cybercrime it’s scary cybercrime is terrifying
cybercrime is terrifying
cybercrime is terrifying cybercrime is nothing compared to a
cybercrime is nothing compared to a
cybercrime is nothing compared to a cross-country road trip with kids it was
cross-country road trip with kids it was
cross-country road trip with kids it was the 80s and my father decided that we
the 80s and my father decided that we
the 80s and my father decided that we were going to take a trip across the
were going to take a trip across the
were going to take a trip across the country this is before cellphones and
country this is before cellphones and
country this is before cellphones and before the internet so we scheduled
before the internet so we scheduled
before the internet so we scheduled everything in advance and we had a
everything in advance and we had a
everything in advance and we had a schedule and by god we were going to
schedule and by god we were going to
schedule and by god we were going to stay to that schedule well there was a
stay to that schedule well there was a
stay to that schedule well there was a particular risk threatening that
particular risk threatening that
particular risk threatening that scheduled unplanned bathroom breaks my
scheduled unplanned bathroom breaks my
scheduled unplanned bathroom breaks my father had a solution a way to mitigate
father had a solution a way to mitigate
father had a solution a way to mitigate that risk he taught my brother and I a
that risk he taught my brother and I a
that risk he taught my brother and I a new skill set how to urinate in a Pepsi
new skill set how to urinate in a Pepsi
new skill set how to urinate in a Pepsi can well by day three we had mastered
can well by day three we had mastered
can well by day three we had mastered our craft we were so confident in fact
our craft we were so confident in fact
our craft we were so confident in fact that we no longer sought parental
that we no longer sought parental
that we no longer sought parental approval or supervision to execute
approval or supervision to execute
approval or supervision to execute nature’s call so one such occasion I
nature’s call so one such occasion I
nature’s call so one such occasion I reached forward and I picked up a Pepsi
reached forward and I picked up a Pepsi
reached forward and I picked up a Pepsi can and there was something different
can and there was something different
can and there was something different about this one
about this one
about this one it was cold my little six year old brain
it was cold my little six year old brain
it was cold my little six year old brain really didn’t register that fact and I
really didn’t register that fact and I
really didn’t register that fact and I again answered nature’s call and put the
again answered nature’s call and put the
again answered nature’s call and put the can back my chest swelling with pride
can back my chest swelling with pride
can back my chest swelling with pride that I was contributing to end the van
that I was contributing to end the van
that I was contributing to end the van swerved to the right and my father let
swerved to the right and my father let
swerved to the right and my father let off a stream of curse words some of
off a stream of curse words some of
off a stream of curse words some of these so good I used them today so whose
these so good I used them today so whose
these so good I used them today so whose fault was that the adorable six year old
fault was that the adorable six year old
fault was that the adorable six year old sure I didn’t DP and my father’s Pepsi
sure I didn’t DP and my father’s Pepsi
sure I didn’t DP and my father’s Pepsi cannon but I believe that he holds some
cannon but I believe that he holds some
cannon but I believe that he holds some of the responsibility as well
of the responsibility as well
of the responsibility as well he had the incorrect belief about his
he had the incorrect belief about his
he had the incorrect belief about his safety he had drank from that Pepsi can
safety he had drank from that Pepsi can
safety he had drank from that Pepsi can hundreds of times before while driving
hundreds of times before while driving
hundreds of times before while driving with no negative consequences he didn’t
with no negative consequences he didn’t
with no negative consequences he didn’t understand that the risk landscape has
understand that the risk landscape has
understand that the risk landscape has changed to us a six-year-old in the car
changed to us a six-year-old in the car
changed to us a six-year-old in the car who could pee in a can
who could pee in a can
who could pee in a can so well yes I did be in his can his
so well yes I did be in his can his
so well yes I did be in his can his incorrect belief compared to the actual
incorrect belief compared to the actual
incorrect belief compared to the actual threat led to unhealthy behaviors let’s
threat led to unhealthy behaviors let’s
threat led to unhealthy behaviors let’s unpack that a bit belief leads to
unpack that a bit belief leads to
unpack that a bit belief leads to emotion emotion leads to behavior and
emotion emotion leads to behavior and
emotion emotion leads to behavior and behavior over time leads to habit see I
behavior over time leads to habit see I
behavior over time leads to habit see I think that cyber security professionals
