1
00:00:00,000 --> 00:00:20,180
Welcome back to Quietly Secure, and welcome to the final episode of this season.

2
00:00:20,180 --> 00:00:24,800
Over the last few episodes we've explored a question that seems simple.

3
00:00:24,800 --> 00:00:28,100
Can we trust the digital world around us?

4
00:00:28,100 --> 00:00:35,860
We've talked about scams, artificial intelligence, deepfakes, online reputation, the information

5
00:00:35,860 --> 00:00:43,620
we see every day, skepticism, identity, and what happens when technology starts becoming

6
00:00:43,620 --> 00:00:47,140
part of almost every decision we make.

7
00:00:47,140 --> 00:00:53,100
And today we're bringing all that together because there is one place where technology,

8
00:00:53,100 --> 00:00:59,340
trust, and human behaviour come together more than almost everywhere else.

9
00:00:59,340 --> 00:01:00,340
Work.

10
00:01:00,340 --> 00:01:08,980
For most of us, work means technology, email, Microsoft Teams, cloud services, shared documents,

11
00:01:08,980 --> 00:01:17,180
mobile phones, online meetings, systems that make decisions, systems that store information,

12
00:01:17,180 --> 00:01:22,420
systems that connect us to customers, suppliers and colleagues.

13
00:01:22,420 --> 00:01:27,940
And all of that technology is designed to make our work in lives easier, but there is

14
00:01:27,940 --> 00:01:34,780
something sitting behind almost every one of those systems, a person, and sometimes

15
00:01:34,780 --> 00:01:39,500
that person is the security boundary.

16
00:01:39,500 --> 00:01:46,300
Think about fishing, we've talked about scams before, but fishing at work can feel different.

17
00:01:46,300 --> 00:01:53,500
The email might appear to come from your manager, your IT department, supplier, customer, perhaps

18
00:01:53,500 --> 00:01:56,220
even the chief executive.

19
00:01:56,220 --> 00:01:58,900
It might look completely legitimate.

20
00:01:58,900 --> 00:02:05,740
The language sounds right, the time in makes sense, and perhaps just one small request.

21
00:02:05,740 --> 00:02:07,780
Can you make this payment?

22
00:02:07,780 --> 00:02:09,820
Can you open this document?

23
00:02:09,820 --> 00:02:13,180
Can you reset your password on my password?

24
00:02:13,180 --> 00:02:15,860
Can you send me the information?

25
00:02:15,860 --> 00:02:21,260
Nothing particularly dramatic, and that's precisely why fishing works.

26
00:02:21,260 --> 00:02:24,660
It doesn't always try to make you panic.

27
00:02:24,660 --> 00:02:29,060
Sometimes it simply tries to make you act normally.

28
00:02:29,060 --> 00:02:34,460
An artificial intelligence is making this even more interesting.

29
00:02:34,460 --> 00:02:37,740
Messages can be written more convincingly.

30
00:02:37,740 --> 00:02:40,620
Spelling mistakes can disappear.

31
00:02:40,620 --> 00:02:44,260
Other information can be incorporated automatically.

32
00:02:44,260 --> 00:02:48,780
A scammer doesn't necessarily have to understand your organisation.

33
00:02:48,780 --> 00:02:52,940
AI can help them create the appearance that they do.

34
00:02:52,940 --> 00:02:58,020
And perhaps wonder, the fishing email, what looks suspicious at all?

35
00:02:58,020 --> 00:03:03,420
It will look exactly like the sort of email you'd normally receive, which brings us back

36
00:03:03,420 --> 00:03:06,380
to something we've talked about through this season.

37
00:03:06,380 --> 00:03:07,700
Trust!

38
00:03:07,700 --> 00:03:14,580
We don't examine every message we receive, we cap, we rely on patterns, we recognise

39
00:03:14,580 --> 00:03:21,020
names, we recognise writing styles, and we recognise familiar requests.

40
00:03:21,020 --> 00:03:24,820
And most of the time, that's perfectly reasonable.

41
00:03:24,820 --> 00:03:30,500
The problem comes when someone deliberately manipulates those expectations.

42
00:03:30,500 --> 00:03:34,740
But external attackers aren't the only risk.

43
00:03:34,740 --> 00:03:39,420
There's another uncomfortable subject, insider threats.

44
00:03:39,420 --> 00:03:42,340
The phrase can sound quite sinister.

