Security Blind Spots: What the Louvre Heist Reveals About Your Organization

What happens when the risks we ignore the longest become the ones that hurt us the most? Hi, I'm Joan Goodchild with Foundry, and welcome to another episode of Cyber Sessions where we talk about the trends and topics important today's Security leader. Joining me today is Colin Zick.

He is a partner with Foley Hogue, where he advises organizations on privacy, Security, and the legal challenges emerging around new technologies. Welcome, Colin. Thank you.

Good to be here. Great.

Now, today we're going to be looking at two different stories that kind of reveal one issue, and that is Security Blind Spots.

Whether it's in a world famous museum with the Louvre heist that got so much attention a few weeks ago, or inside your own conference rooms with AI note takers, we're going to talk about liabilities when leadership decisions prioritize convenience over optics and resilience. So let's start right there.

Let's talk about the heist with the louver. Everybody was talking about that a few weeks ago. You know, the thing that of course got a lot of headlines at the time was that they had a, you know, obviously very easy to guess password because the password was Louvre.

You know, some things have unfolded since then, but you said in some writing that heist was predictable and preventable.

So what stood out to you as the most fundamental failure there?

I, I think, I don't know if there's a single fundamental failure, but there is so many.

And that's inevitably when you go back and look at any kind of incident, whether it's cybersecurity or another crime, it takes multiple things to line up and go wrong, which means you haven't been paying attention to multiple things over a long period of time.

I think, as you said, the one thing that was most predictable is that notion of, okay, here's the default password, we'll go change that later. Right. And you kick that can down the road.

But when you think about it, when you have some of the world's most precious items, how can you kick anything down the road? And I think that I thought about that in the analogy to business organizations, say you've got your crown jewels, because we always use that term.

And yet there's inevitably some decision you're kicking down the road, or as you said, it's inconvenient and you lose sight of that larger picture. And the whole idea that you would be able to drive that close to the building.

You know, here in the US at least now we learned from Oklahoma City you can't allow that in federal buildings. So now that's changed. I mean, you always fix it after the fact.

So what I try to encourage is folks to be creative and think about, all right, how would this happen? And let's try to anticipate where things are going to go wrong rather than be reactive.

Yeah, I mean, I've been in Security long enough that I remember. I mean, I wasn't in Security during Oklahoma City, but it was the first time I became familiar with the notion of a bollard.

You know, and now there's, you know, that's sort of table stakes to any highly secure building is to have bollards out in front. You know, is there any kind of.

You mentioned the sort of kicking it down the can, you know, what do you advise clients in terms of that sort of proactive mindset and considering what needs to be invested in? You know, that could be easily overlooked?

Well, I think you hit on the word. It's investment. It's investment not just of money, but of your personnel resources to make sure that people are given the time to do their jobs appropriately and that when they make recommendations that those are implemented. This sounds really simple, right?

Like, okay, people have jobs and let them do their jobs. For those of us in New England, we will remember a particular phrase from a particular coach. Do your job. And how seemingly simple it was for the New England Patriots to just. They all just did their jobs.

A bunch of, you know, mostly kind of ordinary players, but if they did what they were supposed to do, then the other guys would make the mistake. And I take.

I try to bring those sort of analogies when I'm talking to clients because, a. I think they're relatable and accept, you know, in. In people's lives, they say, oh, yeah, right. That's what that means. So here's in this context, what does it mean?

It means everybody does what they're supposed to do from a physical Security standpoint, from a technical Security standpoint, and there's somebody there who is coordinating those efforts and making them all work together. As you're doing your individual job, you don't have to worry about it.

And here, if the physical and technical Security had worked together, we wouldn't be talking about this. Sure, sure.

What do you think this incident also says about what Security leaders kind of celebrate and, you know, talk about in terms of optics versus what they should actually be investing in?

Well, I think, you know, first, it would be great if every organization let a Security leader celebrate optics. I mean, I think you are viewed inevitably as a cost center.

When you're in Security and when you look at the bad things that can go wrong and what they would cost, I'm thinking about as an example the recent Security incident at Jaguar, the production lines there.

I think they may just be getting back up hundreds of millions of dollars of loss because of that hack. So, yeah, your Security people are not a revenue source, but somebody's going to have to come up with that money to pay for that loss.

When you think about the ability to prevent loss here in France, we had priceless objects. And you think about it afterwards, we just could have spent a little more money.

And we know that every single organization is going to face someone, multiple someones, often nation states, trying to hack them. Why isn't our effort proportional to the threat?