think that cyber security professionals
think that cyber security professionals have a lot to learn from road trips
have a lot to learn from road trips
have a lot to learn from road trips cyber security isn’t about computer
cyber security isn’t about computer
cyber security isn’t about computer science it’s about behavioral science so
science it’s about behavioral science so
science it’s about behavioral science so let’s talk about that just a little bit
let’s talk about that just a little bit
let’s talk about that just a little bit we know in behavioral science that you
we know in behavioral science that you
we know in behavioral science that you can modify a habit you can change
can modify a habit you can change
can modify a habit you can change someone’s behavior but if you don’t
someone’s behavior but if you don’t
someone’s behavior but if you don’t address the core belief that behavior
address the core belief that behavior
address the core belief that behavior will come back so we do a lot of
will come back so we do a lot of
will come back so we do a lot of training we do a lot of efforts to try
training we do a lot of efforts to try
training we do a lot of efforts to try to change that modification of that
to change that modification of that
to change that modification of that behavior but we really don’t address
behavior but we really don’t address
behavior but we really don’t address those core beliefs and this will be look
those core beliefs and this will be look
those core beliefs and this will be look general but I want to cover three core
general but I want to cover three core
general but I want to cover three core beliefs that most of us share the first
beliefs that most of us share the first
beliefs that most of us share the first one I’m not important and no one’s
one I’m not important and no one’s
one I’m not important and no one’s looking for me
looking for me
looking for me the second I don’t have anything anyone
the second I don’t have anything anyone
the second I don’t have anything anyone would want and the third maybe most
would want and the third maybe most
would want and the third maybe most depressing I can’t stop them I can’t
depressing I can’t stop them I can’t
depressing I can’t stop them I can’t stop them don’t worry we’re going to get
stop them don’t worry we’re going to get
stop them don’t worry we’re going to get through this belief number one I’m not
through this belief number one I’m not
through this belief number one I’m not important and no one’s looking for me
important and no one’s looking for me
important and no one’s looking for me good news all of you out there with low
good news all of you out there with low
good news all of you out there with low self-esteem you are exactly what the
self-esteem you are exactly what the
self-esteem you are exactly what the cyber criminals are looking for and if
cyber criminals are looking for and if
cyber criminals are looking for and if you don’t believe me
you don’t believe me
you don’t believe me I have data and you know that’s great
I have data and you know that’s great
I have data and you know that’s great for convincing people and I know this
for convincing people and I know this
for convincing people and I know this isn’t really going to impact anybody no
isn’t really going to impact anybody no
isn’t really going to impact anybody no one really believes the data but I don’t
one really believes the data but I don’t
one really believes the data but I don’t feel like it could be taken seriously
feel like it could be taken seriously
feel like it could be taken seriously unless I prevent a graph presenta graph
unless I prevent a graph presenta graph
unless I prevent a graph presenta graph so I went to the problem of collecting
so I went to the problem of collecting
so I went to the problem of collecting this data please be polite enough to
this data please be polite enough to
this data please be polite enough to consume it here we go 48% of us work for
consume it here we go 48% of us work for
consume it here we go 48% of us work for small businesses for it in nine percent
small businesses for it in nine percent
small businesses for it in nine percent of small businesses have been hacked
of small businesses have been hacked
of small businesses have been hacked seventy percent of cybercrime is
seventy percent of cybercrime is
seventy percent of cybercrime is directed toward small business and
directed toward small business and
directed toward small business and seventy-five percent of employees have
seventy-five percent of employees have
seventy-five percent of employees have skee cyber behavior and here’s the worst
skee cyber behavior and here’s the worst
skee cyber behavior and here’s the worst part of companies that have had a
part of companies that have had a
part of companies that have had a critical hack something more than just a
critical hack something more than just a
critical hack something more than just a malware or something like that 60% of
malware or something like that 60% of
malware or something like that 60% of them go out of business in under six
them go out of business in under six
them go out of business in under six months this is bad news guys don’t worry
months this is bad news guys don’t worry
months this is bad news guys don’t worry we’ll get through it like I said so how
we’ll get through it like I said so how
