Masha Sedova From Generations of CS to Behavioral Science and Entrepreneurship

Masha Sedova0:22

I like picking hard challenges and very tall mountains to climb and computer science seemed like a tall mountain.

Masha Sedova0:32

They are also busy human beings. Like the majority of the organization we're trying to secure, they're not security experts. If they had been, they'd be on the security team.

Masha Sedova0:50

It was just fascinating to me how deep of a field this actually is. And I think very few people actually realize how many avenues there are.

Masha Sedova1:28

All right, on to the show.

Masha Sedova1:30

Thanks, Eamon. Good to speak with you.

Masha Sedova1:37

Yeah, so I have the privilege of starting my own company called Elevate Security, and I work on the intersection of security education and behavioral science. One of my favorite topics, having been in this industry for 17 years or so, is the human element of security. And while some people believe that it's the weakest link, I firmly believe that it can be the strongest element of defense. And so I've built a company dedicated to helping create people-powered security.

Masha Sedova2:14

I think that people who think that people are the weakest link come from an old school belief. I think we got to this belief as a security industry because we've taken a technology approach to a human problem and we found that we can't patch a human being. And so when I talk to old school security practitioners, they say, well, humans always suck. They're always gonna make mistakes. So we should just try to mitigate them at all costs and invest in technology. And we've been trying that approach for decades and it hasn't really worked. And I think it's because we've taken technology solution to a human problem. And I think that's the totally wrong way of going about it because human beings are complex beings who make decisions not rationally, but we have things that we're afraid of or that we're excited about that motivate us.

Masha Sedova3:20

Yeah, and I've been in organizations where the human element has been the only way that we've detected attacks because really sophisticated attacks have gotten through our very expensive technology stack that just wasn't tuned correctly. And it wasn't until a human being said, you know, something looks weird here. I want to check it out.

Masha Sedova3:41

So the story that we're calling was I was working with a red team of a large corporation and the red team had spent about a month of R&D time developing custom malware that they were sending out in really targeted phishing attacks to specific employees to get remote access to their machines. Once the user would click on the phishing link, they would install this machine. And what ended up happening once this malware was installed is it would change the proxy settings on a browser and start routing software or routing network traffic through malicious paths. So, yeah, it's very sophisticated malware. So the story that I recall specifically was this had managed to this malware being created for customized for environment was able to bypass a lot of the technology controls.

Masha Sedova5:18

Yeah, good question. So one of the things that I found in my career is really helpful is to focus on failure as an eventual outcome. And if you train people to say, security is hard, security is tricky, but that's okay. And if you sometimes you make a mistake, just let us know and we'll figure it out together. We'll take a look at together and you create a safety of failure and safety to say it's OK that you made a mistake. You'll find that if you haven't, you'll be able to get much more open and transparent dialogue with employees. And that type of relationship and that trust building takes a long time. It takes repeated interactions where a person sees that the security team has their back and isn't out to get them fired.

Masha Sedova7:24

Thank you. As a simple thing, right? Or stand at the door and every time anyone walks in who's wearing a badge, just give them a donut for no reason at all, other than they're exhibiting the correct policy that you've asked them to, as opposed to only finding opportunities to punish people. And so for all the behaviors that any organization is trying to drive, finding ways of rewarding people when they do the correct thing, instead of just punishing them for doing the wrong thing.

Masha Sedova8:12

Yeah, one of the things that I find, so back to the earlier point I was saying around the fact that we're solving a human problem with technical controls, we're missing the fact that human beings not only make mistakes, but also require reward and recognition and reinforcement, but at the end of the day are also busy human beings. Like the majority of the organization we're trying to secure, they're not security experts. If they had been, they'd be on the security team. Right. But instead, they're in marketing and they're in sales and they're developers and they don't ask the security team to do their job like they don't ask you to market. Right. In addition to your job. And it's unfair for the security team to ask for employees to be security experts.

Masha Sedova10:00

Yeah, I know.