Now you've said strategy is budget, so how do you, what is the signal for an organization that the budget kind of contradicts the Security strategy?

Well, I don't think, I would never say that it's a particular, you know, it has to be a particular percentage or a particular number, but it has to be the result of a thoughtful process. I mean, budget is also process. It's like, all right, we're going to do.

And you're going to do a risk assessment. The risk assessment is going to drive a needs assessment. The needs assessment is going to then look and say, what's the solution for those needs? And then what do those needs cost to address? Hopefully not more, not less.

And this is what it's going to cost. And if you've done your risk assessment right, and the needs assessment that flows from that, then you should be coming up with a realistic budget.

Now, I know in all budgeting everybody puts out a number and it's a little bit of a game there. You get a pushback and so forth.

I'm not commenting on how to play that game, but that if you come up with these well considered ideas and they're well explained, then hopefully management's going to say, yes, of course we need to do these things. I mean, I was just on a call today.

I'm part of our firm's internal information Security committee. And so I get to hear about all the things that our technical people are doing. And it's not without cost, but they're really important things that we should be doing. And they're done after risk assessment.

Of course you have to prioritize. Nobody gets everything they want. But again, that goes back. Have you done a risk assessment?

And said, all right, here's the top item. We've got to address that. This can wait for a little while more. This item. All right, we'll put that on an agenda for a year or two out based on the realities of budget that everybody has to face.

There's also this ongoing discussion that's been happening for years too about demonstrating ROI with your budget for the Security division. What are your thoughts on that in terms of budget is strategy?

How do you square that with the board and all of the other sort of number crunchers who are going to want to understand how you are bringing value to the table? Right.

I've been addressing that for almost as long as I've been practicing, which is going on 36 years. Because before I was doing privacy and data Security, I was doing healthcare compliance. Compliance is compliance in that regard where you're always being asked to justify your existence.

You're a cost center. So I thought a lot about that. And given that I developed some of my ideas 35 odd years ago. I used to tell everyone, and it worked for people my age, but I need a new one.

There was an old commercial for FRAM oil filters and the tagline, which was, it was incredibly effective. It's what, you know, either you change your oil regularly or you get to go see the mechanic and you're going to need a new engine.

And the tagline was, you can pay me now or you can pay me later.

It was the classic notion of ROI that if you don't do the daily maintenance which has a cost but it's not that bad, you're going to have the big failure. And that worked for a lot of people.

So if you have a suggestion of the modern day equivalent, because I do think now I'm stuck in the 70s with that, but it does work. The concept hasn't changed. I just need to find the modern day FRAM oil filter. Especially in the age of the.

The EV oil filters, I'm afraid are a little bit like buggy whips. They're on the way out. So we need the EV equivalent of pay me now, pay me later. Yeah, interesting point.

I don't know enough about EV engines to be able to make that comment, but point well taken. Okay, so we're still talking about Security Blind Spots though. You've also said attackers will optimize against your slowest control.

Give us an example, maybe even going back to the Louvre highs too. What does that look like as a dynamic within an organization?

Well, they're going to look for within your organization, what's the equivalent of Putting a ladder to your window, which is the lowest tech thing possible. I mean, this is. I have images going back to, you know, you can imagine.

We've all seen Romeo and Juliet said in the 1500s, you know, there's a ladder in the window there. We know that's the way people break into places. We've known that for centuries. You'd think you would defend against that.

Again, most of what we're asking about here for clients to address is things that they know about. So I would start with multi Factor Authentication. We know that there's resistance among users to mfa, but we know it works. We just know it works. Do I enjoy using mfa?

No. I struggled with a little bit of it today. I was trying to get a document.

I was trying to move fast. For some reason, it wasn't taking the password. It wasn't like, is it the right password? Yes, it's the right password. Put it in. It's still not generating a code. Why isn't it generating code? I don't know.

And you have to work with your teams to develop some tolerance for that, with the understanding that. Think about the alternative, which is, you know, we're going to be down.

I always remember, I won't name the law firm, but a law firm that had a breach and literally they had to shut all their computers off for a week. I can't even imagine that.

And if you can remind people of these things, then it makes it a little bit easier for them to swallow the occasional challenge and frustration of dealing with that higher bar and ultimately knowing that there are still folks who aren't prepared for the ladder at their window.

And that's where the bad guys will go because it's easy. And again, that's from time immemorial. So, you know, you've just got to take these. They really are tiny baby steps that we all know how to do.

It's not technically hard, and if you can build a culture of that, you're going to be in a far improved position.

