Episodes Review with Nathan Mielke, Director of Information Technology & Cyber Security Manager
Re-thinking The Human Factor with Bruce HallasShow Notes
While Nathan Mielke was teaching a cyber security lesson in homeroom at the Hartford Union High School in Wisconsin, the school experienced a distributed denial-of-service (DDoS) attack that took them down for about a class period. While the identity of the attacker was never discovered, Nathan is fairly certain the attacks were coming from a student's phone, or as it goes in classic American Horror films, the call was coming from inside the house…
Episodes Review with Nathan Mielke, Director of Information Technology & Cyber Security Manager
Nathan Mielke joins us for this episode of the Re-Thinking the Human Factor Podcast. Nathan is from Milwaukee, Wisconsin, and he's a Director of Information Technology & Cyber Security Manager combining high-level security and systems domain administration experience with a background in leading infrastructure development, data solutions, and information risk programs. His job is to manage training, data intelligence, risk, cyber defence, and investigation activities to safeguard users, secure assets, and ensure high-level security and systems domain administration. He and his team stay updated on the latest trends in security equipment/technology to not only keep the organisation safe but also on the cutting edge.
Interestingly, Nathan began his career as a Librarian, took a turn into the IT realm, and through a series of DDos attacks and other events has brought him to where he is now.
In this episode, Nathan Mielke joins Bruce Hallas to discuss insights they've both picked up while listening to the previous 3 episodes of the Re-Thinking the Human Factor Podcast: Char Sample Jonathan Armstrong Bennett Arron
"But ultimately, when something goes wrong, you will be judged on the thinking process that you had behind the choice that you made…"
SOME OF THE TOPICS NATHAN AND BRUCE DISCUSS IN THIS EPISODE ARE: What is it that drew Nathan to the Human Factor, the people piece? Bennett Arron's routine involving asking if any people in the crowd had been arrested and the lesson of timing and easing one's audience into heavier, more difficult topics. Char Sample, culture as a vector for attack, and how Nathan incorporates that insight into his goals for increasing security awareness for the educators he works with. As was pointed out in Jonathan Armstrong's episode, people must rehearse for what happens in the case of a security breach, and each of the involved organisational teams (i.e. Cyber, Lawyer, PR, etc) need to know how to work together in those situations to solve issues quickly and effectively. Regarding the human factor piece, do we think of awareness as being internal-facing only, or should we be considering that awareness is also about external stakeholders that may have an interest in what we're doing? How medium to small size businesses are the ones often flying by the seat of their pants when it comes to security awareness, behaviour, and culture. The probability that people who work in a positive cultural environment are more likely not only to retain training, but also to stop, think, ask questions, and behave in a safer more thoughtful manner than those who work in negative, stressful cultural environments. Stress those who are CISOs or Security Managers experience based on tight budgets and expectations born from the false belief many organisational leaders hold that if IT and security managers are doing their jobs, nothing bad is going to happen, ever; and how that stress effects the performance of those in charge of security awareness, behaviour, and culture for an organisation. How security and awareness managers and leaders need to be sure to build and maintain trust and a positive relationship with others in their organisations in order to bolster security efforts organisation-wide.
"Your data breach is coming. Are you prepared for it?"
MORE ABOUT NATHAN MIELKE: LinkedIn
Please subscribe to the podcast in iTunes, and if you enjoyed this interv
More from Re-thinking The Human Factor with Bruce Hallas
In this episode we re-visit an earlier theme explored in this series. The theme of mesurement and metrics. The question of how to measure awareness, behaviour or culture is something we consistently come across here at Re-thinking the Human Factor when exploring opportunities to work with clients. There's an palpable feeling, across industry chatter, that there's a real lack of maturity when it comes to how we demonstrate the effectiveness of our effrots to influence employee awareness, behaviour and culture. However, there is hope. In this episode I talk with Bernie Smith. Bernie has a focus on KPI's, not just your standard range but also he brings ideas about how you might create new metrics as well. We discuss his view on the development of metrics and how metrics can help not just measure performance but ultimately influence behaviour and shape culture.
In this episode we take a peek at the role of the security teams' own culture and its impact on the broader organisational culture. This, is an important perspective, because whilst many commentators focus on influencing organisational culture they haven't considered the role that the value and behaviours of the security team has in influencing positive security outcomes across the business. To help us explore this perspective, on cultural forces at play, we have a guest who knows a thing or two about how cultures are formed and influenced. Lianne Potter studied in social anthropology, then geeked out on technology before combining the two to shape an industry career which has achieved numerous accolades for her thought leadership in not just the human factor but also information security generally. Lianne, for me, illustrates a small, but growing force within the industry that recognises that the human factor needs to be repositioned not as an after thought once all the work of designing security controls has been done, but as a critical and key part of the process of understanding and managing information security risk. ©Copyright Marmalade Box Limited The content of this podcast is the property of Marmalade Box Limited. Any use of the content of the podcast, either in full or partially, will be considered an infringement of Marmalade Box Limited rights as sole owners of this content. Any enquiries about the use of this content should be directed to Marmalade Box Limited. Contact information can be found at www.marmaladebox.com .
If you're a regular listener then you will have already met today's guest Dr. Char Sample. Char is a force at work deep within the information security community. Char is a rarity, combining a deep knowledge of both the technical and human aspects of the challenges security professionals face when managing cyber security risks. Char and I go back a long way, to a horrible conference lunch in London, where her riveting conversation meant I didn't have to eat what was on the plate in front of me. I have been forever grateful. That riveting conversation was all about our shared understanding of how culture influences everyone's day to day behaviours and how everyday behaviours make up culture. That shared interest has led to many conversations and shared ideas about how the information security industry could step up a level by seeing the potential for improving how we assess and manage human factor risks. In this episode we capture one of those conversations. We talk about heuristics and biases, what they are and what role they might have in artificial intelligence. Why what makes us human often makes us behave in seemingly irrational ways even when presented with all the data we need and assumptions we frequently make when developing and designing systems and processes and how this is undermining the management of business risks. Be warned, there's a lot of laughter in this episode.
In this episode we are joined by a guest who has committed their career to the world of advertising agency work. Influencing target audiences awareness of products and stacking the odds in their clients favour, that the target audience will choose their product over their competitors. The challanges our guest has faced, over the years, are in many ways similar to those that education and awareness managers, for information security and data protection, now face.