Masha Sedova10:07

I think very much so. Yeah. And as you were saying, bedside manners, as the medical industry is teaching doctors how to have bedside manners to avoid getting sued. Maybe we have our own equivalent in the security space, right? Security bedside manners.

Masha Sedova10:20

Right. And how to work with non-technical or non-security folks in your organization and win friends and influence people.

Masha Sedova10:34

Yeah, that's a great question. So maybe I'll take it back before I got into information security.

Masha Sedova10:39

So I studied computer science in school. When I went to school, information security wasn't really even a topic. But I had decided that I wanted to be in some form of engineering or IT support or some kind of technical role ever since I was a little girl. And I knew that I wanted to get into this space because my grandmother was a computer programmer. Oh, I know. So I'm originally from Russia. I was born in the Soviet Union and we moved to the States in 1990. And my grandmother was the first graduating class of computer programmers in 1954 under Stalin in the Soviet Union.

Masha Sedova11:16

It's totally amazing. Yeah. And I asked her, I was like, Grandma, what programming language did you learn? She's like, when I went to school, we didn't even have programming languages, right? Cards, right? There's mainframes and punch cards, right? Yeah. And then she's like, then we learned PL and then Fortran and then C. Wow. And she taught my dad how to program in C. And my dad taught me how to program when I was a little girl.

Masha Sedova11:41

I must have been like in sixth grade or so, sixth or seventh grade.

Masha Sedova11:45

Yeah. So, I mean, not that early, but earlier than some.

Masha Sedova11:51

Actually, we were pretty poor. So I would go into a computer lab in local university and local community college and play around on their Macintoshes there.

Masha Sedova12:00

We still had access for, even though we were poor immigrants, we still had access to a computer. But it was interesting because, you know, there's a lot of conversations right now about women and STEM. And if I look back as to why I got into this, I know I had role models in my own family, in my own life, and it never occurred to me that I shouldn't get into this field. And maybe part of it is the immigrant story. I like picking hard challenges and very tall mountains to climb, and computer science seemed like a tall mountain. Nice. I did that. And I went to school initially two years. I had two years of a liberal arts degree, which became relevant in my behavioral science work later on. I didn't realize that was what I was doing at the time.

Masha Sedova14:48

Yeah, that's a good question. Yeah. So there is an exchange for your two years of school. You work for the government for two years afterwards. And so I started work for a defense contractor. I Got a chance to work for Customs, and then I was cyber analyst for Northrop Grumman. And as I was mentioning earlier, I'm originally from Russia, so I speak Russian fluently and has a background in security. I got to work on some really cool Russian cyber threat accounts. Which was fascinating and really got to see some of this work in action and particularly how, what kind of nation state adversary capabilities are. And along the way, I became really interested in the human element because obviously you have these technical attacks, right?

Masha Sedova18:12

Really fascinating, yeah. And so I was like, okay, so there's something about gaming that I started extracting.

Masha Sedova18:16

And then that got tied into positive psychology, which is a really good book. This is called Flow by an amazing researcher called Mekhi Csikszentmihalyi.

Masha Sedova18:29

And he believes that if you give people the correct amount of challenge that meets their skill level, that is a state of happiness. And if you use that definition, you can actually create happiness for people. And so as an example, let's say if we're given a challenge, a game that is too hard for us, we find it frustrating and we quit. If we play a game that is too easy, we get bored and we quit.

Masha Sedova18:55

But if we get to a level that is just at the right level, we find it fascinating and we keep playing it again and again and again until we master it. If we go back to it, we'll be bored, right? But then we now have the skills to level up and get higher and higher and higher. That is ultimately why mastery, the journey of mastery, is tied to what he calls the optimal human experience, happiness. And that can exist in sports. That can exist in when you're performing musical instruments. But there are lots of experiences where we can get into the state of flow. And so that's slightly related to security. What I started thinking about was like, so it's not that we're afraid of hard work. It's just that the information or the challenge needs to be presented at such a way that meets somebody's ability level.