And what is the gap really? I mean, you mentioned again, there's the frustration around it, you know, and some of these things really are simple.

It's the, you know, the ladder at the window example, but it's also, again, the resetting of the out of the box password on the server and other things that should be, again, especially for an experienced Security team, it should be an immediate thing to happen.

So why is it so difficult in your experience and, you know, maybe what you hear again, from clients or having seen Countless breaches. Now, what is it that keeps them from being able to solve what are often some of the simplest challenges?

Even with the Louvre, you had written that some of these weaknesses had been identified years earlier. Right?

Well, that's really a management issue. Is management paying attention and holding people accountable to do these identified remedies, tasks, whatever it is. And inevitably you find out that management went on to other priorities or you know that and you have a clear record.

Oh yeah, we brought that to their attention. We asked them do it. Can you make sure so and so won't do it? So there is a certain amount of accountability. And you know, you can use a sports analogy there. If somebody doesn't perform in sports, what happens?

They get put on the bench. Right. And I think that's one of the harder things for organizations to do, is to hold people accountable because it involves a certain amount of potential for conflict and people are by nature conflict averse.

They don't want to deal with that thing because somebody is going to get upset or I'm going to have to really lay the law down for someone to do what they're supposed to do who hasn't done it for whatever reason. But that's a management issue.

And I think one of the things you're seeing increasingly written about in the post Covid workplace is a failure of management because we haven't adjusted to what it's like to work in a fully remote or hybrid environment.

We're using our old patterns of behavior in this new context and it doesn't always work. As an example, you just don't always see John in the hallway. Right. I used to.

You would see John or Jane in the hallway and you would be reminded, hey, I meant to ask you about that thing.

Rather than having a system of clearly following up, not based on randomly seeing somebody in the hallway or the cafeteria or at the coffee machine.

That's, that's a simple thing, but it requires a greater level of intentionality to check in with the people who work for you, which means you have to schedule something, means you have to stick to that schedule and you have to have a little bit of an agenda.

None of these things are that hard, but they require the discipline of doing them.

Now let's switch to AI Note takers, you know, which is another sort of Security Blind spot that you've written about. What do you think are some of the misconceptions that exist out there right now for using these, especially during sensitive meetings?

I think it's worse than misconceptions it's reflexive use without thinking. So the first thing you have to get people to do is think about the tool. And we have a lot of people who just, well, it's there. You probably experience it.

I experience it virtually every Zoom teams, whatever you call it, that's got one of these tools. You see up there's the note taker.

And people have either defaulted to the setting, which is the equivalent of, all right, modem comes out of the box, we're not going to change the password. This is just the way it is. And they haven't thought about those settings, which means they haven't been trained. Right.

And that the Security folks haven't thought about the settings either. And then there's the. The misplaced sense that this is convenient and convenience trumps all.

And I go back and think about just how problematic in a litigation sense it can be to have recordings. And I knew that 20 years ago. Why did I know that?

I had a client that, before I represented them, had established the practice of recording audio recording all of their board meetings. They got sued. There was a discovery request, as often happens, and it was for anything that related to their board meeting.

So they had boxes of these cassette tapes of recordings, which, of course, totally analog at that time. And the only way to find out what was on them, to see if you had to produce them in litigation, was for someone physically to listen to them, which is ridiculous.

Well, guess what? We are creating transcripts with these tools that are potentially discoverable.

And so you're at least going to have to go through the effort of think about it, because lawyers now know these things exist and they're going to ask for them.

And if you have, you know, and we all know that people say things they shouldn't say on calls, but the great thing about a call is that it's not recorded.

You know, it's like, you know, pick up the phone or go down the hall, those sort of things for the difficult conversation, things you don't want to put in an email you've just said in something that's being recorded and then becomes the equivalent of it.

And so that's why people need education, that these things don't go away from that litigation standpoint. The other thing is you don't know where they go.

And depending on the nature of your system, you may have just sent that recording out to go train the AI. And if you talked about things that were subject to confidentiality restrictions or privilege, you may have blown that.

And people just haven't thought about it, they haven't, you know, and I think, you know, there's a responsibility there for management lawyers. I'm constantly making my clients aware of this when I'm on calls with them. I said, don't do this unless we agree to do it.

If we agree to do it, everybody's agreement going in, great, that's just fine. But it is another way things you need to know how the tool works. And I think because it's so easy, people don't take the time to learn how the tool works.

They just use it and they say, wow, isn't that nice? We have this transcript.

