cybercrime is terrifying
cybercrime is nothing compared to a
cross-country road trip with kids it was
the 80s and my father decided that we
were going to take a trip across the
country this is before cellphones and
before the internet so we scheduled
everything in advance and we had a
schedule and by god we were going to
stay to that schedule well there was a
particular risk threatening that
scheduled unplanned bathroom breaks my
father had a solution a way to mitigate
that risk he taught my brother and I a
new skill set how to urinate in a Pepsi
can well by day three we had mastered
our craft we were so confident in fact
that we no longer sought parental
approval or supervision to execute
nature’s call so one such occasion I
reached forward and I picked up a Pepsi
can and there was something different
about this one
it was cold my little six year old brain
really didn’t register that fact and I
again answered nature’s call and put the
can back my chest swelling with pride
that I was contributing to end the van
swerved to the right and my father let
off a stream of curse words some of
these so good I used them today so whose
fault was that the adorable six year old
sure I didn’t DP and my father’s Pepsi
cannon but I believe that he holds some
of the responsibility as well
he had the incorrect belief about his
safety he had drank from that Pepsi can
hundreds of times before while driving
with no negative consequences he didn’t
understand that the risk landscape has
changed to us a six-year-old in the car
who could pee in a can
so well yes I did be in his can his
incorrect belief compared to the actual
threat led to unhealthy behaviors let’s
unpack that a bit belief leads to
emotion emotion leads to behavior and
behavior over time leads to habit see I
think that cyber security professionals
have a lot to learn from road trips
cyber security isn’t about computer
science it’s about behavioral science so
let’s talk about that just a little bit
we know in behavioral science that you
can modify a habit you can change
someone’s behavior but if you don’t
address the core belief that behavior
will come back so we do a lot of
training we do a lot of efforts to try
to change that modification of that
behavior but we really don’t address
those core beliefs and this will be look
general but I want to cover three core
beliefs that most of us share the first
one I’m not important and no one’s
looking for me
the second I don’t have anything anyone
would want and the third maybe most
depressing I can’t stop them I can’t
stop them don’t worry we’re going to get
through this belief number one I’m not
important and no one’s looking for me
good news all of you out there with low
self-esteem you are exactly what the
cyber criminals are looking for and if
you don’t believe me
I have data and you know that’s great
for convincing people and I know this
isn’t really going to impact anybody no
one really believes the data but I don’t
feel like it could be taken seriously
unless I prevent a graph presenta graph
so I went to the problem of collecting
this data please be polite enough to
consume it here we go 48% of us work for
small businesses for it in nine percent
of small businesses have been hacked
seventy percent of cybercrime is
directed toward small business and
seventy-five percent of employees have
skee cyber behavior and here’s the worst
part of companies that have had a
critical hack something more than just a
malware or something like that 60% of
them go out of business in under six
months this is bad news guys don’t worry
we’ll get through it like I said so how
is what’s changed what’s changed we used
to believe hackers looked like this
young man in the nerds in the basement
tinkering around with computers what’s
changed is now they have more in common
with Al Capone organized crime has
entered the picture and they have gone
through a innovation cycle with their
techniques it should make any Silicon
Valley entrepreneur impressed let’s use
imagery to explore here we see our
hacker in his natural habitat apparently
in a river it’s a metaphor guys so it’s
a skilled individual using a set of
tools to get one fish and while this
skilled individual is engaged with that
behavior the rest of the fish are safe
well with technology and automation we
can have less skilled people reach out
blindly touch every single one of us and
then look for vulnerabilities so beliefs
I’m not important that no one wants and
no one can find me – you’re super
important and thanks to automation
they’re gonna find you next belief I
don’t have anything anyone would want
and this is true if your belief is that
what people want our intellectual
property or trade secrets just something
very important data lives right well
that’s not it anymore let me tell you a
story about my friend Tom Tom owns a
business it’s a manufacturing company
it’s a products roll off his line and he
makes money uses that money to pay his
employees during the best to probably
get a boat I don’t know
but four months ago Tom got hacked one
of his employees exercised their 75%
unhealthy risky cyber behavior and
clicked on a link they showed that
malware was installed on the computers
in his network spread around until it
found the command and control center the
computer that controlled the actual line
and that was hit with ransomware the
whole hard drive was then encrypted and
