end of the day. Sometimes we implement controls and other measures, and it makes people circumvent what we have done. The reason people circumvent the countermeasures that we put in place is because things have gotten too complex for them. Just like in aviation, we know where the cognitive-demanding functions are. We know what those tasks are. We allocate certain time, and sometimes we get two people involved in those tasks and functions because they’re just too demanding. For instance, if you ever had the opportunity to sit on a flight deck, you would notice that when the pilot is flying, you have one pilot flying and the other one running the checklist and doing all the communication. They’re working and talking through things. We need to have that same flow in cyber. We need to identify some of our riskier tasks and functions and label them as such so that we can put mitigation strategies in place. For instance, mergers and acquisitions need to be number one on everybody’s task list when talking about cybersecurity because there’s a lot of risk associated with that. If we can identify things like that and start working in parallel and borrowing from the healthcare and aviation communities, I think we can start to reduce some of the errors and problems we see in cyber.

Manoj Tandon: You might remember the exfiltration of information from Target?

Calvin Nobles: Yes.

Manoj Tandon: In that case, their systems were actually telling them something was wrong, and they were choosing to ignore it or turn the alarm off. Could human factors have been a huge player in that?

Calvin Nobles: Absolutely. One thing, even when I was going through my aviation training and was part of a squadron, when you got a warning indication, you never just wished it away. You had to investigate it. We have to teach our cybersecurity professionals—and all of our employees—that if you get a warning or something doesn’t seem right, stop, ask questions, inquire, and elevate it to the next level for assistance if necessary. By doing that, I think that we will become more cognizant and more aware of things in our environment.

Manoj Tandon: On risk, have you seen in your experience any particular framework that does a better job of risk assessment, whether you look at NIST, the FAIR model, or any number of other models? Is there one that’s a favorite for you?

Calvin Nobles: I would have to say the NIST framework. I really like the NIST framework. I remember when we first started utilizing it. To me, it just made sense and it still makes sense to this day. So I’m a fan when it comes to NIST; however, there are other frameworks out there that are just as effective. When it comes to a framework, what I tell people is try not to get so involved that it is the only framework you think of. Pay attention to some of the other frameworks because some call out certain areas more so than others. ISO is very good when it comes to user-centered design, and does a much better job with it than the NIST framework. There are some things that you can leverage from that particular framework that the NIST framework might not focus on as much. A hybrid of a little bit from each one can get you there. They each serve a purpose, but I’m a big fan of the NIST framework. It really makes sense from a business aspect as well.

Manoj Tandon: There is a lot of tie-in between cybersecurity and national security. I think it’s a new battlefront.

Calvin Nobles: Absolutely. When I was in the Navy, I spent some time working inside of the intelligence community and at one of our national-level agencies, so it was very natural to become an expert in national security. National security is so important for the advancement of our country—and not just our country, but for the global environment as well. The United States plays such a critical role. When we talk cybersecurity, you look at what our government has done and what our private industry has done in terms of building these very robust networks, systems, and infrastructure. We rely on these things daily. Our organizations, whether private or public, have invested significantly in this infrastructure. Because of the expansion of globalization and the advancement of different technologies, it makes it easier for our infrastructure to be attacked. When we talk about national security, we just can’t look at the federal government anymore. We have to look at critical industries as well, because if you look at our most-attacked industries, you can see where adversaries—state-sponsored, non-state sponsors, hackers, cybercriminals, whoever it may be—are targeting certain industries more than others. Because they’re targeting those industries the way they are, it’s very strategic. Cybersecurity is becoming our underbelly. Because people are targeting that underbelly so much, we’re having to take very progressive steps to secure it. We’re having to do that through national security. We have U.S. Cyber Command and a very robust intelligence community, but that’s not enough. We have to partner with our private industry, private organizations, and also our non-profit organizations. As well as academia, we need to build that bond. National security primarily rests on the shoulders of the federal government, but it also rests on the shoulders of the rest of us, too, because we are so interconnected from a technology aspect that it’s almost impossible to separate them. I wrote a paper about a year and a half ago called “Disrupting the United States National Security through Financial Cybercrimes.” Again, I view our cybersecurity infrastructure and what we’re facing as our new underbelly, right? It’s an area that’s exposed right now. We’re working as diligently as we can to protect it. But like you said, you can’t separate what’s happening on the federal side or what’s happening on the public side from our private partners, because we really rely on each other for very unique services. Anytime there’s an attack against the United States, in my perspective, our national security is threatened. The global international security level is threatened because the United States is such a critical player on the international stage. When companies see the United States being attacked, imagine what that’s doing psychologically to countries that are not as advanced or capable as the United States. It’s messing with them psychologically, because they’re saying, “Wow, if this is happening to the United States, what can happen to us?”