Masha Sedova19:46

And that requires understanding of their ability level. So we can't do a one size fits all approach. There's a certain amount of customization that needs to happen for someone to want to engage into this conversation. Right. So that was the second field. And the third field ultimately tied all of these elements in, and that was behavioral science. And this was heavily relying on the work of BJ Fogg, who is a professor out of Stanford. And he talks about the fact, how do we create new habits? And that's the perfect combination between motivation and ability. We will do something if we are either motivated enough to do it or something is easy enough to do. And you can play on either of those two verticals.

Masha Sedova21:03

I did because that sort of got into the game design aspect of it. I did play with leaderboards. I found that leaderboards are effective for a small subset of people. Sales and executives are really big into leaderboards. But I have also found that leaderboards are really effective for like the top 10% of performers. And you're going to get the same 10% on your leaderboard again and again and again with very little churn. And you're only engaging a really small population who are likely already going to get the content anyway. You're not engaging with the masses. And so I since then moved away from leaderboards as a core technique for engaging a large population. But I think in small subsets or maybe small campaigns, it is actually an effective use.

Masha Sedova22:02

Yeah. I've actually seen it as social acceptance where people might not care about security or saving power, but they do care about security. How they're performing compared to their neighbors. And so what you were saying is the Opower report saved something like $8 billion in energy use because they just compared your usage to somebody else's. And it's been shown to be really, really effective. And it's a behavioral science concept called social proof.

Masha Sedova22:27

We've been doing that for security data sets and showing how you are doing on reporting rates and phishing click-through rates compared to your team, to your department, and to your organization. And people have been finding that to be incredibly, incredibly powerful in getting people to shift their behaviors. Because you might not care about reporting, but you might care about the fact that you report three times less than everyone else on your team, for example.

Masha Sedova22:58

So it's behavioral economics, behavioral science, behavioral psychology. I think this is all Venn diagrams. Like there's mass overlap in them. I think behavioral psychology is probably subset behavioral science. I'm not entirely sure. I suspect a professor... Of one or the other would correct you, but I don't know the terminology enough to declare it.

Masha Sedova24:03

Absolutely, yes. So at its core, the security education industry has a belief that, you know, the problem is that people don't know. And if I give you more information, you'll do something different. And all of a sudden, you'll change your behavior. When in fact, the reason people don't do things is not because they don't know. But there are a lot of other things that can influence a behavior. So one of the things that I did was changing tailgating behavior while I was at Salesforce. People weren't wearing their badges and walking through spaces visibly, walking to secure spaces without authentication. And so I initially thought, well, maybe it's an education problem. And I sent out the policy and put posters up and it didn't, not a surprise.

Masha Sedova24:46

No one's like, oh, I didn't know. There's a poster. I'll do it now. Right. And it's funny. Yeah. We all laugh. And yet that's what we do. Right.

Masha Sedova25:00

You're totally right, though. Posted notes are passive aggressive. Yeah. Yeah, just have a conversation. But that's what I started doing. Right. And I started talking to people. I was like, hey, why don't you wear your badge? Right. I'm just curious. And I found a couple of things. One, people just had a badge pull that was broken and they didn't know where to get a new one.

Masha Sedova25:19

That's it, right? And that's not necessarily behavioral science other than I asked some questions. And that's back actually to the BJ Fogg model of motivation and ability. They actually just didn't have the ability to wear their badge. They wanted to, they just didn't have the ability. So I'd fix that. The second thing is people were not able to have a hard conversation with other people behind them and said, I need you to badge in. It wasn't a social norm. And so what I had to do was model for people. I'd created a video and shared that out I modeled for people how that conversation could look so they had a certain comfort of understanding what that looks like. And then the last component was the motivation.

Masha Sedova26:36

And they were empowered to do it. And so by giving people the ability, the tools and the framework, and then understanding why they needed to do it, we shifted the behavior. And I'm told it's been about three or four years since I've been at the company and this department where I did that or this building where I did it. And I'm told that's still the culture is to always check the badges of people behind you, which warms my heart.

