Speakeasy - Session 1 (with Zoe Rose)

### Overview In this inaugural Speakeasy session hosted by The Beer Farmers (featuring Ian, Sean, Scott, and Mike), cybersecurity specialist Zoe Rose joins the group for an informal yet wide-ranging discussion on human behavior, community mentoring, and industry culture. Reflecting on her professional journey and community work—notably mentoring around 30 first-time speakers at BeerCon 2—Zoe shares practical insights on why information security must prioritize human empathy, clear communication, and accessibility over blame and fear.

### Key Topics - **Human-Centric Security vs. Blaming Users:** Zoe challenges the traditional industry trope that users are the "weakest link," arguing instead that people are the most valuable and critical asset of an organization. She emphasizes that security controls must fit into employees' actual workflows rather than forcing them into workarounds. - **Influence vs. Manipulation & Vendor Culture:** Referencing concepts from the book *Phishing Dark Waters*, Zoe highlights the distinction between ethical influence (guiding someone to make safer choices for their own benefit) and manipulation (exploiting emotions for self-serving goals). She critiques vendor sales tactics driven by fear, uncertainty, and doubt (FUD) or attacking competitors, advocating instead for vendors that engage directly with communities and seek genuine user feedback. - **Mentorship and Elevating New Voices:** The panel reflects heavily on the mentorship model developed for BeerCon 2. Zoe discusses helping new speakers overcome imposter syndrome and presentation anxiety through slide reviews, practice sessions, and transparent discussions of past failures, demonstrating how inclusive community support produces high-caliber presentations. - **Virtual Conferences and Accessibility:** Discussing the shifts brought on by 2020 and the COVID-19 pandemic, Zoe notes how virtual and streamed conferences lowered financial and logistical barriers, allowing broader attendance for parents, individuals with social anxiety, and international participants.

### Technical & Operational Details - **Contextualizing Vulnerabilities:** Zoe points out that delivering vulnerability scans or finding cross-site scripting (XSS) issues is ineffective if reports merely show an "alert box" without articulating real-world business risk. Security professionals must clearly explain the *why*—tailoring the impact and remediation context to management, developers, and compliance teams. - **Enforcing Sensible Security Defaults:** Addressing widespread shifts to remote work, Zoe emphasizes the necessity of rolling out and strictly enforcing controls like Multi-Factor Authentication (MFA). She notes that when paired with supportive communication and user enablement, organizations can achieve rapid, comprehensive MFA adoption without friction. - **Holistic Diversity:** Zoe touches on diversity beyond visible demographics, emphasizing diversity of background, life experiences (such as surviving domestic abuse), technical skill levels, and outside perspectives that enrich threat modeling and defense strategies.

### Takeaways Security succeeds when treated as an enabler of people rather than an obstacle. Industry practitioners and vendors must prioritize empathy, transparent motivations, and educational context over gatekeeping and criticism. Furthermore, fostering sustainable platforms and mentoring networks creates lasting pathways for newcomers, elevating the cybersecurity community as a whole.