Manoj Tandon: In your paper, what were some of your findings? Can you elaborate on some of what you found regarding affecting national security with cybercrime? That’s very interesting.

Calvin Nobles: One of the findings that I discovered was that between 2016 and 2018, the financial industry was one of the fastest growing industries in terms of cybersecurity potential, investing significantly to protect those assets. This was not just in the United States; this was international. That gives you an idea of the investment by these financial institutions and what they were dealing with from a threat and risk aspect. The other thing I determined was that banks and other financial institutions are in the business of providing services. What’s unique about that is the more services that we provide to our customers, the larger our attack surface becomes. That plays into the hands of nefarious agents; they’re able to capitalize and take advantage of that. One of the outcomes of my paper was a recommendation that we take a look at enhancing authentication for customers and anybody who’s trying to access a financial services entity while they’re at home or out and about. One of the other points I made was not to access these types of services on a public Wi-Fi unless you are really skilled and know how to protect yourself. It’s preferable to do it at home and to enhance your mobile devices so that they are more secure. You can have that mobile banking ease. I got a call from a good friend of mine last Friday afternoon, and he said, “Hey man, you’re not going to believe this.” I had to share this with you because I knew you would get a kick out of it. He said he was talking with the CEO of a small company and they had just been hacked. He started talking with the CEO about managing her platform, and she’s never changed her password. Her employees have never changed their passwords, either. I’m not saying this to pick on small companies; I’m saying this to highlight how we need to start getting the word out. We need to start partnering with small companies to ensure that they understand: Because you’re a small company, it doesn’t mean that you don’t stand a chance of being hacked. In fact, as a small company, you are more of a gateway into a larger company because you’re going to be partnering and probably in somebody’s supply chain. That’s why you are a target; you can be that gateway into somebody else’s network.

Manoj Tandon: I went to the Dewpoint Summit in 2019 and did a presentation on businesses leveraging the dark web to conduct business because of the security aspects of the dark web. Should we look at the dark web as a business medium? That’s very interesting. I would venture that most people have never been on the dark web and have never explored the sites and groups that are on there. I would say that’s a good thing because a lot of the pros play at that level. If you’re not careful, you can expose yourself there and become a victim quite easily. But you can also look at how the chain of trust is created, right? You can outsource cybercrime today. That’s no big secret. With 500 bucks, I’m sure I could get somebody in Eastern Europe to do some things that are not good. I’ll leave it at that. But the chain of trust that it would take for me to get into that circle to be able to execute that is maybe something that’s noteworthy of studying to see if that can be applied in conventional business for doing the right thing.

Calvin Nobles: If company A and company B work together to use the dark web to conduct their transactions—because those two entities know who they are—they can meet on the dark web, conduct their transactions, and don’t have to worry about transmitting over the regular internet anymore.

Manoj Tandon: I don’t know if you remember, but way back—I’m going to turn back the clock to the late 80s or early 90s—there was a book and a program called PGP, Pretty Good Privacy. You remember that? You could use it to send encrypted emails. The whole thing was that you created your public key—it’s still used today; that’s what public-private key encryption is for all our listeners—but you managed those keys. You dictated who you gave those keys to. That’s “Pretty Good Privacy,” as it implies. It’s not 100 percent, but it’s pretty good. That’s kind of the process of what you’re saying. Between two companies, if we have that exchange of sessions or “keys,” then you know who I am and I know who you are, and we’re cutting out everybody in the middle.

Calvin Nobles: Personally, I think it’s a great idea. Of course, I haven’t really explored it any further than that. I just talked about it and researched it conceptually. When we start talking about the dark web, we’re talking about an entity that’s about 700 percent larger than the internet that we see. We don’t know what we don’t know about the dark web, what’s out there, and who’s operating in it.

Manoj Tandon: Do you think that most businesses have transitioned to seeing cybersecurity as a business problem and not an IT problem?

