How sharing cybercrisis stories can save us all | Marc Vael | TEDxUHasselt

Key Concepts

Cyber crisis, digital sledgehammer, data breaches, cyber criminals, vulnerabilities, incident response, lessons learned, human firewall, cyber security leadership, fading effect bias, story sharing, collaboration, awareness, incident response.

Cyber Crisis and Digital Sledgehammer Moments

• The speaker opens with a personal anecdote about a friend's daughter losing a decade's worth of digital memories due to accidental deletion, illustrating the devastating impact of data loss – a "digital sledgehammer moment."
• Cyber criminals are motivated by data and money, operating invisibly and causing disruptions like blocking research, payments, and even hacking vehicles and bicycles.
• The speaker emphasizes that cyber crises aren't solely due to external attacks; internal issues like application bugs and vulnerabilities also play a significant role.
• Example: A small update in the Crowd Strike security tool in July 2024 caused the blue screen of death and $10 billion in damages worldwide.
• The speaker highlights the reality of poorly managed data centers, showing examples of neglected IT infrastructure.
• Maitra, a nonprofit organization, has identified 359 ways to attack systems but only 230 defense techniques.
• Global cybercrime costs are estimated to increase significantly from 2018 to 2029, indicating a growing threat.

Incident Response Methodology

• The speaker outlines a four-step process for handling cyber crises, based on personal experience:
  1. Detecting and Analyzing: Understanding what happened, who found it, and potential solutions.
  2. Responding: Implementing solutions to mitigate the crisis, such as rebooting systems or shutting down networks.
  3. Resolution: Aiming to restore the system to a state as if the crisis never occurred.
  4. Lessons Learned: Identifying what worked well and what can be improved for future incidents.
• The speaker emphasizes the importance of the "lessons learned" phase, which is often neglected due to time constraints or a desire to move on.
• Finding the root cause is key to preventing future incidents.

The Human Element in Cyber Security

• The speaker argues against the notion that users are the weakest link, instead positioning them as the "strongest link" – the "human firewall."
• This relies on providing adequate training, regular awareness programs, and accessible channels for reporting suspicious activity.
• Once data is compromised, it's nearly impossible to fully recover it, comparing it to putting toothpaste back in a tube.

The Evolving Role of the Cyber Security Leader

• The role of a cyber security leader has evolved from a purely technical one to encompass processes, people, and strategy.
• The speaker likens a cyber security professional to a butler, working invisibly to ensure everything runs smoothly and having backup plans in case of emergencies.
• The analogy to the insurance business is drawn, highlighting the importance of proactive protection and the value of having security measures in place when things go wrong.

The Fading Effect Bias and the Importance of Story Sharing

• The speaker introduces the "fading effect bias," a psychological phenomenon where people tend to forget negative memories and focus on positive ones.
• This bias, combined with a lack of documented lessons learned, creates a gap in the collective knowledge of cyber crises.
• Quote: "All those moments will be lost in time, like tears in rain" (referencing Blade Runner), highlighting the loss of valuable learning opportunities.
• Executives often avoid sharing cyber crisis stories due to fear of reputational damage, legal consequences, and customer impact.
• Legal and regulatory restrictions also hinder the sharing of information.

The Solution: A Neutral Platform for Sharing Cyber Crisis Stories

• The speaker proposes a neutral platform where vetted cyber security leaders can share their experiences securely and in real-time.
• The platform should operate under the Chatham House Rule to encourage open discussion without attribution.
• The speaker shares that they participate in a Signal group with 585 European cyber security leaders who share cyber crisis stories.

Three Reasons to Share Cyber Crisis Stories

1. Improve Response: Faster sharing of information enables quicker mitigation and prevention of attacks.
2. Awareness as Intelligence: Learning from others' experiences strengthens defenses and prevents falling for the same errors.
3. Strengthen Solidarity, Collaboration, and Trust: Providing emotional support and practical advice to fellow leaders facing cyber crises.

Synthesis/Conclusion

The speaker argues that sharing cyber crisis stories is crucial for improving cyber security practices. By overcoming the fading effect bias and creating a safe, neutral platform for sharing experiences, cyber security leaders can learn from each other, improve incident response, raise awareness, and foster a stronger sense of community. This collaborative approach is essential for protecting against future "digital sledgehammer moments."