Conference Day 2

### Overview In this presentation titled "Pandemic Polemic," Eric Pinkerton from Trustwave explores whether societal responses to the COVID-19 pandemic offer actionable lessons for cybersecurity. Pinkerton reflects on the initial premise—that managing public health behaviors mirrors the behavioral change challenges faced by security professionals—and concludes that rather than finding neat solutions, the comparison primarily illustrates the limitations of relying on human compliance. The talk examines human behavior through psychological concepts, supply chain vulnerabilities, attribution dilemmas, defense-in-depth fallacies, and remote work adaptations.

### Key Topics - **Human Behavior and the "Dark Tetrad":** Pinkerton notes that security often oversimplifies people into binary categories of good or bad. In behavioral science, traits like narcissism, Machiavellianism, psychopathy, and sadism (the "Dark Tetrad") explain why certain groups deliberately defy rules or exploit systems, creating "chaotic evil" dynamics in both public health compliance and security compliance. - **Incentive Structures:** During the pandemic, authorities relied on carrots (freedom, financial perks, economic recovery) and sticks (fines, imprisonment, public shaming, lockdowns). In cybersecurity, equivalent levers are limited; financial incentives (such as SurveyMonkey offering discounts for enabling MFA) are rare, leaving organizations to rely heavily on adverse career consequences or mandatory technical enforcement. - **Attribution vs. Practical Priority:** While identifying patient zero or origin points (e.g., wet markets or mink farms) matters to specialized researchers, it proved largely irrelevant for the general public's daily safety. Similarly, in cybersecurity, Pinkerton argues that attributing attacks to specific actors wastes resources for the vast majority of organizations. - **Supply Chain Risks and Panic Responses:** Early pandemic supply chain disruptions spurred fraudulent testing clinics, counterfeit PPE, and widespread panic buying. Pinkerton observes that human panic and mirroring behavior (such as bulk mask purchasing) emphasize how collective reactions can exacerbate supply chain fragility. - **Defense in Depth vs. Non-Compliance:** Public health deployed layered measures (masks, ventilation, social distancing, hand sanitizing, vaccination). However, Pinkerton points out that individuals who refuse one control frequently refuse all of them, challenging the theoretical independence assumed in defense-in-depth models (such as SABSA 80/20 probability calculations).

### Technical Details & Real-World Examples - **Remote Work and VPN Bottlenecks:** When an insurance company moved 100 call center operators to remote work almost overnight on a VPN provisioned for only 10–15 concurrent users, Pinkerton advised temporarily disabling VPN encryption (null encryption) as a pragmatic risk decision to maintain business operations. - **Technical Controls Over Awareness:** Pinkerton criticizes organizations spending significant budgets on phishing simulations or security awareness while lacking basic controls like multi-factor authentication (MFA). He argues technology must enforce roughly 80% of security requirements (such as password length policies) before addressing residual human error. - **Hybrid Operations:** Security activities adapted to pandemic constraints by adopting hybrid incident response tabletop exercises and deploying remote dropboxes with modems for penetration testing tasks that were previously done strictly on-site.

### Takeaways - Rely on technical enforcement rather than human goodwill: make the secure option the easy and default choice. - Do not squander budget on user training and phishing campaigns if fundamental controls like MFA are not yet in place. - Focus on organizational agility and risk-based decision-making rather than wasting operational cycles on threat attribution. - Supply chain complexities will remain an enduring challenge across both physical crises and cybersecurity operations.