Calvin Nobles: I think for the most part, most businesses have transitioned over to it being an enterprise issue rather than an IT issue. But it also depends on how the leadership and the partnerships between the Chief Information Officer, the Chief Information Security Officer, and the Chief Risk Officer are really pushing that agenda. Everybody should be involved because it doesn’t necessarily have to be the IT department; it could be anybody who is a vector or a target. You have to treat it as a whole. With the amount of play that Chief Information Officers are getting and the amount of attention that Chief Information Security Officers are getting, I think everybody is beginning to see this as an enterprise-level problem.

Manoj Tandon: Have you seen CISOs who do not report to the CIO, but have actually been separated out as a separate function altogether from IT?

Calvin Nobles: I have a lot of friends that are CISOs and we talk several times a week. Most of them feel that by reporting to the CIO, their agenda is not as clear as they would like it to be. The CISO has a role of reporting the facts, and that information needs to be unfettered. It doesn’t need to be changed or modified; it needs to be what the CISO is seeing from his or her lens. That’s how it needs to be carried out. It doesn’t need to be vetted by anybody else because a lot of CISOs believe that’s what’s changing the overall interplay between cybersecurity and some of the other priorities across the organization. I heard someone make a comment earlier today during a conversation: “Most cybersecurity programs are getting what they deserve, not what they need.” As long as we have that type of thinking and mentality, that’s going to be problematic. I’m also a proponent of the idea that the cost of maintaining these cybersecurity programs is becoming so robust that it is not sustainable. If you look at it on a 15-year trajectory, the cost of what these companies are paying for cybersecurity is unsustainable. Somebody asked me, “Well, if you were in charge, what would you do, Calvin?” I said, “This is exactly what I would do: I would take a look at how we can make humans stronger than they really are. How do we design systems that align with the natural abilities of humans rather than countering those abilities?” They were like, “Well, how would you do that?” I said, “Think about it: we forget our passwords. I forget mine sometimes; you forget yours sometimes. Why don’t we design systems where we don’t need to use passwords? Can we use biometric authentication? Can that work?” That’s how you design systems where you don’t have humans calling the help desk to change their passwords every other month because they forgot them, or writing them down and leaving them on their desks, or in a drawer, or in a purse that gets stolen. How can we avoid all of these things and make systems that are more favorable for humans?

Manoj Tandon: I think that there is an over-reliance on tools in our industry.

Calvin Nobles: Oh, yes.

Manoj Tandon: For everything, there’s a tool, and everyone’s pitching a tool. I think if you had every tool—even if you integrated them all together, whether AI-based or not—you still wouldn’t have a 100 percent secure organization. There is no such thing as 100 percent.

Calvin Nobles: Right. There is no such thing.

Manoj Tandon: But process, yes. Understand the risk and put in a process to guard against the risk that you care about. The stuff that you don’t care about, acknowledge it and accept it. What can you do with risk? You can accept it, you can transfer it, or you can mitigate it. You have three choices there. If you do a good job on the risk upfront, then you can look at the processes that surround the risk that’s relevant to you and really architect those processes well. Make those people-friendly, bring people into that conversation, and enable them to do the right thing. You do need tools—I’m not beating on the OEMs—but it just seems like everywhere I turn, there’s a new AI thing. We try, as a cybersecurity consultancy and managed services provider, to really say, “Look, it’s not the tool; it’s the people and the processes behind it that’s going to make all the difference in the world.”

Calvin Nobles: Absolutely. What you just said is so important. I was reading LinkedIn a couple days ago, and there was a CISO—I forgot where she worked, but that’s not important—the point is she said she fielded a call on a weekend from a vendor to her personal cell phone number. That vendor figured out how to get her personal cell phone number and called her on the weekend. I’m sitting here thinking, “God bless her,” because I would have just hung up the phone and turned off my cell phone. But she entertained the individual. She was very cordial about it, and I think that example is a bridge too far. Vendors really have to start understanding who they want to work with and how their product can enhance what our CISOs need. You don’t need to call CISOs a day because you don’t really know what their environment is like, and you haven’t even developed a partnership with them. That’s not the best way to build that relationship. Do a little homework and invest some time into understanding that business so you can develop a partnership with that CISO to get a better picture of what their needs are. Don’t get me wrong, I am fascinated with the amount of technology we have in cyber. I must admit, I’m a technology junkie. I enjoy it. It shows our growth and maturity as an industry and the skilled people we have. We have some extremely skilled people in our industry, so we’re able to develop some of the best technologies much quicker than we were able to do in the past. That’s an indication of the growth of our industry, and that is a pat on the back for us. I just think that organizations have to figure out which technologies they need the most based on what they’re trying to achieve for the business need. I’ve seen organizations that will bolt technology on top of technology. They will bolt on so much technology that it will exceed their organic capabilities, and they will have to bring in specialists to help them understand what they have built because they don’t even know what they have built at that point.