the bad guys said give me 1500 Bitcoin
and we’ll unlock it for you well he had
a couple problems first Tom had no idea
what a Bitcoin was second Tom had no
idea what to do he turned out he did the
right thing he did not pay he took three
days to bring himself back up thank
goodness he had the ability to do that
but with that line being down for three
days it really disrupted his business
and I’m not in manufacturing but if you
know somebody is and you say the lines
been down for three days they have a
panicked look on their face so let’s
modify this one as well I don’t have
anything anyone want to hey I’ve got
money and they’re going to disrupt my
life until they get it and it’s not just
businesses by the way the same thing
that happened Tom can happen to laptops
personal computers etc when they find
you and they touch all these computers
they take that next step they even know
who you are they just take the next step
so third belief I can’t stop them even
if I wanted to guys I’m going to pause
for a minute and I’m going to share a
little bit this talk sucks I’m sorry
you became in here was an unhealthy
belief and I just made them worse and I
feel bad about that but I also feel like
we’ve gotten kind of close and I want to
reassure you I’m not going to leave you
in this unhealthy state so don’t walk
out on me hang on I can’t stop them even
if I wanted to turns out this isn’t the
first time the word infection has had a
high impact on our society we used to
have doctors who would cut people open
and put their hands in them and then
people would die
yeah
really hard solution right so turns out
it’s almost a straightforward to
practice good cyber hygiene let’s talk
about that so your soap and water for
cyber hygiene are having good backups
and a good cybersecurity insurance
policy
now that means pretty much nothing what
I really mean is you got to have a
systematic way of backing your data up
somewhere else where an adult
responsible human being who is not you
is keeping track that it’s happening and
when something goes wrong we’ll help you
put the data back too many people just
back it up on a jump drive or they say I
got Dropbox I’m fine no that’s not we’re
talking about the cybersecurity
insurance policy is also a little less
intuitive you’re not supposed to buy a
cybersecurity insurance policy to get
money when something goes wrong you want
to have a cybersecurity insurance policy
so that professionals can help respond
to your disaster so whatever you’re
looking for whatever you go get make
sure it’s not just here’s some money
because that’s not going to do any good
so if you got a million dollars in your
hand and you still don’t know who to
call that million dollars is doing
nothing for you so the soap and water of
cyber hygiene backups and insurance but
let’s pretend you’re germophobia kind of
person you don’t want to have it touched
it off gloves gloves that is moving your
systems and services to the cloud now
again let’s get a little granular with
that it’s not moving it to the cloud I’m
just going to put everything on a on
line drive notes moving services for
example if you’re using email which
anybody using them right if you’re using
email and you’re running an Outlook are
you running it locally that’s very bad
because anything that happens to that
machine you’re out of luck moving it to
a service like Microsoft or Google or
any of the other ones and yeah I know
that sometimes they get in the news for
being hacked but there’s still so much
better at it than you are
right but you can’t move everything to
the cloud you can’t move all this stuff
some stuff just has to live on your
local devices and that’s when you need a
surgical mask that is something very
complicated
stick with me you know those automatic
patches that Microsoft keeps trying to
do and you maybe are doing a PowerPoint
presentation for a TED and kind of
getting mad and keeps trying to reboot
your computer yeah just let it happen
see most of the things that hit us
nowadays our problems that have been
around for a very very long time the
solutions are out there we just don’t
patch our machines so get the stuff off
the local machine put it into a cloud
getting on to a service that somebody
else can manage and allow automatic
patching on your machines and there’s
one other thing that every good surgeon
has and that is a plan the National
Institute of Standards and technology’s
NIST that way you can sound cool at
dinner parties use your tax dollars in
2013 to come up with that plan for you
if you go through this framework you’ll
be able to identify your important stuff
you’ll be able to protect your important
stuff you’ll be able to detect when
someone’s messing with your important
stuff you’ll be able to respond once you
get an alert and most important you’ll
be able to recover after the horrible
event happen so you’ve got hygiene and a
plan let’s look at our beliefs one more
time you are super important and they’re
you got money and that’s why they’re
looking for you and they’re going to
screw with you until they get it but you
can drastically reduce the risk of
getting infection by practicing good
cyber hygiene and ladies and gentlemen
it’s my hope that if you do these things
and you adopt these beliefs into your
core being that you’ll be able to avoid
the horrible horrible consequences of
your behaviors thank you very much
[Applause]
[Music]
you [Music]