BSidesSF 2016 - The Art of the Jedi Mind Trick (Jeff Man)

### Overview In this BSides San Francisco 2016 presentation, Jeff Man examines why the security industry continues to struggle with persistent data breaches, point-of-sale malware, and basic weaknesses like default passwords, despite decades of technical advancements. Drawing on his background as an NSA cryptanalyst, early penetration tester, and PCI Qualified Security Assessor (QSA), Man argues that a significant portion of the security industry's problem lies in poor communication. Security practitioners frequently fail to educate decision-makers, bridge the technical gap, or present manageable, risk-informed options. The "Jedi mind trick" refers to the art of effective communication, empathy, and framing, enabling stakeholders to reach sound, logical security conclusions without unnecessary conflict or technical jargon.

### Key Topics - **Industry Communication Breakdown:** Security professionals often know the right solutions but fail to present them effectively to executives, boards, or non-technical management, leading to stalled security programs. - **Knowing the Audience and Listening:** Researching stakeholder backgrounds, interests, and priorities before engaging, and actively asking organizations what problem they are actually trying to solve. - **Bilingual Communication:** Translating deep technical concepts into accessible, business-focused terms, while recognizing that jargon, heavy math, or poorly chosen analogies (such as regional idioms or sports metaphors) can alienate listeners. - **Feedback and Verification:** Avoiding assumptions about whether an audience understands technical findings; confirming comprehension by having stakeholders articulate what they heard. - **Framing Assessments Constructively:** Balancing negative audit or pentest findings by acknowledging positive security aspects first, avoiding an adversarial tone that creates defensiveness. - **The Three-Option Strategy:** Facilitating executive risk decisions by offering three potential paths: doing the bare minimum, implementing an ideal/high-cost scenario, and adopting a balanced middle ground that encourages realistic risk negotiation.

### Technical Details & Industry Context Man contextualizes modern security failures by reflecting on foundational security practices. Decades prior, cryptography was largely manual—broken using paper, pencils, and one-time pads before automation on early, non-networked IBM PCs. While early commercial penetration testing focused on basic firewall adoption and security policy creation, modern organizations continue to fall victim to identical 20-year-old issues: default credentials, weak passwords, and misconfigurations. Rather than overcomplicating discussions with advanced mathematics like elliptic curve cryptography, practitioners must focus on foundational hygiene and explain concepts simply (plaintext combined with random keys producing ciphertext). Additionally, compliance frameworks like PCI DSS can serve as strategic leverage for internal teams to secure necessary resources, provided security is framed around informed, calculated risk rather than fear, uncertainty, and doubt (FUD).

### Takeaways & Practical Advice - **Treat Persuasion as a Puzzle:** View organizational hesitation not as an adversarial game, but as a puzzle with multiple viable solutions that requires patience, especially in monolithic enterprises. - **Negotiate Calculated Risk:** Aim to bring stakeholders to an informed, risk-based decision. If business constraints prevent closing every vulnerability, focus on monitoring the remaining gaps closely. - **Build Allies and Navigate Internal Resistance:** When dealing with reluctant or hostile management, avoid saying "I told you so." Instead, work slowly, celebrate small wins, identify internal influencers (such as administrative staff), and build consensus across sympathetic peers.