Changing Mindset: What Cybersecurity Practitioners Can Learn From Tarot Cards | DevOps Connect: DevSecOps 2023

It is uncommon to see the words cybersecurity and tarot used together. And what I'm gonna do is I'm gonna ask you to con, I'm gonna ask you to consider that maybe the intersection between cybersecurity and tarot actually exists in our minds. Now you might be thinking, Caroline, have you gone completely off the deep end?

You used to write and talk about topics like security metrics and application security. Didn't I just hear that Cobalt released its fifth annual state of pen testing report with more than 16,000 findings? Why aren't you talking about that?

Why are you talking about tarot? It's cuz Mark asked me to. Um, and because I think it's fun.

So I wanna start out, uh, by telling you a little bit about myself. Um, I'm so delighted to see several friendly faces, uh, and be able to connect with folks that I know. Um, there's also a lot of new faces and folks that I haven't met before.

Um, I also think that, you know, these stories that we tell ourselves about who we are and how we got to be this way, these external and internal narratives I find to bely fascinating. I started my information security career in 2005, leading security teams at eBay and Zynga. Since then, I've run a global product management team at Symantec, been a management consultant at digital.

I'm currently the chief strategy officer for an offensive security company called Cobalt, where I lead the security delivery and strategy teams in interested in terrible. In 2011, I published a bestselling textbook with McGraw Hill on security metrics in 2022, that book was inaugurated into the cybersecurity Canon Hall of Fame. I teach cybersecurity courses on LinkedIn learning and my courses have been viewed by over 200,000 learners.

I host a podcast called Humans of InfoSec. We began this podcast five years ago and today we have more than 80 episodes featuring the amazing and unique stories of experts and leaders in our field. Last year I received the president's award for public service by is s s a and was included on a Forbes list of 15 inspirational and influe influential female leaders in technology.

An extremely humbling list that also included Cheryl Sandberg and Marie Cury. This afternoon I'll be attending the Champions in Security Awards gala, where I have been nominated for the Champions in Security Collaboration Award. That is my professional story and it's my public one.

My personal story looks a little bit different. In 2012, I married the wrong person and in 2013 I got divorced. For years I've struggled with anxiety, depression, and alcoholism.

In 2014 my father was diagnosed with pancreatic cancer. In 2015, my daughter was born and my father passed away. One week later, About a year after my daughter was born, I got laid off from Sigi and I was responsible for being the primary breadwinner in a house in San Francisco as well as having a one-year-old baby girl.

A few years later we ended up leaving San Francisco, this city which I was born in and had lived my whole life. Uh, we picked up and moved to the Pacific Northwest. So that's my story.

I have been so nervous about this talk. I have had some really severe imposter syndrome because tarot is a very woo kind of topic and I was texting with a really good friend of mine and I said to her, I'm having really bad imposter syndrome right now. And she wrote me back and she said, wow, you are maybe the most skilled application security person I know your credentials are impeccable and you know and have implemented so much.

It's amazing that when the most awesome people have imposter syndrome because the rest of us are thinking, what? And that meant so much to me and it also corresponds to the devil card in the tarot. So the thing about tarot is that in my opinion, it's not about predicting the future, it's not about divination.

It's not about connecting with spirits unless you want it to be. Um, it's really about changing mindset. It's about brainstorming new ideas.

It's about looking at problems from a different angle. It's about recognizing that these 78 pictures on cards represent human archetypes that are within each of us and we have an opportunity to simply explore those. And so this imposter syndrome is like perfect for this talk because it's my devil.

So I'm gonna talk briefly about what is tarot and why are we talking about it today. I'm gonna talk a little bit about mindset and changing mindset. I'm gonna go through a series of cards and interpret them for us for cybersecurity.

And at the end of this I'm also gonna recommend some activities uh, that you can try out for yourself if you like, that kind of thing. So what is tarot? Tarot is an evolution of playing cards.

My understanding is that the very earliest playing cards or games of that type, um, kind of like dominoes actually originated in China. The earliest known playing carb decks I believe are from China and Egypt and they made their way via the Silk Road over to Europe in Spain and in Italy in like the 13 or 14 hundreds, the church banned playing cards and they burned, banned tarot cards. Uh, and that was really interesting.

The most common deck that folks are probably aware of if you know anything about tarot is a deck created by a person called Rider Wait. It is illustrated by a person called Pamela Coleman Smith. And today you can find variations on these tarot cards, literally whatever you want.

Cat tarot cards, fairy tarot cards. I'm sure there's like internet based tarot cards. There's just like all all of these terra cards.

Is there anything else I want you to know? Um, there's two categories of taro cards. So there's what's called the minor arana and that's kind of like a deck of playing cards.

There's four suits. Uh, the suits happen to be Ws, which represents fire cups, which represent water swords which represent air and pentacles which represent earth. In addition to the minor arcana, which is sort of like a playing deck of cards, there's also uh, about 20 or so what's called Trump cards.