45
00:03:42,340 --> 00:03:49,420
We might imagine somebody deliberately stealing information, and employ selling data.

46
00:03:49,420 --> 00:03:52,220
Someone sabotaging a system.

47
00:03:52,220 --> 00:03:54,540
And those things do happen.

48
00:03:54,540 --> 00:03:58,540
But insider risk isn't always malicious.

49
00:03:58,540 --> 00:04:04,700
Sometimes it's someone making a mistake, sending the wrong attachment.

50
00:04:04,700 --> 00:04:07,460
Sharing something with the wrong person.

51
00:04:07,460 --> 00:04:09,820
Using the wrong account.

52
00:04:09,820 --> 00:04:11,820
Clicking a link.

53
00:04:11,820 --> 00:04:17,860
Leaving a laptop somewhere, or simply misunderstanding what they were supposed to do.

54
00:04:17,860 --> 00:04:23,860
And this is important, because security isn't just about stopping bad people.

55
00:04:23,860 --> 00:04:28,260
It's also about helping good people make fewer mistakes.

56
00:04:28,260 --> 00:04:34,300
And that's when human decision-making becomes so important.

57
00:04:34,300 --> 00:04:38,020
We like to think that people make decisions logically.

58
00:04:38,020 --> 00:04:44,700
We gather the information, we assess the risk, and we choose the sensible option.

59
00:04:44,700 --> 00:04:47,420
But that's not really how humans work.

60
00:04:47,420 --> 00:04:53,620
We're busy, we're distracted, we're under pressure, we're trying to meet deadlines, we're

61
00:04:53,620 --> 00:04:58,740
interrupted by messages, we're thinking about the next meeting.

62
00:04:58,740 --> 00:05:04,260
And sometimes, we simply make a decision quickly, because we've made the same decision

63
00:05:04,260 --> 00:05:06,820
100 times before.

64
00:05:06,820 --> 00:05:14,860
And that's not stupidity, that's being human, and attackers understand it.

65
00:05:14,860 --> 00:05:21,020
A fishing message doesn't necessarily need to convince you that something is true.

66
00:05:21,020 --> 00:05:24,620
It might only need you to stop questioning it.

67
00:05:24,620 --> 00:05:28,740
A request doesn't need to be obviously malicious.

68
00:05:28,740 --> 00:05:31,980
It might simply need to feel familiar.

69
00:05:31,980 --> 00:05:35,140
A decision doesn't need to be forced.

70
00:05:35,140 --> 00:05:38,420
It might just need to be made quickly.

71
00:05:38,420 --> 00:05:45,140
And that gives us one of the simplest security tools we have, the ability to pause.

72
00:05:45,140 --> 00:05:47,380
Just for a moment.

73
00:05:47,380 --> 00:05:51,620
Perhaps that's what good security at work should feel like.

74
00:05:51,620 --> 00:05:55,900
No fear, not suspicion of everyone.

75
00:05:55,900 --> 00:05:58,180
No endless warnings.

76
00:05:58,180 --> 00:06:03,620
Not making people feel that every click could bring the organisation crashing down, but

77
00:06:03,620 --> 00:06:06,700
something much quieter.

78
00:06:06,700 --> 00:06:07,700
Confidence.

79
00:06:07,700 --> 00:06:12,020
The confidence to recognise when something feels unusual.

80
00:06:12,020 --> 00:06:15,300
The confidence to question a request.

81
00:06:15,300 --> 00:06:17,860
The confidence to check.

82
00:06:17,860 --> 00:06:24,660
And the confidence to say, before I do that, I'm just going to make sure.

83
00:06:24,660 --> 00:06:32,500
And perhaps most importantly, the confidence to admit when something has gone wrong.

84
00:06:32,500 --> 00:06:37,380
Because people will make mistakes, that's unavoidable.

85
00:06:37,380 --> 00:06:40,980
The question is, what happens afterwards?

86
00:06:40,980 --> 00:06:45,380
Can someone report a suspicious email without being embarrassed?

87
00:06:45,380 --> 00:06:49,780
Can someone admit they've clicked something without being afraid?

88
00:06:49,780 --> 00:06:53,820
Can someone say, I think I may have made a mistake?

89
00:06:53,820 --> 00:06:59,380
And know that the organisation would rather hear about it immediately, than discover it

90
00:06:59,380 --> 00:07:01,380
three days later.

91
00:07:01,380 --> 00:07:04,060
That's not just a technology problem.

