Sign New York Banking Job Description Template Secure

Industry sign banking new york job description template secure

[Music] hi everyone my name is victoria granova and i'm very excited to present something to you that i'm very very passionate about and that is cyber security through the eyes of psychology thank you so much to the techno conference for having me here this is so exciting and i'm looking forward to the rest of the presentations as well so i'll jump right in the field of psychology is several hundred years old whereas cyber security is several decades old and evolving every day so the one constant that we are dealing with out there in the world is that human factor people haven't changed very much in the past thousand years and what will help us go through the world in the real world is understanding people so we've been discussing the human factor in cyber security for quite some time but rarely in the in terms of psychology or in terms of scientific studies or research so what i'm bringing today is just a few concepts that i want to introduce it's a bit of a primary tiny little psychology presentation uh so i'm going to talk about some concepts in psychology that we can apply in our cybersecurity lives but before i begin of course there's a mandatory disclaimer as always i represent only myself and my own views uh not those views of my employers or any organizations that i'm affiliated with and of course i'm coming here with my own knowledge my own or whatever knowledge that i have from my own perspective as a student of psychology i'm by no means an expert and this is not a consulting presentation by any means so before we jump in um i will present a little bit about my background i'm currently a senior information security consultant at a big fight bank here in toronto canada and i'm also in my not my day job i'm also president of the iec square toronto chapter ic squared is the global organization that administers cybersecurity certifications such as the cissp and the ccsb if you've heard of those and the chapter is based in toronto and what we do is we do events for the community and we offer professional education opportunities and most importantly networking i love love love networking and of course that is one of the best value that we bring to this community here in the greater toronto area i'm also the founder of the cyber toronto conference this is an annual virtual conference that began last year and it is a it's a community-based conference on a part-time basis i'm also an instructor at york university in the certificate in cyber security so when i first started in my career or my educational background i started in the business world and from the get-go i was interested in how humans interact with one another so for those familiar with business courses organizational behavior was the subject that i loved the most um and then when i started learning about cyber security again gravitated towards that human element and uh in uh so first when i took a certificate in cyber security got my cissp then i switched my focus to learn more about psychology because that's an area i did not have a background in even though i had so much passion and interest in seeing how those two worlds may collide let me just get my slides here technical difficulties over here all right so there's an unending battle that we're facing in staying in front of technology as it changes and advances and to further protect our systems as technology and infrastructure continues to advance and while technology advances so do different types of attacks but the one constant again in all of this change regardless of the technology is people the human element so even though there seems to be new attacks based on new technology on almost basically an hourly or mid by minute basis uh the one constant that attackers are leveraging is social engineering uh so leveraging the human factor to get into a system so what i'm talking about today is definitely be focusing on social engineering especially through the eyes of psychology principles because those principles will stay constant throughout the technology change and understanding that may help us get better at defending ourselves as practitioners so what is social engineering it is the art of human hacking and this is where i'm actually quoting a title of a book by christopher hadniggy um i so human hacking so leveraging human weaknesses to get in what the attacker wants be it personal information or access to a corporate system according to 2020 verizon data breach investigations report phishing remains the top threat actor in breaches and financially motivated phishing and social engineering continues to increase year over year so it's a massive problem as we can see uh in addition in the 2019 report um it was found that the social element continues to be the top action in the beginning and the middle of incidents so this shows that that this is a significant factor in getting in and staying in a system in an incident situation so definitely a massive problem that we're facing in cyber security and what i found is as i was looking into this topic more deeply i found that it was largely unresearched at this moment in time at least in in the academic field or in the field of academia lots of opportunities here to dive deeper into specific topics and finding uh specific research to understand the best practices that we have in cyber security including the field of security awareness training so as an industry we often talk about the human factor as the weakest link so we often say if only we could remove the user from the system we would have a much more secure system would actually have a chance at making it secure but the one thing i wanted to point out before we go any further is that when we're talking about that human factor we really are talking about ourselves and well it's really time to dispel the negativity and blame that surrounds the the human factor and human weakness and we seek to understand it instead and understand ourselves and this could help us um build more a build more effective systems and and training so let's start at the very beginning what is psychology so not to worry for this presentation it's a very high level primer and definitely you don't need a psychology background to uh to continue with me i will definitely relay the concepts back to cyber security so the focus today i'm really focusing on the behavior part of this uh definition so psychology being the scientific study of the mind brain and behavior but behavior is something very very interesting um so what why we do what we do what i'm not going to be focusing on today is why attackers attack because potatoes are going to potate and that's not a irrelevant to this particular presentation at least i'm focusing today on us as defenders and why do we do what we do when we're trying to defend ourselves so as you can imagine the field of psychology being as old as it is and is extremely extremely broad there's so many areas of study aid and i just listed a few of these just just for demonstration purposes it's uh definitely an exhaustive list but what i'm going to leverage today is some principles from cognitive