Do As I Say, Not As I Do: Why Our Security Advice Sucks and How We Can Change That

No ratings

Presented at bsideswinnipeg 2017 by

Sarah Lacroix

Let's talk about risk assessment and personal security! As technically inclined people, we are at an advantage when it comes to our privacy and security. We are more aware of the risks and consequences associated with our use of technology than the average person. For them, standard security advice is overwhelming, unrealistic and failure to comply comes with intangible consequences. Sensationalist media coverage of obscure DDoS attacks from China combined with the reality that people tend to suck at assessing risk means that the average person is more worried about the Russian government reading their email than they are of giving their own password away. On the other side of things, as professionals who have some idea of what actually can go wrong, our trouble with assessing risk tends to take us in the opposite direction. We lock everything down to the point of missing out on some of the cool things that our tech can offer us. This talk looks at how we can help ourselves and the people around us better assess their risk so we can start giving more realistic advice. Sarah started her education in technology by hanging out with IT professionals and hobbyists who were passionate about their projects. She grew that interest by volunteering at conferences and asking lots of questions. When she finally had more questions than her friends could answer, she decided it was time for a more formal education. She started with Applied Computer Science and Business Administration at University of Winnipeg, then studied Digital Forensics, Penetration Testing and Ethical Hacking at Glasgow Caledonian University in Scotland before transferring into the Business Information Technology program at Red River College. She is currently on the board of technology student group, Bits and Bytes Association. Never quite satisfied with her current level of knowledge, Sarah is always working to strengthen her skills and build her expertise by taking on side projects and talking to people more experienced than herself. Upon graduation (expected: June, 2019), she wants to work as a security analyst. She enjoys hipster coffee, going to the gym, and Instagramming her food. You can find her on the Internet as @punkrockgoth.