Cyber Crime Isn't About Computers: It's About Behavior | Adam Anderson | TEDxGreenville

Summary

In this talk, the speaker draws parallels between cybersecurity and behavioral science, using a childhood road trip story to highlight the impact of human beliefs on security practices. He debunks common misconceptions—such as feeling unimportant, having nothing of value, and being powerless against cybercriminals—and emphasizes the importance of modifying behaviors. Practical solutions like backing up data, using cybersecurity insurance, and adopting cloud services are shared, alongside a structured approach based on the NIST framework. The talk encourages individuals and businesses to adopt proactive measures to reduce cyber risks and protect against threats.

Takeaways

• 😀 Cybersecurity isn't just about technology, it's about human behavior and beliefs that influence actions.
• 😀 Our core beliefs shape our behaviors, and changing those beliefs is key to improving cybersecurity habits.
• 😀 Belief #1: 'I'm not important and no one’s looking for me' is false—small businesses and individuals are prime targets for cybercriminals.
• 😀 48% of workers are employed by small businesses, 49% of those businesses have been hacked, and 70% of cybercrime targets small businesses.
• 😀 Ransomware attacks, like the one faced by Tom, demonstrate that even small businesses are vulnerable to significant disruptions.
• 😀 Belief #2: 'I don’t have anything anyone would want' is also false—cybercriminals often target businesses to disrupt operations or demand ransom.
• 😀 Belief #3: 'I can't stop them' can be overcome with the right precautions, such as backups, cybersecurity insurance, and cloud services.
• 😀 Good cyber hygiene is like soap and water for your digital systems—regular backups and proper cybersecurity insurance are essential.
• 😀 Cloud services are a better choice for data management than keeping everything locally, as they offer superior security and reliability.
• 😀 Automatic software updates (patching) are crucial for protecting systems from known vulnerabilities and minimizing cyber risks.

Q & A

How does the speaker relate cybersecurity to a childhood experience?

The speaker uses a humorous childhood road trip story to illustrate how incorrect beliefs can lead to unexpected problems. The comparison emphasizes that cybersecurity risks, like unplanned bathroom breaks during the trip, stem from misunderstood or ignored threats.

What are the three core beliefs that make people vulnerable to cybercrime?

The three core beliefs are: 1) 'I’m not important, and no one’s looking for me', 2) 'I don’t have anything anyone would want', and 3) 'I can’t stop them.' These beliefs make individuals and businesses more susceptible to cyber attacks.

How has cybercrime evolved over time according to the speaker?

Cybercrime has evolved from being a hobbyist activity by individuals to an organized crime effort similar to that of Al Capone’s. Hackers now use advanced technology and automation to target a large number of people and businesses with fewer skills required.

Why does the speaker say that small businesses are particularly vulnerable to cybercrime?

Small businesses are particularly vulnerable because they often lack the resources and cybersecurity measures that larger businesses have. Data shows that 70% of cybercrime is directed at small businesses, and many employees exhibit risky cyber behaviors.

What happened to Tom's manufacturing company, and how does it relate to the idea that 'I don’t have anything anyone would want'?

Tom’s company was hacked when one of his employees clicked on a malicious link. This led to ransomware that encrypted his production line’s hard drive, causing major disruption. The story shows that even businesses without valuable intellectual property are still prime targets for cyber criminals.

What is the importance of practicing good cyber hygiene?

Good cyber hygiene involves practices like regular backups and using cybersecurity insurance to reduce the risk of cyber attacks. By implementing these practices, individuals and businesses can drastically decrease the likelihood of falling victim to cybercrime.

What does the speaker mean by the 'soap and water' of cyber hygiene?

The 'soap and water' of cyber hygiene refers to the essential practices of backing up data and having a cybersecurity insurance policy. These are basic but crucial steps to protecting oneself from cyber threats.

How can cloud services help in improving cybersecurity?

Cloud services help by taking critical services, like email, out of local devices and into a secure environment managed by professionals. Cloud providers often have better security measures in place than individual users can provide, reducing the risk of cyber attacks.

What does the speaker suggest about automatic software patches?

The speaker advises allowing automatic software patches to run as they are an essential part of keeping systems secure. Regularly updating systems ensures that vulnerabilities are patched before they can be exploited by cyber criminals.

What is the NIST framework, and how does it help with cybersecurity?

The NIST (National Institute of Standards and Technology) framework provides a systematic approach to cybersecurity. It helps businesses identify, protect, detect, respond to, and recover from cyber incidents, offering a comprehensive strategy for managing cybersecurity risks.