we’ll get through it like I said so how is what’s changed what’s changed we used
is what’s changed what’s changed we used
is what’s changed what’s changed we used to believe hackers looked like this
to believe hackers looked like this
to believe hackers looked like this young man in the nerds in the basement
young man in the nerds in the basement
young man in the nerds in the basement tinkering around with computers what’s
tinkering around with computers what’s
tinkering around with computers what’s changed is now they have more in common
changed is now they have more in common
changed is now they have more in common with Al Capone organized crime has
with Al Capone organized crime has
with Al Capone organized crime has entered the picture and they have gone
entered the picture and they have gone
entered the picture and they have gone through a innovation cycle with their
through a innovation cycle with their
through a innovation cycle with their techniques it should make any Silicon
techniques it should make any Silicon
techniques it should make any Silicon Valley entrepreneur impressed let’s use
Valley entrepreneur impressed let’s use
Valley entrepreneur impressed let’s use imagery to explore here we see our
imagery to explore here we see our
imagery to explore here we see our hacker in his natural habitat apparently
hacker in his natural habitat apparently
hacker in his natural habitat apparently in a river it’s a metaphor guys so it’s
in a river it’s a metaphor guys so it’s
in a river it’s a metaphor guys so it’s a skilled individual using a set of
a skilled individual using a set of
a skilled individual using a set of tools to get one fish and while this
tools to get one fish and while this
tools to get one fish and while this skilled individual is engaged with that
skilled individual is engaged with that
skilled individual is engaged with that behavior the rest of the fish are safe
behavior the rest of the fish are safe
behavior the rest of the fish are safe well with technology and automation we
well with technology and automation we
well with technology and automation we can have less skilled people reach out
can have less skilled people reach out
can have less skilled people reach out blindly touch every single one of us and
blindly touch every single one of us and
blindly touch every single one of us and then look for vulnerabilities so beliefs
then look for vulnerabilities so beliefs
then look for vulnerabilities so beliefs I’m not important that no one wants and
I’m not important that no one wants and
I’m not important that no one wants and no one can find me – you’re super
no one can find me – you’re super
no one can find me – you’re super important and thanks to automation
important and thanks to automation
important and thanks to automation they’re gonna find you next belief I
they’re gonna find you next belief I
they’re gonna find you next belief I don’t have anything anyone would want
don’t have anything anyone would want
don’t have anything anyone would want and this is true if your belief is that
and this is true if your belief is that
and this is true if your belief is that what people want our intellectual
what people want our intellectual
what people want our intellectual property or trade secrets just something
property or trade secrets just something
property or trade secrets just something very important data lives right well
very important data lives right well
very important data lives right well that’s not it anymore let me tell you a
that’s not it anymore let me tell you a
that’s not it anymore let me tell you a story about my friend Tom Tom owns a
story about my friend Tom Tom owns a
story about my friend Tom Tom owns a business it’s a manufacturing company
business it’s a manufacturing company
business it’s a manufacturing company it’s a products roll off his line and he
it’s a products roll off his line and he
it’s a products roll off his line and he makes money uses that money to pay his
makes money uses that money to pay his
makes money uses that money to pay his employees during the best to probably
employees during the best to probably
employees during the best to probably get a boat I don’t know
get a boat I don’t know
get a boat I don’t know but four months ago Tom got hacked one
but four months ago Tom got hacked one
but four months ago Tom got hacked one of his employees exercised their 75%
of his employees exercised their 75%
of his employees exercised their 75% unhealthy risky cyber behavior and
unhealthy risky cyber behavior and
unhealthy risky cyber behavior and clicked on a link they showed that
clicked on a link they showed that
clicked on a link they showed that malware was installed on the computers
malware was installed on the computers
malware was installed on the computers in his network spread around until it
in his network spread around until it
in his network spread around until it found the command and control center the
found the command and control center the
found the command and control center the computer that controlled the actual line
computer that controlled the actual line
computer that controlled the actual line and that was hit with ransomware the
and that was hit with ransomware the
and that was hit with ransomware the whole hard drive was then encrypted and
whole hard drive was then encrypted and
whole hard drive was then encrypted and the bad guys said give me 1500 Bitcoin