92
00:07:04,060 --> 00:07:05,940
It's a culture problem.

93
00:07:05,940 --> 00:07:12,580
And culture is one of the strongest security controls an organisation has.

94
00:07:12,580 --> 00:07:18,300
We've spent this season talking about technology, but technology has never really been the main

95
00:07:18,300 --> 00:07:19,820
character.

96
00:07:19,820 --> 00:07:21,140
People have.

97
00:07:21,140 --> 00:07:26,900
We've looked at why scams work, because they exploit human psychology.

98
00:07:26,900 --> 00:07:33,700
We've looked at deepfakes, because technology can manipulate what we can see and hear.

99
00:07:33,700 --> 00:07:39,500
We've looked at AI, because we're increasingly asking machines to provide information and

100
00:07:39,500 --> 00:07:41,420
make decisions.

101
00:07:41,420 --> 00:07:47,060
And we've looked at reputation, because what exists about us online can influence how

102
00:07:47,060 --> 00:07:49,060
others see us.

103
00:07:49,060 --> 00:07:54,120
We've looked at information, because having more of it doesn't necessarily make it more

104
00:07:54,120 --> 00:07:55,920
trustworthy.

105
00:07:55,920 --> 00:08:02,900
We've looked at skepticism, because sometimes the safest response is simply to stop and ask,

106
00:08:02,900 --> 00:08:04,900
how do I know?

107
00:08:04,900 --> 00:08:11,980
We've looked at identity, because in an AI world, proving who you are is becoming increasingly

108
00:08:11,980 --> 00:08:13,940
complicated.

109
00:08:13,940 --> 00:08:18,340
And now we've arrived at work, where all of those things meet.

110
00:08:18,340 --> 00:08:23,660
And perhaps that's the real lesson of this season.

111
00:08:23,660 --> 00:08:26,300
Security isn't about knowing everything.

112
00:08:26,300 --> 00:08:30,860
You don't need to understand how every AI model works.

113
00:08:30,860 --> 00:08:34,940
You don't need to know how every cyber attack is performed.

114
00:08:34,940 --> 00:08:38,780
You don't need to understand every security control.

115
00:08:38,780 --> 00:08:42,620
You don't need to become a cyber security expert.

116
00:08:42,620 --> 00:08:47,940
You simply need enough understanding to make the better decisions.

117
00:08:47,940 --> 00:08:52,540
Tough knowledge to recognize when something doesn't feel right.

118
00:08:52,540 --> 00:09:00,100
Enough confidence to question it, and enough skepticism to look twice, and enough humility

119
00:09:00,100 --> 00:09:05,220
to realise that sometimes you might get it wrong.

120
00:09:05,220 --> 00:09:12,180
That's what I mean by quiet confidence, not being completely certain, not being afraid,

121
00:09:12,180 --> 00:09:17,620
not assuming you're immune to scams, and not believing that technology will always

122
00:09:17,620 --> 00:09:19,380
protect you.

123
00:09:19,380 --> 00:09:25,300
Quiet confidence is knowing enough to navigate the digital world calmly.

124
00:09:25,300 --> 00:09:31,100
It's been able to receive an unexpected message, and pause.

125
00:09:31,100 --> 00:09:36,300
It's been able to see a convincing video, and question it.

126
00:09:36,300 --> 00:09:42,940
It's been asked to prove your identity, and understand what you're giving away.

127
00:09:42,940 --> 00:09:49,940
It's been given an answer by AI, and remember that an answer isn't necessarily the same thing

128
00:09:49,940 --> 00:09:57,660
as truth, and at work it's been able to receive a request and confidently say, "Let me just

129
00:09:57,660 --> 00:10:00,180
check that first."

130
00:10:00,180 --> 00:10:06,340
So as we come to the end of the season, perhaps we should return to where it started.

131
00:10:06,340 --> 00:10:07,340
Trust.

132
00:10:07,340 --> 00:10:08,860
We need trust.

133
00:10:08,860 --> 00:10:11,060
We can't function without it.

134
00:10:11,060 --> 00:10:18,820
We trust our colleagues, we trust systems, we trust information, we trust organisations,

135
00:10:18,820 --> 00:10:21,420
and we trust technology.

136
00:10:21,420 --> 00:10:24,420
The answer isn't to stop trusting.

