Navigating Faulty Assumptions and Magical Thinking in Cybersecurity
summary
Panel argues many security fixes rest on false certainties and gives concrete examples and alternatives: domain generation algorithms resist generic detection and Conficker generates thousands of domains and uses only five, NIST 2017 abandons forced password rotation so sites still prompting resets are outdated and NIST 2017: stop forced password rotation, industry benchmarks measure peer behavior not effectiveness and benchmarks show what others do not what works, push toward mission appropriate security and note turnover risk with roughly half of security staff predicted to leave by 2025.
AI-written summary · about
chapters (14)
- 0:00Introduction and panelists
- 3:33Myths in domain generation algorithms
- 6:05Technology versus human context
- 8:14Password policy myths
- 9:38Benchmarks and herd mentality
- 10:44Users are not the weakest link
- 18:30Illusion of control and burnout
- 21:58Predicting the future in cybersecurity
- 27:21Mission appropriate security
- 28:47Defining cybersecurity clearly
- 31:12Predictions and black swans
- 39:15Questioning assumptions and predictions
- 40:43Q&A begins
- 51:21Closing and book signing
related talks
51mThinking Differently About Security
01h 03mWhy Don't Users Do What They are Supposed to Do? A look at users and security
41mSecurity: The world is broken and you are guilty
46mFire, Brimstone, and Bad Security Decisions
42mReal-World Security Implementations and Key Lessons
53mOptimistic Security
38mDo You Feel Secure?
49mWinning - the future perspective in the next 20 years!