psychology so cognitive psychology is that study of information processing and behavior so when i first started studying the in in the certificate of psychology at ryerson university i was first and foremost interested in how we process information and how it influences the way that we may react so if you think about the way that you react to someone throwing a ball at your head that's a very different way of reacting to uh when compared to you sitting down and trying to solve a very complex math problem so those those differences were very very interesting to me and uh neatly enough very coincidentally there's a a great theory and one of my favorite theories is this dual systems theory uh it says that there's two systems of information processing um so the first one is system one self-explanatory so system one this is system two but system one is uh is is instinct basically it's a quick and uh low effort way of processing information so for example you see a snake you run um but then on the other hand the system two which is slower it's very deliberate it's higher effort and it's it's like playing chess so you when you sit down you you play through the various options in your head first you consider your options and the consequences of those options before you take take a particular action so bringing it back to cyber security for just one moment attackers really want us to be reactionary to engage system one so to see their prompt and react so click that phishing link or give out your password or say now your access will be suspended forever you know or some other kind of threat that you may see in a phishing email or or even here in a voice phishing calls or vision call um so when you so we're in current so what we want to be doing when we encounter social engineering attacks is you want to be engaged in system two so unfortunately that is quite it's a lot more difficult uh by definition it's higher efforts the higher effort way of thinking uh and actually it's uh it's thought to have evolved later in humans than system one um and that's where those more complex processing takes place so for example abstract thinking um it's believed to be a sequential type of thinking and uses a lot of working memory so or other uses working memory uh it says very so so definitely as defenders or as potential victims of social engineering attacks we want to try and interrupt our tendency or our wish to use system one and react fast and instinctively and which is more easy comes more easily to us as humans system two not so much but that's the system we want to be engaged we want to take that pause before we react so i'm talking about all these challenges on on how to uh react to certain prompts or attacks and as we as we can tell it's very difficult to react in a reasonable manner and to have uh to do the correct thing when we're prompted with with a decision point and if it if that's not enough of a complication there's even more challenges to that thinking or that cognitive process so it's just listing some for demonstration purposes for example of course if you have incomplete or incorrect knowledge you're more likely to make an incorrect decision if you are multitasking if you're thinking about some of us are working from home right now in this pandemic situation if you are say working on a urgent report and then you're trying to respond to a co-worker who's chatting with you on the side and then uh and someone at home is asking you know asking you questions about something that's unrelated and then at that moment you receive a phishing email that's that is very difficult to react to uh and respond to in a reasonable manner or to pause and critically assess that email to see if it's legitimate or not if you have none of these distractions it's a lot more simpler to just focus focus on the task at hand and evaluating whether this email is legitimate or not if you should be clicking that link or not or changing um changing your your password or anything like that that's a it's a whole um it's a lot more difficult when you're multitasking but uh no again one of the things that is one of my favorite concepts is hear six and biases and uh heuristics they're basically mental shortcuts that we take based on our past experience instead of using the facts of our current situation to make decisions and that this heuristics are fabulous they you know they can keep us safe if it's a lot instead of assessing each situation as it comes and trying to figure out new ways of reacting or rethinking your decision making you can react a lot quicker so if say there's a bear attacking you uh you don't need to uh evaluate what kind of barrier that is in that moment no you just you just run or you just fight that is a based on your past experience so heuristics can be extremely uh wonderful and useful and they've helped us survive across the millennia but there is as you know uh there's a there's a flip side to it we can be very much hurt by heuristics and biases and to demonstrate just a few of these so here in the in the blue light blue column on the left i'm listing a couple of heuristics in there um but instead of naming the definitions and going through it that way i want to talk to talk through a bit of a fictional scenario or a story that that can help demonstrate how these heuristics work so say now you work in accounts payable okay so a someone claiming to be a vendor so a vendor calls you and they introduce themselves as joe from your third-party it provider so your mind goes ah the vendor i will now treat uh this person as i would treat any other vendor or any other person in the vendor category i'm going to treat them as a trusted party and this is where that says categorization is the representativeness heuristic so we go go through the story and we say okay so joe starts talking to you on the phone talking to you about the current lockdown situation imagining we're all in in ontario in canada where there's a stay-at-home order as well on top of that um so joe's talking to you about okay how's difficult it's affecting the his business and how difficult it is to work from home while trying to homeschool the kids you know lockdown and kobed this these pieces of information are very much top of mind for us here in canada and across the world for sure and so we believe uh so in the scenario scenario you are believing this statement you're believing that um he's coming from a genuine place because he's mentioning things that are top of mind for you so the availability heuristic actually gives more weight to the pieces of information that are more top of mind they've been in the news and you've been exposed to that piece of information and it sounds more legitimate and more or more trustworthy so joe keeps talking he's very friendly he's openly sharing his daily struggles and concerns and you're sympathizing with each other about the diff difficult situation that you're both facing here so at this moment before continuing um this conversation as an employee you should be asking yourself uh do i trust this person do i trust joe but that's a very very difficult question to answer because it requires a lot of different components and considerations you should