CPI Talk: Data Breaches and Multiple Points to Stop Them
Channel: CPI Waterloo
Date: 2021-12-19

Speaker: Daphne Yao

To many people, preventing data breaches appears to be an unattainable goal. However, this impression is not accurate. We will first explain the reasons behind some of the high-profile data breach incidents (including Equifax and Target). Then, I will show that there are usually multiple opportunities to prevent, detect, or stop a data breach. I will also discuss the roles of regulations, e.g., Data Security Standard from the Payment Card Industry, and non-technical factors, such as organizational culture, in cybersecurity. Because of the cat-and-mouse nature of cybersecurity, achieving absolute data security is impossible. However, being proactive in cybersecurity will substantially reduce the risks.

Timestamps:
0:00 Intro What are CPI Talks?
2:54 Intro: Who is Daphne Yao?
4:19 Daphne Yao’s Career, Academic and Cybersecurity & Privacy Journey
8:19 Evolution of data breaches from the ‘80s [ie. Ransomware, holidays attacks, Target, Bitcoin etc.]
11:26 Good news [ie. San Francisco Subway Quesadilla Ransomware etc.]
12:47 Concept of perfect security/security is relative
Lessons to be learned from high-profile data breaches 
14:00 2013 Target Data Breaches  
15:59 How can a HVAC vendor’s credential access Target’s internal networks?
17:00 Target’s Missed Opportunities
19:32 Research Opportunities
19:54 Payment Card Industry (PCI) compliance 
22:53 Issue with PCI scanners
25:06 Target’s Improvements/Lessons Learned
26:12 2017 Equifax Data Breach
28:44 Why Didn't Equifax patch?
32:28 Why Equifax response was inadequate
33:40 Equifax’s Missed Opportunities
37:10 How can organizations protect data?
37:50 Lawmakers' reaction to Mark Zuckerberg's Testimony (Facebook–Cambridge Analytica data scandal)
39:54 What should executives do?
41:32 What should researchers do?
44:11 How can the public learn? /Why we must democratize data breach prevention knowledge?
45:24 Misconceptions of computing and cybersecurity
46:40 Opportunities for younger students 
48:00 Q&A session
48:43 Thoughts on innovative security thinking like Google's Zero trust networking initiative that they have been advocating?”
53:51 Follow-up: Do you have any thoughts on recent works that look at encrypted channels and then try to make some inferences about the data by doing some kind of statistical analysis” 
59:53 Regarding to PCI scanners that are certified despite being subpar, are there possibilities to build a better scanner? Has the certification process improved? 
1:04:04 Conclusion

Tags: 
data breaches, data breaches heist, data breaches explained, data breaches heist glitch, data breaches 2021, data breaches setup, data breaches doomsday heist, data breaches caused by human error, data breaches heist payout, the data breaches gta 5 glitch, target data breach 2013, target data breach, target data breach 2013 how did it happen, target data breach 2014, target data breach explained, target data breach third party vendor, equifax data breach, equifax data breach case study, equifax data breach settlement, equifax data breach settlement (credit monitoring instructions and activation code)