39:51This recording is not available yet.
Digestible Cybersecurity Knowledge, With Ten Times the Science
Download resourcesCategories
Threats & Threat IntelligenceCybercrime EconomyRansomwarePeople, Culture & CareersSecurity AwarenessWellbeing & Human Factors
Vendors and tools discussed
About this session
Michael Joyce, co-executive director of SERENE-RISC, the federally funded knowledge-mobilization network based at Université de Montréal, splits the talk in two. He first presents the network's free resources: a Canada-wide community of academics and partners, more than 200 plain-language research summaries, the Cybersecurity Research Digest with its one-question, quarter-page and one-page formats, the Connect knowledge site, the cybersec101.ca training kit built with public libraries, the annual workshop and the Cybersecurity Revolution 24-hour online conference. He then delivers ten recent studies in about twenty minutes: phishing gangs in the Netherlands built on offline social ties, why drug dealers move to darknet markets, a 10,000-respondent survey on victimisation and self-control, police takedowns of DDoS-for-hire booter services, a meta-analysis showing rewards and punishments do little for security-policy compliance, technology-enabled intimate partner abuse and the stalkerware market, health-belief models for awareness campaigns, the economics of running a botnet, and a GoSecure co-authored analysis showing a handful of ransomware families capture most Bitcoin payments.
Make decisions based on science and evidence, its easier said than done. SERENE-RISC is a Montreal-based, government-funded project that not only makes cybersecurity research available with efficient and free tools, it also provides linkages for business and government to interface with top academics nationwide. We provide hundreds of research summaries that can save you valuable time. To prove our point, this presentation will deliver the research findings from ten important studies from around the world. A low fat presentation with 10 times the science.
Key takeaways
- Rewards and punishments barely move security-policy compliance; invest in employees' norms and attitudes instead of adding sanctions.
- Fear-only awareness messaging can demotivate; pair the threat with a response people believe they can carry out and lower the barriers to doing it.
- Ransomware revenue is concentrated in a few families, so targeting the top three disrupts most of the market.
- Taking down a single DDoS-for-hire service changes little; coordinated multi-site takedowns and public deterrence campaigns do reduce attacks.
- Use the free SERENE-RISC research summaries and the Statistics Canada cybercrime survey tables to ground decisions in evidence.
Speakers
Michael Joyce
Michael Joyce is the co-executive director for Canada’s SERENE-RISC (Smart Cybersecurity Network – Réseau Intégré sur la Cybersécurité) initiative, a national network of researchers and practitioners, which has developed innovations including… Read moreRead less
Michael Joyce is the co-executive director for Canada’s SERENE-RISC (Smart Cybersecurity Network – Réseau Intégré sur la Cybersécurité) initiative, a national network of researchers and practitioners, which has developed innovations including cybersec101.ca, The Cybersecurity Digest, secrev.org, and Konnect. He has nearly a decade of experience in the development and management of national and international cybercrime and cybersecurity knowledge mobilization programs. In his spare time he is completing a doctorate in criminology at the University of Montreal in the Cybercrime prevention laboratory (https://www.prevention-cybercrime.ca/). He is also the host of the cybercrimeology.com podcast.
