Protecting People

Nobody wants to view employees as insider threats. Yet in the last 2 years, there have been about 40% more insider threat incidents - almost 1 in 3 breaches involves insider threats.   In this first episode of our People Variable miniseries, we interview Sai Chavali, Sr. Product Marketing Manager at Proofpoint, about insider threats.   What we talked about:   - The 3 types of people-centric insider threats   - Providing targeted security awareness about insider threats   - How insider threats are changing the security landscape Find additional content, like our Insider Risk Threat Assessment and Guide to Building a Security Awareness Program that Works, and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.

Would you pay the ransom?   There are 4,000+ ransomware attacks per day with $3.5Bn lost in just 2019.   Looks like the answer is Yes.   In our 6th episode to understand the mind of cybercriminals, your Protecting People hosts learn all about ransomware from Christopher Budd, Principal at Christopher Budd Security, and Ryan Kalember, EVP, Cybersecurity Strategy at Proofpoint.   What we talked about:   - What ransomware is & why people pay   - How to pay your ransomware attacker   - Professionalism among cybercriminals! Some have stopped attacking the healthcare industry during COVID-19   Find additional content and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.

The word malware comes from “malicious” + “software” — and it’s as bad as it sounds.   To get inside the minds of cyber criminals, we asked 2 security experts to teach us about malware.   In this episode, we interviewed Christopher Budd, Principal at Christopher Budd Security, and Sherrod DeGrippo, Sr. Director, Threat Research and Detection at Proofpoint, about how to get and avoid malware.   What we talked about:   - What malware is & how to get it   - Different types of malware like rats & banking Trojans   - COVID-themed lures vs. classic lures for malware   - Whether it’s better business sense to buy or build your own malware   Find additional content and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.

We recently put this question to three security awareness experts:   Where do you start with a company-wide training program?   In this #TacklingUserBehavior episode, we interview Eddie Whittingham, founder of the recently-acquired The Defence Works,  Kurt Wescoe, Former CMU Faculty and Chief Architect at Proofpoint Security Awareness Training, and Robert Shields, Sr. Product Marketing Manager at Proofpoint.   What we talked about:     - The need to have specific goals instead of doing “everything”   - Donuts as an excellent motivator   - Incorporating personal examples into training   - Focusing on your organization's unique risks and user landscape to tailor education   Find additional content and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.

Not all cybercriminals are evil. Some send phishing emails to their coworkers for their own good.   We’re talking about simulated phishing emails for education.   In this episode, we interview Jason Riegner, Jr Front End Developer at Proofpoint, about the Microsoft TEAMS phish he designed, which most of us fell for.   What we talked about:   - How to identify a phishing email   - What to do & especially what not to do when you get one   - The nuanced design of phishing emails, from intricate to innocuous   - We had a contest! Who wins our respect?   Find additional content and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.

BEC, or Business Email Compromise, is when an attacker disguises themselves to look like a trusted person.   But EAC, or Email Account Compromise, is when an attacker actually compromises an email account. They can start sending emails as, well, you.   In this episode, we hear from past guests Rob Holmes, Sherrod DeGrippo, & Mike Bailey about how to access and compromise a legitimate mailbox.   What we talked about:   - BEC & EAC attacks caused more than $26 billion in losses since 2016   - Why a real estate agency is a great target for a new cybercriminals   - How to leverage people skills to make believable demands for money   Find additional content and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.

Wouldn’t it be great if security training were so exciting that employees started begging for the next episode? Security training should feel like watching your favorite sketch comedies.   In this episode, we interview Eddie Whittingham, Founder of The Defense Works and former police officer and lawyer, about his inspiration for humorous, interactive security training.   What we talked about:   - Finally, the end of traditional security training   - How interactive comedy affects user behaviors   - The process of creating training episodes with comedy writers   - Eddie’s goal to push the boundaries of what security training means   Check out these resources we mentioned during the podcast:   The Defense Works’ YouTube channel gives you a taste of their training   Their blog is pretty funny, too   Find additional content and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.

Security is like having a foolproof safe. Privacy is like telling everyone the combination.   When it comes to the complex security and privacy landscape, where do you even start with awareness training?   In this episode of the #TacklingUserBehavior series, we interview Daniel Solove, Founder of TeachPrivacy and John Marshall Harlan Research Professor of Law at the George Washington University Law School.   What we talked about:   - The overlap between privacy and security   - The “hub and spokes” approach to training employees in security   - The qualities of effective privacy training   - Enforcement in the age of COVID-19   Check out this resource we mentioned during the podcast:   - Daniel has a Privacy + Security blog   - Register for our August 18th webinar: https://www.proofpoint.com/us/webinars?id=416919   Find additional content and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.

80% of what you need to be a cybercriminal is Internet access.   The other 20% is mostly social engineering. Effective cybercriminals understand how people think.   In this episode, we interview Robert Holmes, VP and General Manager, Email Fraud Defense at Proofpoint, about the easy process for business email compromise (BEC) attacks.   What we talked about:   - Smaller companies are more likely to be victimized than larger companies   - Cybercriminals pretend to be a trusted persona (like your CEO)   - Super easy but insidious tech tips that people fall for all the time   - Phishing, vishing & smishing: What are they?   Find additional content and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.

Users still clicking phishing emails? Reusing passwords?   Don't worry - you're not alone.   In this inaugural episode of our new #TacklingUserBehavior series, we interview Kurt Wescoe, VP of Engineering at Proofpoint and former Carnegie Mellon University faculty, about how to achieve successful user behavior change.   What we talked about:   - The importance of user buy-in and engaging security awareness programs   - Contextualizing education for users might mean incident-by-incident training   - How to be adaptable in setting achievable goals   Find additional content and subscribe to Protecting People on Apple Podcasts, Spotify, or our website.