Part of that too is to make sure that if you're going to be keeping transcripts, that somebody reviews them, that you have a regular practice to go back and say, all right, we've reviewed transcripts.

Or conversely, you say, our regular practice is not to review them and we don't take them as authoritative.

They're there, but the authoritative record of a meeting is the minutes, or that if we have a recording so that we can make minutes, that our practice is to get rid of the recording after. So that the only authoritative source is something that we have vetted.

And we all agree that's what happened. Because we had another meeting today where we're talking about some of our AI tools and discussing stuff that worked right and stuff that didn't work right. Sometimes it doesn't work right. Yeah.

So if you're creating a recording that's not a true recording, but later on, because you haven't checked it, you don't even know what's on it. That's pretty scary. Yeah.

And particularly the vertical too, that you're, I mean, in the financial industry, for example, I mean, I could think of so many examples of various industries where this would be particularly sensitive conversation that you know, is being now recorded by AI transcriber.

You know, you mentioned lawyers now know that this is. They're going to ask for this kind of thing in discovery.

But are you hearing about or aware of any patterns yet of known exposure of sensitive data because of these, Is it coming up at all in any legal cases?

It is starting to come up in legal cases. It is. And it's in all the ways that you would imagine in hotly fought litigation where there are no holds barred and expense is no issue.

We see these coming up and being produced and then people have to explain away what they said in ways that they would not have had to. And so we see that happening. Hopefully that's instructive.

Hopefully me being here today is again, instructive to folks, because if you are not careful about this, you're going to have to do a lot of explaining about things that maybe not you say, but your colleague down the hall who always says the awkward thing.

And we all have them.

Yeah, now you mentioned instructive. You actually have a tip sheet that's available on the firm's site for people about AI note taker tips and things to keep in mind. But is there a red line where you advise clients to say, do not activate these?

Are there certain rules to keep in mind that folks listening might even keep in mind themselves now that we know that these are being used so much.

I mean, my default would be like so many other things to change the default so that it's off and only with intentionality is it turned on so that you don't have that.

Even though the little thing comes up and says it's recording, people get busy, they forget those things. You know, I could think of things where there are where I would not have problem doing it.

And there are things that we're used to recording when we do presentations that are either for the general public or I often do compliance presentations for clients, and oftentimes they're people who can't attend. And so we record it so that they can have that.

But I do that knowing that I'm going to be recorded and I tell everybody in the room they're going to be recorded before we record, because some of the worst, best things that I've ever seen are things that were recorded and people didn't know.

Sales meetings, for example, are notorious when they get recorded. You see behavior there because they're intended to excite people and get people motivated. So often outrageous things are said, which in context makes sense, but you can grab and take out of context.

And I've seen those used against people in civil and criminal cases because they didn't realize that they were being recorded or even if they did realize, they got lost in the moment.

So, you know, there, in terms of red lines, I think anything that is a highly sensitive internal discussion, I would think not once, not twice, but three times before I hit the record button. Sure, sure.

And I mean, we certainly know, you know, what the implications are from a legal standpoint.

But again, going back to the Security leader, the ciso, the head of Security, is there anything, is there any sort of unique vantage point that they need to have when they're thinking about this as part of their overall Security strategy now?

Well, I think hopefully as part of any. If you're any Security leader, you're involved in the rollout of the technology. And if you're rolling out technology, then you should be rolling out training. And that means to help people understand it.

But I think that's the challenge, is people will often just lock onto something that's available, or worse, that all of a sudden in the background, some functionality has been added in an upgrade that nobody really knows or understands. That's a lot harder to deal with.

But I think it's important to really work to know what these tools do. It's related to this. We talk about the concept of embedded AI that now everything that comes out new and improved with AI, what if I don't want it with AI?

What if I don't need it with AI and it doesn't really matter at this point, you're going to get it with AI and that's a real challenge. When then you have to say, okay, it's got AI with it.

Do I have to go back and look at all the terms and conditions and figure out where that data is going? What is it doing with my data? Do I still own that data? Does somebody else own the data? Are they manipulating the data?

And so that comes back to data governance disciplines and techniques and understanding that itself is a thing that your data is valuable.

In the field that I worked with, I've been telling people data is valuable for like 20 years and trying to figure out how can we control data in a legal way and make sure that we have rights to it.

Because the line is, it's not my line, but data's the new oil. Yeah.

And that's why so many of these AI tools are being added, because they are essentially going to be mining our data while they help us. And we've seen this happen to some extent with our search engines, with social media.