the bad guys said give me 1500 Bitcoin
the bad guys said give me 1500 Bitcoin and we’ll unlock it for you well he had
and we’ll unlock it for you well he had
and we’ll unlock it for you well he had a couple problems first Tom had no idea
a couple problems first Tom had no idea
a couple problems first Tom had no idea what a Bitcoin was second Tom had no
what a Bitcoin was second Tom had no
what a Bitcoin was second Tom had no idea what to do he turned out he did the
idea what to do he turned out he did the
idea what to do he turned out he did the right thing he did not pay he took three
right thing he did not pay he took three
right thing he did not pay he took three days to bring himself back up thank
days to bring himself back up thank
days to bring himself back up thank goodness he had the ability to do that
goodness he had the ability to do that
goodness he had the ability to do that but with that line being down for three
but with that line being down for three
but with that line being down for three days it really disrupted his business
days it really disrupted his business
days it really disrupted his business and I’m not in manufacturing but if you
and I’m not in manufacturing but if you
and I’m not in manufacturing but if you know somebody is and you say the lines
know somebody is and you say the lines
know somebody is and you say the lines been down for three days they have a
been down for three days they have a
been down for three days they have a panicked look on their face so let’s
panicked look on their face so let’s
panicked look on their face so let’s modify this one as well I don’t have
modify this one as well I don’t have
modify this one as well I don’t have anything anyone want to hey I’ve got
anything anyone want to hey I’ve got
anything anyone want to hey I’ve got money and they’re going to disrupt my
money and they’re going to disrupt my
money and they’re going to disrupt my life until they get it and it’s not just
life until they get it and it’s not just
life until they get it and it’s not just businesses by the way the same thing
businesses by the way the same thing
businesses by the way the same thing that happened Tom can happen to laptops
that happened Tom can happen to laptops
that happened Tom can happen to laptops personal computers etc when they find
personal computers etc when they find
personal computers etc when they find you and they touch all these computers
you and they touch all these computers
you and they touch all these computers they take that next step they even know
they take that next step they even know
they take that next step they even know who you are they just take the next step
who you are they just take the next step
who you are they just take the next step so third belief I can’t stop them even
so third belief I can’t stop them even
so third belief I can’t stop them even if I wanted to guys I’m going to pause
if I wanted to guys I’m going to pause
if I wanted to guys I’m going to pause for a minute and I’m going to share a
for a minute and I’m going to share a
for a minute and I’m going to share a little bit this talk sucks I’m sorry
little bit this talk sucks I’m sorry
little bit this talk sucks I’m sorry you became in here was an unhealthy
you became in here was an unhealthy
you became in here was an unhealthy belief and I just made them worse and I
belief and I just made them worse and I
belief and I just made them worse and I feel bad about that but I also feel like
feel bad about that but I also feel like
feel bad about that but I also feel like we’ve gotten kind of close and I want to
we’ve gotten kind of close and I want to
we’ve gotten kind of close and I want to reassure you I’m not going to leave you
reassure you I’m not going to leave you
reassure you I’m not going to leave you in this unhealthy state so don’t walk
in this unhealthy state so don’t walk
in this unhealthy state so don’t walk out on me hang on I can’t stop them even
out on me hang on I can’t stop them even
out on me hang on I can’t stop them even if I wanted to turns out this isn’t the
if I wanted to turns out this isn’t the
if I wanted to turns out this isn’t the first time the word infection has had a
first time the word infection has had a
first time the word infection has had a high impact on our society we used to
high impact on our society we used to
high impact on our society we used to have doctors who would cut people open
have doctors who would cut people open
have doctors who would cut people open and put their hands in them and then
and put their hands in them and then
and put their hands in them and then people would die
people would die
people would die yeah
yeah
yeah really hard solution right so turns out
really hard solution right so turns out
really hard solution right so turns out it’s almost a straightforward to
it’s almost a straightforward to
it’s almost a straightforward to practice good cyber hygiene let’s talk
practice good cyber hygiene let’s talk
practice good cyber hygiene let’s talk about that so your soap and water for
about that so your soap and water for
about that so your soap and water for cyber hygiene are having good backups
cyber hygiene are having good backups
cyber hygiene are having good backups and a good cybersecurity insurance
and a good cybersecurity insurance
and a good cybersecurity insurance policy
policy