Manoj Tandon: How do we as leaders work through our “unknown unknowns” to protect the business? I would love to see more businesses have that conversation internally and really look at it in those terms: “What are we covered for? What is our real attack surface? What are we guarding?” Then have these other discussions; it might make a lot of sense.

Calvin Nobles: Yes, I think so.

Manoj Tandon: We’re getting towards the hour, but I want to give you a chance to talk about some other interesting findings and things in your experience that you would really like our audience to know about from a cybersecurity perspective.

Calvin Nobles: Absolutely. I’m going to say this: I had this discussion today with a new friend of mine who is well known in the human factors field and is also supporting several entities from a cybersecurity perspective. I encourage more people who are interested in working in cybersecurity to look at human factors as a field, because it’s an emerging field right now. We’re beginning to see more usage of human factors in user experience and user interface design. As long as those fields stay around, they are indicative of what we’re looking for in human factors. But human factors is really a scientific discipline and it’s been around for 80 years. It’s applicable to cyber because cyber is a socio-technical field. We have a huge technical aspect to it, but we also have a huge people side and a huge organizational side. I just encourage people, if you think about something you want to do, don’t sleep on human factors. It is a mixture of psychology and engineering together. I love talking about the need for psychology and human factors. I went down to the NICE Expo and gave a presentation on the need for psychological professions in cyber. We need psychologists who can help us understand human behavior. We need behavior analysts who can help give us a true analysis of our behavior—not just what we say, but what we do. We need human factors people to come in and help develop human factors programs inside of cyber. I hate to be selfish, but that’s my plug. It’s a selfish plug, but again, we need more people who understand cyber to also understand human factors. I just designed a course for a school out on the West Coast, and I’m currently teaching there; it’s the “Human Factors and Cybersecurity” course. We take a look at human performance, cognitive awareness, culture, situational awareness, the history of human factors, and the socio-technical system. We really get into several different topics in the field to help give the students a more broad understanding of how we can look at the human aspect in cybersecurity.

Manoj Tandon: Are you going to be appearing on any shows or have any books or anything that you would like us to know about?

Calvin Nobles: I’d like to give a selfish plug out to a good friend that I actually met over the last week and talked to earlier today, and that is Ira Winkler. Ira Winkler has a book called You Can Stop Stupid, and I can’t put the book down. I’m supposed to be working on all kinds of research right now, and I can’t put his book down because he gives such in-depth explanations of how we can eliminate user-initiated losses inside of organizations. So, a shout out to Ira. He’s a hardcore human factors guy, and again, the book is fabulous. I can’t put it down.

Manoj Tandon: I would love to make that the title of this show, actually. With a title like that, how can you not?

Calvin Nobles: Yes, absolutely.

Manoj Tandon: Well, Calvin, I really appreciate you taking the time. We’re at the hour here. I don’t want to hold you past your commitment to us, but thank you so much for coming on the show, letting our listeners in, and enlightening us with a little bit of information here on your extensive experience in cyber.

Calvin Nobles: Thank you very much, sir, for having me on the show. I look forward to being in communication with you and talking with you again. Maybe when I write my book on human factors and get that published, I’ll come back.

Manoj Tandon: We would love to have you back to talk and explain it to us and give us the cliff notes.

Calvin Nobles: Absolutely. I’ll give you a handful. One of the things I’m writing about right now—there’s a section of the book called “Dog Tired”—talks about all the different types of fatigue that people deal with from a cybersecurity aspect. The last time I stopped counting, based on my research, there were different types of fatigue that the average person deals with in cybersecurity. There’s so much repetitive activity and so many repetitive tasks that have to be done, and they have to be done well. It’s like the pre-flight checklist: You’ve got to go through it.

Manoj Tandon: Yes. If you don’t—”Are your flaps down?” “Oh, I didn’t check it”—well, we don’t know if you’ll have a good outcome. You’re likely to have a very disastrous outcome in some cases. Well, alright, Dr. Nobles. Take care and have a great rest of your week.

Calvin Nobles: You too, sir. Thank you very much.