Who hasn't had the experience of, oh, you know, I was just looking at this thing or thinking this thing, and all of a sudden it's popping up all over your computer screen.

You know, it's happening and, you know, whether I want to, you know, buy a different kind of soap or something isn't really a big deal. But there are other things that could be a big deal. And, you know, these things last and last.

There's a record of these things we're seeing here locally. There's a very prominent murder case. What's the first thing they do?

They look at the Google searches of the defendant and say, because those things last and Most people don't think about it, but there are trails to what you do, and those trails are available to lots of different folks.

And so it's about helping people improve their understanding of what the tools do, what they can't do, what the limits are.

But I think at some point, if you're a Security professional, you also have to put some guardrails out and say, there are just some areas where we're just not going to go. And that may make you unpopular.

So you've got to have some support there because people say, oh, why can't we use this thing? It's like, well, it's for your own good. Trust me, you'll thank me someday.

It's another case of less than immediate gratification where you need the support of leadership that buy in to say, look, this is the right way to do it. This is the standard. Yeah, other people may be doing it, but they're going to pay the price for that.

Yep, yep, yep.

Yeah. And that, you know, to your point, the Google search ended up becoming a very, you know, relevant and significant part of that case.

So, yeah, I remember a few years ago seeing a joke, a meme or something that said something like, dance as if no one is looking, but email, text, and use the Internet as if you're being deposed. That's exactly it.

Right. Because, well, what's the worst can happen? Well, if they film me dancing, there's a reason we won't be dancing today, I suspect on this. But people are watching in, or machines are watching in all sorts of contexts and you have to behave accordingly.

That may be the overall lesson. And it works in both the things we've talked about. Obviously, at the museum, people were watching for the behaviors so that they could take a certain action.

You know, we are in kind of a surveillance culture at this point, and you have to behave knowing that there are very small reservoirs left where you can be private. Yeah, yeah.

Very, very little expectation of privacy left. Right.

I don't have a Faraday room yet in my house. Maybe I should get one. Maybe we should all have them somewhere we can go and just be total disconnected and not tracked. But I think that's probably unlikely for most of us.

And so you've just got to do a little more about hygiene and just. It will get there. Although I am still constantly surprised by, in some ways, how slow we are getting to those things.

I can still remember In February of 2020, just before the pandemic hit, I had a big team in one of my cases and I said, you know, we should all learn how to use Zoom.

And within a month we all went on a crash course on how to use zoom and yet we still really don't know how to use it that well.

If you've been on a zoom or teams. Oh, I'm still muted.

I'm this, these are symptoms of, well, hey, there's a lot to do with our technology and we're creatures of habit and we use one and it goes this way and we use another, it goes the other way. Here's a button to click.

Oh, I don't know where that setting is. These things take some time to master. And so it is something you've got to invest that time in or you will, down the line, pay the price. So you can do it now or you can pay for it later? Yeah.

All right, well, we are out of time. But one more question that we always ask everyone at the end is, do you have an unpopular opinion?

Whether it's about AI note makers, note takers, or the Louvre or French pastries or anything else that you see in your line of work when it comes to cybersecurity, privacy, legal challenges.

Do I have an unpopular opinion? I guess my unpopular opinion is that people need to take responsibility for what they do and what they use. And I think it's hard for people to do that. Any of us, and it starts.

Any of us who's ever had a three year old in our care knows that it's hard to get other people to take responsibility. Hopefully with grownups it's a little easier.

And I think it's something where you have to meet people part way that by and large grownups do want to take responsibility for their actions, but sometimes they don't know how to do that.

And so you've got to meet them part way, give them the tools to do it and then they will. But yeah, because nobody wants to be dealing with three year old behavior in the workplace.

So you know, we're going to hold people accountable, but you can't just say that. You've got to work with them to be accountable. So I don't know if that's all that unpopular, but.

But I try to be accountable and therefore try to make sure that other people are accountable in return.

Yeah, I'm sure it is unpopular at times though, right?

Yeah, sometimes it's unpopular with me. It's like, oh, I really have to own that because I did it. Yeah, you see stuff and like, yeah, I did do that and oops.

And then, you know, sometimes you just say, I'm sorry, and I will try to do better next time. And hopefully the result is not something as big as what were talking about. Absolutely.

All right, well, Colin Zick, thank you very much for joining us on Cyber Sessions today.

It was a pleasure.

All right, and thanks to you for watching. If you like this conversation, we want to encourage you to comment, like, subscribe. For now, I'm Joan Goodchild, and we'll see you next time.