policy now that means pretty much nothing what
now that means pretty much nothing what
now that means pretty much nothing what I really mean is you got to have a
I really mean is you got to have a
I really mean is you got to have a systematic way of backing your data up
systematic way of backing your data up
systematic way of backing your data up somewhere else where an adult
somewhere else where an adult
somewhere else where an adult responsible human being who is not you
responsible human being who is not you
responsible human being who is not you is keeping track that it’s happening and
is keeping track that it’s happening and
is keeping track that it’s happening and when something goes wrong we’ll help you
when something goes wrong we’ll help you
when something goes wrong we’ll help you put the data back too many people just
put the data back too many people just
put the data back too many people just back it up on a jump drive or they say I
back it up on a jump drive or they say I
back it up on a jump drive or they say I got Dropbox I’m fine no that’s not we’re
got Dropbox I’m fine no that’s not we’re
got Dropbox I’m fine no that’s not we’re talking about the cybersecurity
talking about the cybersecurity
talking about the cybersecurity insurance policy is also a little less
insurance policy is also a little less
insurance policy is also a little less intuitive you’re not supposed to buy a
intuitive you’re not supposed to buy a
intuitive you’re not supposed to buy a cybersecurity insurance policy to get
cybersecurity insurance policy to get
cybersecurity insurance policy to get money when something goes wrong you want
money when something goes wrong you want
money when something goes wrong you want to have a cybersecurity insurance policy
to have a cybersecurity insurance policy
to have a cybersecurity insurance policy so that professionals can help respond
so that professionals can help respond
so that professionals can help respond to your disaster so whatever you’re
to your disaster so whatever you’re
to your disaster so whatever you’re looking for whatever you go get make
looking for whatever you go get make
looking for whatever you go get make sure it’s not just here’s some money
sure it’s not just here’s some money
sure it’s not just here’s some money because that’s not going to do any good
because that’s not going to do any good
because that’s not going to do any good so if you got a million dollars in your
so if you got a million dollars in your
so if you got a million dollars in your hand and you still don’t know who to
hand and you still don’t know who to
hand and you still don’t know who to call that million dollars is doing
call that million dollars is doing
call that million dollars is doing nothing for you so the soap and water of
nothing for you so the soap and water of
nothing for you so the soap and water of cyber hygiene backups and insurance but
cyber hygiene backups and insurance but
cyber hygiene backups and insurance but let’s pretend you’re germophobia kind of
let’s pretend you’re germophobia kind of
let’s pretend you’re germophobia kind of person you don’t want to have it touched
person you don’t want to have it touched
person you don’t want to have it touched it off gloves gloves that is moving your
it off gloves gloves that is moving your
it off gloves gloves that is moving your systems and services to the cloud now
systems and services to the cloud now
systems and services to the cloud now again let’s get a little granular with
again let’s get a little granular with
again let’s get a little granular with that it’s not moving it to the cloud I’m
that it’s not moving it to the cloud I’m
that it’s not moving it to the cloud I’m just going to put everything on a on
just going to put everything on a on
just going to put everything on a on line drive notes moving services for
line drive notes moving services for
line drive notes moving services for example if you’re using email which
example if you’re using email which
example if you’re using email which anybody using them right if you’re using
anybody using them right if you’re using
anybody using them right if you’re using email and you’re running an Outlook are
email and you’re running an Outlook are
email and you’re running an Outlook are you running it locally that’s very bad
you running it locally that’s very bad
you running it locally that’s very bad because anything that happens to that
because anything that happens to that
because anything that happens to that machine you’re out of luck moving it to
machine you’re out of luck moving it to
machine you’re out of luck moving it to a service like Microsoft or Google or
a service like Microsoft or Google or
a service like Microsoft or Google or any of the other ones and yeah I know
any of the other ones and yeah I know
any of the other ones and yeah I know that sometimes they get in the news for
that sometimes they get in the news for
that sometimes they get in the news for being hacked but there’s still so much
being hacked but there’s still so much
being hacked but there’s still so much better at it than you are
better at it than you are
better at it than you are right but you can’t move everything to
right but you can’t move everything to
right but you can’t move everything to the cloud you can’t move all this stuff
the cloud you can’t move all this stuff
