2019 LT: People Are The Solution!

### Overview In this lightning talk titled "People Are The Solution!", a cybersecurity senior lecturer addresses the cultural and communication issues prevalent within the information security industry. Drawing on global demographic statistics, cybersecurity workforce estimates, and common security attitudes, the speaker argues against the pervasive industry habit of dismissing end users and developers as "idiots." Instead, the presentation makes the case that security professionals must recognize the scale of the challenge, stop treating others poorly, and focus on helping people make fewer mistakes through supportive technology, proper training, and empathy.

### Key Topics - **Cybersecurity Demographics and Workforce Disparity**: The speaker opens with a quiz contrasting the 2018 world population (7.5 billion from the US Census) and estimated breach records (5.09 billion) against the roughly 6 million cybersecurity workers worldwide. Security personnel represent under 0.08% of the global population, demonstrating the massive numerical disadvantage security teams face against devices and breaches. - **The Flaw of Blaming Users**: Referencing a comment attributed to the CTO of Amazon stating that "there's always that idiot that will click the link," the speaker critiques the habit of calling users idiots. Insulting users alienates them, causes them to ignore security advice, and overlooks the fact that phishing lures are explicitly designed to deceive. - **The Role of Security Professionals**: Security's core mission is framed as helping users make fewer mistakes through thoughtful technology implementation and training—moving away from ineffective, unengaging slide-based training. - **Professional Conduct and Empathy ("Don't Be a Dick")**: The speaker urges practitioners to monitor how they treat colleagues. If a user's only interaction with security is negative, they assume the entire profession is hostile. A suggested core policy for security teams is simply to avoid acting poorly toward others. - **Empathy for Developers and Humility**: Practitioners are urged to stay humble and remember that no one started out as a security expert. Developers often release insecure code not out of incompetence, but due to intense business pressures, buyouts, or simply not being taught practices like input sanitization.

### Technical Details - **Population vs. Breach Data**: Data cited includes a world population of 7.5 billion (2018 US Census data), 5.09 billion estimated breached records, and an estimated 6 million global cybersecurity workforce (representing less than 0.08% of the population). - **Phishing and User Design**: The talk emphasizes that phishing links are engineered to fool human targets; even experienced security professionals (such as a referenced Data Protection Officer, Carl Gottlieb) can come close to clicking on malicious links. - **Development Pitfalls**: Mentions common security fundamentals such as input sanitization and explains that developers facing downward financial deadlines or legacy practices ("we've always done it that way for 20 years") may introduce vulnerabilities unintentionally.

### Takeaways - Calling end users or colleagues "idiots" fails as a security strategy and only drives disengagement. - The primary job of cybersecurity professionals is to support people and minimize errors through better training, supportive technology, and empathetic communication. - Professionals should remain humble, remembering that everyone started knowing nothing, and recognize the external constraints under which software developers and users operate.