137
00:10:24,420 --> 00:10:31,100
It's to learn how to trust well, to understand when trust is appropriate, when it needs to

138
00:10:31,100 --> 00:10:37,860
be questioned, and when we need a little more evidence, because skepticism without trust

139
00:10:37,860 --> 00:10:40,340
becomes paranoia.

140
00:10:40,340 --> 00:10:45,540
But trust without skepticism can become vulnerability.

141
00:10:45,540 --> 00:10:51,060
The balance is somewhere in between, and that's where quietly secure has always tried to

142
00:10:51,060 --> 00:10:52,460
sit.

143
00:10:52,460 --> 00:10:58,860
Not telling you to be frightened of technology, not telling you everything online is dangerous,

144
00:10:58,860 --> 00:11:03,620
and not pretending that technology is going away, because it isn't.

145
00:11:03,620 --> 00:11:11,300
AI will continue to develop, digital identity will continue to evolve, the way we work will

146
00:11:11,300 --> 00:11:17,540
continue to change, and the technology around us will become more deeply embedded in our

147
00:11:17,540 --> 00:11:19,660
everyday lives.

148
00:11:19,660 --> 00:11:26,100
The answer isn't to step away from it, it's to understand it, just enough.

149
00:11:26,100 --> 00:11:31,300
So if there's one thing I'd like you to take away from this season it's this.

150
00:11:31,300 --> 00:11:36,380
You don't have to know everything, you just need to know when to stop.

151
00:11:36,380 --> 00:11:43,500
When to question, when to check, and when to ask for help, because sometimes the most powerful

152
00:11:43,500 --> 00:11:50,500
security tool you have isn't the antivirus programme, it isn't artificial intelligence,

153
00:11:50,500 --> 00:11:57,460
it isn't a password, and it isn't a firewall, it's a few seconds of human thought.

154
00:11:57,460 --> 00:12:04,300
That little moment between receiving something and reacting to it, the moment when you stop,

155
00:12:04,300 --> 00:12:08,780
think and ask, how do I know?

156
00:12:08,780 --> 00:12:14,300
And perhaps that's the quiet confidence we should all aim for, not confidence that will

157
00:12:14,300 --> 00:12:21,140
never make a mistake, but confidence that when something doesn't feel right, will notice,

158
00:12:21,140 --> 00:12:25,100
will question it, and will do something about it.

159
00:12:25,100 --> 00:12:31,300
Because the digital world isn't going to become simpler, it's going to become more complicated,

160
00:12:31,300 --> 00:12:39,100
more convincing, more connected, and increasingly difficult to separate from everyday life.

161
00:12:39,100 --> 00:12:47,060
But that doesn't mean we need to navigate it anxiously, we can navigate it calmly, curiously,

162
00:12:47,060 --> 00:12:50,940
and with just enough skepticism to keep us safe.

163
00:12:50,940 --> 00:12:54,340
So that's it for season 4 of Quietly Secure.

164
00:12:54,340 --> 00:12:56,140
Thank you for listening.

165
00:12:56,140 --> 00:13:00,660
Thank you for spending these episodes exploring these questions with me.

166
00:13:00,660 --> 00:13:06,220
We've talked about scams and why they work, we've explored deepfakes, and what happens

167
00:13:06,220 --> 00:13:09,620
when seeing it is no longer believing.

168
00:13:09,620 --> 00:13:16,020
We've questioned whether we can trust AI answers, we've explored algorithms and the information

169
00:13:16,020 --> 00:13:18,380
they choose to show us.

170
00:13:18,380 --> 00:13:21,740
We've looked at online reputation.

171
00:13:21,740 --> 00:13:25,380
What it means to grow up in a digital world?

172
00:13:25,380 --> 00:13:32,300
We've talked about skepticism, identity, and finally looked at trust at work.

173
00:13:32,300 --> 00:13:38,260
And underneath all of those subjects, there's one common theme, people.

174
00:13:38,260 --> 00:13:45,620
Because technology might change, the tools might change, the threats might change.

175
00:13:45,620 --> 00:13:51,700
But the need to think carefully about the decisions we make probably won.

176
00:13:51,700 --> 00:13:53,740
This has been Quietly Secure.

177
00:13:53,740 --> 00:13:55,940
Thank you for listening to season 4.

178
00:13:55,940 --> 00:14:02,220
Stay curious, stay skeptical, and most importantly, stay Quietly Secure.

179
00:14:02,460 --> 00:14:12,220
[MUSIC]

180
00:14:12,220 --> 00:14:22,220
[BLANK_AUDIO]