the cloud you can’t move all this stuff some stuff just has to live on your
some stuff just has to live on your
some stuff just has to live on your local devices and that’s when you need a
local devices and that’s when you need a
local devices and that’s when you need a surgical mask that is something very
surgical mask that is something very
surgical mask that is something very complicated
complicated
complicated stick with me you know those automatic
stick with me you know those automatic
stick with me you know those automatic patches that Microsoft keeps trying to
patches that Microsoft keeps trying to
patches that Microsoft keeps trying to do and you maybe are doing a PowerPoint
do and you maybe are doing a PowerPoint
do and you maybe are doing a PowerPoint presentation for a TED and kind of
presentation for a TED and kind of
presentation for a TED and kind of getting mad and keeps trying to reboot
getting mad and keeps trying to reboot
getting mad and keeps trying to reboot your computer yeah just let it happen
your computer yeah just let it happen
your computer yeah just let it happen see most of the things that hit us
see most of the things that hit us
see most of the things that hit us nowadays our problems that have been
nowadays our problems that have been
nowadays our problems that have been around for a very very long time the
around for a very very long time the
around for a very very long time the solutions are out there we just don’t
solutions are out there we just don’t
solutions are out there we just don’t patch our machines so get the stuff off
patch our machines so get the stuff off
patch our machines so get the stuff off the local machine put it into a cloud
the local machine put it into a cloud
the local machine put it into a cloud getting on to a service that somebody
getting on to a service that somebody
getting on to a service that somebody else can manage and allow automatic
else can manage and allow automatic
else can manage and allow automatic patching on your machines and there’s
patching on your machines and there’s
patching on your machines and there’s one other thing that every good surgeon
one other thing that every good surgeon
one other thing that every good surgeon has and that is a plan the National
has and that is a plan the National
has and that is a plan the National Institute of Standards and technology’s
Institute of Standards and technology’s
Institute of Standards and technology’s NIST that way you can sound cool at
NIST that way you can sound cool at
NIST that way you can sound cool at dinner parties use your tax dollars in
dinner parties use your tax dollars in
dinner parties use your tax dollars in 2013 to come up with that plan for you
2013 to come up with that plan for you
2013 to come up with that plan for you if you go through this framework you’ll
if you go through this framework you’ll
if you go through this framework you’ll be able to identify your important stuff
be able to identify your important stuff
be able to identify your important stuff you’ll be able to protect your important
you’ll be able to protect your important
you’ll be able to protect your important stuff you’ll be able to detect when
stuff you’ll be able to detect when
stuff you’ll be able to detect when someone’s messing with your important
someone’s messing with your important
someone’s messing with your important stuff you’ll be able to respond once you
stuff you’ll be able to respond once you
stuff you’ll be able to respond once you get an alert and most important you’ll
get an alert and most important you’ll
get an alert and most important you’ll be able to recover after the horrible
be able to recover after the horrible
be able to recover after the horrible event happen so you’ve got hygiene and a
event happen so you’ve got hygiene and a
event happen so you’ve got hygiene and a plan let’s look at our beliefs one more
plan let’s look at our beliefs one more
plan let’s look at our beliefs one more time you are super important and they’re
time you are super important and they’re
time you are super important and they’re going to find you
you got money and that’s why they’re
you got money and that’s why they’re looking for you and they’re going to
looking for you and they’re going to
looking for you and they’re going to screw with you until they get it but you
screw with you until they get it but you
screw with you until they get it but you can drastically reduce the risk of
can drastically reduce the risk of
can drastically reduce the risk of getting infection by practicing good
getting infection by practicing good
getting infection by practicing good cyber hygiene and ladies and gentlemen
cyber hygiene and ladies and gentlemen
cyber hygiene and ladies and gentlemen it’s my hope that if you do these things
it’s my hope that if you do these things
it’s my hope that if you do these things and you adopt these beliefs into your
and you adopt these beliefs into your
and you adopt these beliefs into your core being that you’ll be able to avoid
core being that you’ll be able to avoid
core being that you’ll be able to avoid the horrible horrible consequences of
the horrible horrible consequences of
the horrible horrible consequences of your behaviors thank you very much
your behaviors thank you very much
your behaviors thank you very much [Applause]
[Applause]
[Applause] [Music]
[Music]
[Music] you
you
you [Music]
”
Be First to Comment