Uh, the Trump cards are kind of like the big tarot cards. I did a talk in 2019 at BSides in San Francisco and during that talk I shared a version of my professional and my prof and my personal story similar to as I just did a few moments ago. And I also talked about things like C B T, cognitive behavioral therapy.

I talked about things like energy management, the idea that, you know, we spend a lot of time trying to figure out how to manage our time and I've actually begun to practice like this idea of energy management, which is to say managing our energy because while I believe that time is actually finite and discreet, I believe that energy has the potential to be unlimited. And I think folks, you know, any of us can remember a moment when we were in flow and just going and just staying up all night solving a problem, you know, working on something fun that that made you feel full of energy. So for us today, when I think about wellness, when I think about how we can take care of ourselves when we think about asking questions and making decisions and considering options, we know that diversity leads to better results.

And so the question that I have and the recommendation that I have is Let's try and diversify our minds. Who feels like this? Sometimes I think it's common for us to feel this way.

Why is that? It's because there's so much that we cannot control. We cannot control the behavior of bad actors.

We cannot control the malicious attacks that are launched against our software, our organizations and our people. We cannot control the unintentional errors that we make, that our teams make, that the users of the software that we build make. We cannot control our stakeholders opinions, decisions and actions including regulators, executives, developers and vendor partners.

We cannot control the size of our security budgets or the size of our security teams. What then can we control? We get to control how we manage our time and we get to control how we manage our energy.

We control our decisions and our actions and our behaviors. We control our opinions. We control the way that we think about things.

We control the way that we interact with others. We control what we say and what we do. It's natural to get upset and stressed out about things that we cannot control.

However, it's pretty challenging and requires a change in our mindset to focus on and be laser focused and intentional about what we can control. As you go about your day, notice what affects your thoughts and your feelings. Notice which things come from external elements outside of your control and consider putting those aside.

Notice which things come from inside of you that you have complete control over. And consider pulling those in closer. So there are these books.

One of them is called the Phoenix Project and one of them is called the Unicorn Project. And in the unicorn project there is this idea, there are these principles and I really think that whatever we've been doing before, whatever we've been doing before, we were doing what these five ideals say to do, it's not working. We have an opportunity to do things differently.

We have an opportunity to shift our mindset. Risk management fundamentally is about acknowledging a lack of control. So today I want to talk to you about risk and I want to talk to you about control and I want to talk to you about storytelling.

So what I love about the tarot is that I can be going about my day mindlessly caught up in a stream of emotions and thoughts that are largely driven and influenced by things that are outside of my control. Someone just doesn't get it. A business decision has been made that I don't get to backfill the person on my team who just left Development managers are not prioritizing security.

Vulnerability fixes, incidents and fires are happening and they need to be addressed. Projects are not getting done. I'm stressed out and exhausted.

Sometimes I just take a moment and I take a couple of breaths and I shuffle my terror deck and I pull out a card and then I breathe some more and I look at the cards and their imagery and I notice how I feel in response to how the card looks and what I understand about its traditional meaning. I ask myself at this moment, what can I learn? How might I be able to shift my mindset?

Security people learn about technology and tools and vulnerabilities. And for years I've been saying we really need to learn about the business and about revenue generation and about value creation. Today I'm saying we also need to learn about ourselves, particularly the stories we tell about ourselves and the narratives.

I really like tarot as a tool for self-awareness, for getting to know yourself, for reflecting your interior truth. When you pull a card, what is your response? Tarot can also be play.

Self-care involves play. It involves doing things for fun. It involves doing things that have no purpose other than your joy.

Tarot can be used for imagination, for creativity. You can allow your thoughts to drift down a fantastical path and see where it takes you. We live in a culture without myth and without meaning.

We are so focused on progress and practicality. But what more is there? I used to work for a gaming company and this gaming company made money with these like addictive Facebook games, Farmville.

And we're just wasting time our precious lives. I read a book a couple years ago called 4,000 Weeks and the whole point of the book is the average human lifespan is 4,000 weeks. What are you gonna do with your one precious life?

Are you gonna scroll Twitter? Are you gonna play Farmville? Tarot is one example of entertainment with depth, the shuffling and the ordering and having something physical to hold in our hands and the knowledge that maybe in some way we are each all of these 78 archetypes.

Sign cybersecurity is in the 11th. Wait, I was gonna say cybersecurity is in the 11th hour of human existence, but that's not even right. Cybersecurity is in like the 11th hour and the 59th minute and like the 58th second of human existence.

Our field has only existed for less than 50 years, but humans have been around for way longer and they have been dealing with all sorts of daily problems, problems at work, problems with friends, problems with family, problems in love, problems with ourselves. I think it's really interesting to ask ourselves what about being human has always been the case? What has always been true?