Masha Sedova27:00

Thanks. Similar with phishing reporting, you know, people always thought they were just going to get punished if they clicked on links. And once we communicated that the correct behavior was reporting and not, it wasn't just falling for a link, but actually reporting. And then we send out thank you emails to their managers. We highlighted top reporters, fastest reporters. We sent the most, you

Masha Sedova27:27

You got it. Yeah. We were able to increase our reporting rates 350 percent in six month period. So that was really valuable.

Masha Sedova27:34

Yeah.

Masha Sedova27:53

Yeah, I think mentorship is probably one of the most pivotal ways of getting people into this field and getting them to stay in this field. As I was mentioning earlier, I got into it because I had a model from my grandmother and it never occurred to me that I couldn't do it. I have personally found that, so I do some casual mentoring, which is advice here and there, but also there's certain people who are really interested in a career path and doing the work that I'm doing. And we sit down on a regular basis and talk through, you know, career choices, when, if they get stuck in an organization, like, you know, when do you ask for a promotion? How do you push back on your boss? How do you put together, like, how do you level up your skill sets?

Masha Sedova31:30

Yeah. So I wouldn't go up to someone and be like, would you be my mentor? I don't think either party knows what that means. Okay. I think it's really helpful if you can come in with a very specific ask and said, I'm really interested in X, whatever X is. Getting into behavioral science and security. I'm really interested in your application of finding backdoors in this application. I'm really into hardware security. And I know that you are like a leader in this space. Would you be willing to help me architect my career or work with me on the next several steps to get me into a job in a successful company or working on a really cool research project or work with me to present at a next conference?

Masha Sedova32:54

And occasionally from this blast out, there's a couple of things that come back and say, I heard this that you said. And that reach out, I always try to respond and initiate some kind of dialogue because how else would we have ever crossed paths unless you reach back out to me? And so I highly encourage finding people who do speak a lot in this space because they're probably a great place to start because even if they're maybe at capacity from a mentorship perspective, they might know other people that you can get in touch with.

Masha Sedova33:32

Yeah. It's a lot more satisfying to be humans than just to be digital robots.

Masha Sedova33:54

Yeah. So at its core, what we're trying to do is rethink the way that enterprises, companies approach their human element. And so, as I was mentioning earlier, as a foundation of behavioral science, we are building three different product lines that really look at the full human experience. So the first product that we created is a group-based game called Hacker's Mind. And you sit down in a room or a virtual room. And you play through this game with your peers or your coworkers, and you experience what it looks like to look at yourself from the perspective of a hacker, and you ultimately design an attack against yourselves, exploiting the human vulnerabilities, the social manipulation techniques that you've uncovered in yourself and trying to get access to the key asset that you have, ultimately designed to get you to

Masha Sedova35:34

And it's also fun because you get to play with your peers. Again, the human connection, right? Yeah. It's not just you and a machine. It's dialogue, which secondarily actually really helps with retention. If you have discussion, you're likely to remember something 70% more than if you just read it, which is 15% retention.

Masha Sedova35:52

And the second product is like, okay, so cool, you care, now what? Wouldn't it be great to know what specifically you need to do to be a better security-minded employee? And if, let's say, Susie at a company is excellent at security, she never clicks on a phishing link, she has a password manager, she reports all the time, why does she need to go through the same security training that John on the other side has to go through, even though he's terrible, right? He posts like, you know, Secrets to GitHub all the time, as leaky as three buckets. It's not necessarily fair, and it's also not relevant. So what we're doing is ingesting the security behavior data that exists for a lot of enterprises, often in Splunk or through phishing assessment tools and reporting.

Masha Sedova37:25

And then all that data is also pulled back for the security team so they can see, you know, I'm trying to influence malware download rates. Is it actually getting better or worse? So you can actually start using data-driven approach to your security awareness programs to see if you're actually making an impact or are you finding that the posters you keep putting up in the sticky notes are keeping you flatlined, right? Yeah. I anecdotally have seen this, but I'm on a mission to show the industry the data that shows, you know, ongoing videos and newsletters don't do anything to shift behaviors or do, you know, maybe three percent. And then you got to try something else.

