This content was created by Robert Siciliano. This content was uploaded by Robert Siciliano. This is a YouTube video titled "Cyber Security Keynote Speaker Robert Siciliano | Keynote Speaker | Guest Speaker" (posted 2023-05-18) containing a keynote talk by Robert Siciliano on cybersecurity. The speaker frames security as an ongoing journey, cites large-scale credential theft statistics, and gives social-engineering examples (Uber SMS phishing, a gas-company phone scam, and a Mattel phishing incident that led to a $3M loss) to warn about human-targeted attacks and urge behavioral changes to reduce risk.
Chapters
There's no such thing as 100% security. And what security is, is it's a journey. It's a destination. It's not a place that we fully arrive to. Security is always being on your toes, always being aware. Security never sleeps. It's 24/7, 365. But it's not about worry. It's not about panic. There always has been, there is, and there always will be this criminal element out there. Your job is to become a tougher target. 146 billion digital records will be stolen by the end of 2023. What does all this mean? It means that your name, your address, your phone number, your account numbers, credit card numbers, bank account numbers, your usernames and your passcodes, your email addresses, your mobile phones, your Social Security numbers are in the hands of criminals. That's 21 million credentials, okay? And guess what? Those credentials are right here on my device, right? I have them. I decided to download them. I wanted to check it out. I wanted you to see it. I do a quick search to see what people are using for passcodes, and you'd be amazed at how simple human beings are, we do 1, 2, 3, 4, 5, 6, and it shows that 11,794 people out of 1.5 million are using 1 through 6 as a passcode, right? So they're making it really easy for the bad guy just to access their accounts. Everybody is a sucker. Everybody. Everybody either has been or will be suckered. And why is that? Is it because we're naive? Is it because we're gullible? Is it because we're dumb? No. It's because we're human. See, the bad guy's modus operandi is to gain your confidence, to convince you, and to convert you into believing that they are worthy of your trust. And what they do is they take the truth for as long as they can And they bend it just a little bit, and then they get you. The report said the attacker claimed to have sent a text message to an Uber employee pretending to be corporate IT, convincing the employee to share a password that allowed the hacker to access the company systems. Is that employee dumb? Is he naive? Is he stupid? What is he? What is he? Human. He's human. He's trustworthy. He's a good person. That's it. What did he want to do? What did that employee want to accomplish? What did he want to do? He wanted to what? Help. That's it. He just wanted to help. He's a good person. He just wanted to help. That's all any of us, 97% of us, want to do is just help. And that's what happens. Massive data breach. That's going to cost them potentially millions of dollars. You're an employee, a manager at a fast food restaurant. Guy says, "Yeah, this is—" and the caller ID says name of the local gas company. "This is Jack Smith from the gas company. Listen, we have reason to believe that you have a gas pipe leaking in the building. It's probably so profuse you can't even smell it right now." "Your building is about to blow up. Get out of there right now. Break all the windows. Release the gas into the atmosphere or thousands of people are gonna die. Go now." And they did. And they broke all the windows. Are they dumb? They just wanted to help, right? And that means every single time the phone rings, beware. 'Cause this isn't a prank. This is violence. CISO at Mattel. And a bad guy sets up a LinkedIn account posing as an employee of Mattel. Now, those of you who have signed up on LinkedIn, you have a LinkedIn account, as soon as you do that, who does LinkedIn suggest that you connect with? Your colleagues. All your colleagues, right? Everybody who's plug-and-play and elsewhere, right? And then from there, the bad guy connects with all the Mattel employees, gathers intelligence about the organization, finds out who's in accounts receivable, who's in accounting, who's in purchasing, who's in manufacturing, right? And then from there knows who the players are, begins to infiltrate Mattel's network, gathering all of that social intelligence, and as a result of that This is what happens. Barbie brain, a Mattel exec fell for phishing, sent $3 million to China. Is the exec dumb? They're just human. They wanted to do their job and they got roped in, they got hooked. It happens every single day. These are things that you can easily do by just little slight changes in the way you look at the world. In your behavior and how you access email when the phone rings and when you visit various websites. Don't worry about anything that I said, but definitely do something about it. Thank you so much, everybody. Appreciate you. Thank you very much.