Sometimes transitions and change are hard and evolution is hard and it's always been hard. And so we have an opportunity to look at things a little bit differently. Okay, I think I did all the talking that requires notes.

I think now, oh my gosh, we've got nine minutes and so I just get to go and talk to you about some of these cards. There is a card called the hanged one, Which Sounds really intense, right? Most people hanging upside down are not doing it cuz they chose to do it.

But sometimes if you find yourself upside down physically or metaphorically, there is an opportunity to look at the world differently. And if you can look at the world differently, you have an opportunity to see things differently, you have an opportunity to change the way that you think which might actually open up paths to different decisions and different actions. I think that we as cybersecurity practitioners and software development practitioners, every single day we have an opportunity to turn ourselves upside down and consider looking at something differently.

Why do we do this? Why are we here? Why do we stress out so much?

Why do we care so much? It's because of the world. The world card is what we care about.

We care about the people in the world, we care about the communities, we care about the societies. If not for people in the world interacting with each other on the internet, we wouldn't have a cybersecurity problem at all. The world is what we care about.

And sometimes it's nice just to remember that the Wheel of Fortune card. I think that there's stuff that we can control and I think there's stuff that we cannot control. Another way to think about this concept is what is free will and what is destiny?

How much do we get to choose and how much is just gonna happen no matter what we do? Wheel of Fortune is about risk management. It's about, it's about not being able to predict the future.

It's about letting go of trying to control things that you could never control, that you've never had control over. And it's about recognizing what you do have control over and really taking responsible ownership for that. The tower, there are a few scary cards in the tarot.

One of them is the devil, one of them is death and one of them is the tower. In the traditional tarot imagery, this card shows a tower being struck by lightning falling down and people are like jumping out of the tower fearing for their lives. And this is kind of like what it feels like when you're in the middle of a security breach.

It feels like the tower. Another tower moment that we experience sometimes is when your budget gets cut or when you get laid off or when everyone on your team gets laid off except for you. Those are tower moments in our professional and our personal lives.

We have tower moments all the time. I really like the tower. There is a philosophy associated with the tower that says, look, this is a moment in time and it's part of a spectrum of what's gonna come next.

We've got five minutes. We got a question. I do.

So you had mentioned towers part of one of those three cards that you know is real scary, right? What does death mean? Um, Yeah, great question.

Let's talk about the death card. I had a slide on the death card and I decided to take it out cause I didn't wanna scare people. We're all grownups.

The death card and the tower card are the same thing except for death happens slowly and tower happens fast. If you go along with the death card, then whatever's dying can just like fade away. If you resist and you resist and you resist and then the tower card comes up, everything is just gonna explode in your face.

They are both just moving from one moment in life to another. And here's another thing, death could be a good thing. What if it's death of a bad thing?

What if it's death of imposter syndrome? What if it's the tower and you divorce the person that you don't wanna spend the rest of your life with? Great question.

Thank you so much. So what do you do when you get the tower card in life? You look for strength.

Each of us has strength. One of the really cool things about the traditional imagery for this card is there's a feminine figure and she has a lion by her side. The lion is wild and vicious and the feminine character has tamed the lion.

So we can be angry, we can be strong, we can be furious, we can just have like raw unbridled anger and energy. And we can also use that. We can, we can choose how to use it.

Sometimes you just gotta chill. Sometimes you just gotta remove yourself from the craziness of it all and just chill and think and that's what the hermit's about. And then when all is lost and you feel really desperate and hopeless, you look for the star.

The star is always there. The star is hope. And guess what?

We've got stars all over this industry. I've got a podcast, it's called Humans of InfoSec. We've got 80 stars for inspiration and to give us hope and to give us energy.

The chariot is just about the journey forward. You gotta always just go forward. You gotta always just be trying.

If you take an action, something will happen. The fool is perhaps one of my favorite Carves. The fool is about the recognition about how little we know.

And it's about continual learning. It's about tech strong learning. All right, super quick.

Six of pinnacles asking for security budget. Five of swords. You lost the battle.

Five of Ws. You're fighting with development leaders. Three of pinnacles.

This three of pinnacles is the DevSecOps card. Folks are working together to build something greater. 10 of wands.

You're trying to carry too much. You're doing too much. You're exhausted, you're overwhelmed.

Four of swords. You just need to take a nap, take a vacation. Take a break.

So what do you do? You get a deck. You pull a card and you ask the card, what should I consider?

You pull two cards. You say cards, here's my situation. What's going on with it?

That's your status card and what do I need to support me? That's your second card. You pull three cards, you say, tell me about my past, my present, my future.

You go to Google and you type in TA spread and you look at images. Email me, email me and put taro in the subject. And if you have questions, write that in the message and I would be so delighted to to pull a card for you.

That's what I've got. Thank you. Thank you.