Masha Sedova38:07

So to really start seeing what kind of campaigns truly start shifting a behavior. It might be an email from the CEO, right? It might be a video of your latest tailgater, or it could be sticky notes, and I'm totally wrong. But really start using a data-centric approach to understand who are your high-risk groups, who needs focus on, and then give people very customized and tailored recommendations for where they are.

Masha Sedova38:36

Yeah, it's in super beta, scheduled for next summer, but essentially our working title for it is Grammarly for Security, the red squiggly line that will in line tell you whether or not this is the moment you need to be paying attention or not.

Masha Sedova38:52

Summer 2019. So stay tuned for that.

Masha Sedova39:08

Yeah, totally. I have two favorite fails. So shaming. I think shaming works short term and long term. People just don't trust you. And I used shaming for locking people's computer screens. And that works. It works. Right. And then you're the enemy of the state going forward. Right. And then bad math. That's, you know, I've seen it work in work in some organizations, but not in others.

Masha Sedova39:35

Second, I have run phishing campaigns that have impersonated well-known logos and brands, FedEx and Dropbox and Facebook. And my target audience decided to report those phishing attacks to FedEx and Dropbox and Facebook instead of us. And the CISO of those companies ended up calling my management and told us to cut it out, which we did, which we did.

Masha Sedova40:03

I know. No, I would have probably just had an informal heads up next time if I felt like a campaign like that was really important to run. It really is too bad because if you neuter campaign enough to make it, you know, a package is here, but without the branding, you know, attackers do it all the time. It's too bad that as training, we can't do that. But yeah, that's the thing. And the last lesson I learned that I was really surprised on is money isn't a motivator as much as I thought it would be. And I have since done a lot of reading in this space. But I found that, so the specific example was I was running a bug hunt, like a bug bash for a set of products. And we basically said, if you show up and you find the most number of bugs, top winner will win this $1,000 piece of technology.

Masha Sedova40:52

And I found that very few people showed up despite it being marketed and communicated and set on people's calendars. And I was really confused because I would have thought that $1,000 would have been plenty of money to get someone in the door. And what I have since found is what happens is that people do this correlation and say, I'm really busy. And I don't really need that $50, $100, even $1,000. It's not really worth it. I can live without it. It's not a big deal. And they do a calculation in their mind as to, is my time or my energy worth that $1,000, yes or no? And they'll often opt out because they have a lot of stuff going on. And so that's an extrinsic reward. Now, if you tie something in that's an intrinsic reward, something like competition, like win amongst your teammates or altruism, like defend this company in a way that no one can, but something that doesn't have a clear monetary value, but it does have a personal value to somebody.

Masha Sedova42:32

It's so great. It's so great. But it goes into, there's a specific example of a moving company or like why if you ask a friend to move, they will feel better if they did it for free and just strengthen this friendship than if you sort of gave them like the friend rate of, you know, a $50 versus the 300 moving truck. And they're like, they were more likely have done it for an altruism thing than have the whole thing be cheapened by a $50, whatever. Yeah. Coffee or dinner date or something and be like ah you just use me as cheap movers right whereas if you had never paid them at all they would probably have been better off yeah it's a fascinating quirk of being human yeah so much to say on that you know just being internally motivated versus externally motivated you see that with kids trying to you know see which kids are internally motivated or externally and then yeah i mean you've touched on so much behavioral rash i love that book it was one of the first books i read in behavioral economics

Masha Sedova43:47

My pleasure. Thanks for all the great questions.

Masha Sedova44:00

Yeah. So the best email to reach me is Masha at ElevateSecurity.com. I'm also on Twitter at ModMasha, M-O-D, M-A-S-H-A. I'm also pretty active on LinkedIn. So please feel free to find me there and drop in your note that you heard me on this podcast and I'll make sure to accept your request.

Masha Sedova44:23

Thank you so much. Really appreciate it. All right. Thank you.

Masha Sedova44:37

They might thank you for it.