be thinking through that requires a lot of system to processing and it's what instead the mind does it swaps that do i trust question for something that is a lot more easy to answer so the question of do i like this person so you're swapping out do i trust him for do i like him and that's an easy question to answer because you know joe's being extremely friendly you've been sympathizing with each other and why yes yes you do like this person and therefore you're also answering the question of do i trust this person the same way so uh and that's that's a very dangerous situation that that uh it puts you in so joe continues and he shares with you that with the current chaos uh he'd completely forgotten to ask his team to update their payment information with your company so that payment information happens to be important because uh otherwise they'll miss the next payment and then there's a whole it's gonna cause a lot of chaos basically so in this statement there are two pieces of information so one the lockdown case of chaos has uh caused him to forget an important step and he is now in distress uh the second portion of that statement is that he needs to update the payment information with you so that the company's payment goes through to them so here's where confirmation bias kicks in you your mind will go and ignore the piece of information that is less plausible and will give more weight to the piece of information that is more plausible so essentially because you believe part of that sentiment uh you end up believing the entire or at least you're giving legitimacy to this entire uh entirety of his statement just because one piece of it appears to be plausible and legitimate so normally in your company's process uh you'd need to get manager sign off to do this over the phone or there's additional controls that kick into place but your team does deal with this third-party it provider very often and you have a grea relationship that you'd like to maintain so because you're persevering in your belief so believe perseverance heuristic right here um because you're persevering in your belief that this is a trusted party he's joe's a nice guy he's a trusted person so what you go ahead and do you go and make the change you you make the change in the payment information and you kind of make a mental mental note to go back to check with the manager to make sure that this is all aboveboard all that so joe says you know thank you so so very much and he hangs up and as the days go on that mental note that you made kind of disappears off off your mind off your radar and several days later a sizable invoice amount is deposited into a wrong account so the caller joe was in fact an attacker and funds have been rerouted to that attacker's account so this seems like a bit of a bleak scenario and we might be uh thinking about how if there's any possibility at all to eliminate or permanently eliminate these heuristics and biases so that we're not subject to them and unfortunately that that's not the case we are we are humans even if we are aware of these heuristics and biases we are still going to be subject to them so what we can try and do is try and turn these heuristics to stop them working from against us and have them work for us instead so i'll go through what we so we can start with the first heuristics so representativeness that's the categorization heuristic where you categorize joe as a in the vendor category which is a trusted caregiver therefore he would like to help anyone who falls into that category um but how can we combat this particular heuristic so the answer is we ensure this is a proposed answer is that we ensure that all the trusted categories have specific procedures that are attached to those categories and they're required to be followed every single time that there's an interaction with this vendor so basically build policies and procedures that for trusted parties um which would force the the t you and your teammates to question uh to ask predetermined questions every time that uh that a person who claims to be in that category um you know calls or emails so um for example instead of so in this case particular case instead of thinking oh um you know joe equals vendor equals trusted party therefore do whatever you can to help them out um then you would you would associate uh joe or anyone in the vendor category with question list number xyz and those predetermined questions will also help with the rest of the heritage mentioned here so through predetermined procedures and training of course it will remove that load from the from the mind so the mind no longer needs to create its own questions and and spend that extra effort to try and validate the identity of the caller and and validate all the information that is given this true and you know and you know spend that extra effort to look out and question unusual requests of information that that could be uh folded into that procedure so um so there's some hope basically and i'm almost almost done with this essentially the it really comes down to having mindful policies procedures and training just being aware and to pause before we act and to force that system to thinking to be engaged so this goes for ourselves it goes for our users it's called it goes for our external parties as well because we'd like our external parties to also know about our procedures and and follow them and not be surprised if we're asking validating questions and the very very last thought that i want to leave you with today is the problem with being aware of psychology principles like heuristics and biases and so forth is that we learn about them and then we think oh that doesn't like of course these heuristics and biases are applied to you know silly humans you know we humans all fall for these things but those biases don't apply to me because i know better and i i know you know i'm not well educated in these principles so i'm not going to be subject to them which is unfortunately not true um whether we are well versed in psychology principles or not we're at the end of the day we're still human and we're still subject to them and we're still susceptible to all these things and so when you consider these principles and try and build your procedures and and training with these principles in mind then just be wary of the not me fallacy definitely include yourself in those procedures and policies and training as well don't circumvent those procedures yourself because of course you yourself i myself will also be subject to these uh to these uh human opportunities and weaknesses all right so i am working on some research in the intersection of cyber security and psychology so if you are interested in collaborating or on any of my projects or even just wanted to reach out and continue this conversation please definitely reach out to me on linkedin and and mention technoconference um i'm also on twitter as well so feel free to follow me on there and so uh so thank you very much again to the techno session um i'll leave the references up so that in case you would like to read what i was reading for the purposes of this presentation uh thank you all so very much and enjoy the rest of the sessions you