Nadya Bartol: Better cybersecurity starts with honesty and accountability | TED

Transcriber:

譯者: 傅寰 李 審譯者: Yi-Ping Cho (Marssi)

Today, I'm going to talk about a shameful topic.

今天，我想談一個讓人汗顏的主題

This has happened to many of us, and it's embarrassing,

我們大多數都碰過，讓我們很尷尬

but if we don't talk about it, nothing will ever change.

但如果不討論 事情就沒有任何轉機

It's about being hacked.

那就是被駭

Some of us have clicked on a phishing link and downloaded a computer virus.

有些人是點了釣魚連結 下載了電腦病毒

Some of us have had our identities stolen.

有人是個資被竊取

And those of us who are software developers

而像我們程式設計師

might have written insecure code with security bugs in it

可能寫了有漏洞的程式

without realizing it.

卻沒注意到

As a cybersecurity expert,

身為網路安全專家

I have worked with countless companies on improving their cybersecurity.

我和許多公司合作 增進他們的網路安全

Cybersecurity experts like me have advised companies

我們這些專家建議公司

on good cybersecurity practices,

要有良好的網路安全訓練

monitoring tools

監管工具

and proper user behaviors.

以及好的使用者行為

But I actually see a much bigger problem that no tool can fix:

不過我看到更大的問題 而且沒有工具能修補

the shame associated with the mistakes that we make.

就是我們犯錯後，伴隨而來的羞愧感

We like to think of ourselves as competent and tech savvy,

我們認為自己很有能力 對科技也很熟悉

and when we make these mistakes that can have a really bad impact

當我們犯的錯 帶來的影響可能很壞

on us and our companies --

對自己或公司都是

anything from a simple annoyance,

從小小的不愉快

to taking a lot of time to fix,

到花大把時間修補

to costing us and our employers a lot of money.

到付出大筆金錢

Despite billions of dollars that companies spend on cybersecurity,

雖然很多公司花了大錢做網路安全

practitioners like me see the same problems over and over again.

我和同行們卻重複看到相同的問題

Let me give you some examples.

我講幾個例子給你聽

The 2015 hack of Ukrainian utilities

2015年烏克蘭電廠被駭

that disconnected power for 225,000 customers

22萬5千名客戶無電可用

and took months to restore back to full operations

電廠花了數個月才完全恢復營運

started with a phishing link.

起因是一個釣魚連結

By the way, 225,000 customers is a lot more 225,000 people.

喔對了，22萬5千名客戶 遠不止22萬5千人而已

Customers can be anything from an apartment building

客戶包含公寓大廈

to an industrial facility

工廠設施

to a shopping mall.

還有購物中心

The 2017 data breach of Equifax

2017年易速傳真資料外洩

that exposed personally identifiable information

遭外流的個資數量

of 140 million people

有1億4千萬人

and may ultimately cost Equifax something on the order of 1.4 billion dollars:

為了處理這事，它們最後花了 差不多14億美元

that was caused by an exploitation of a well-known vulnerability

起因是駭客攻擊了一個出名的弱點

in the company's customer consumer complaint portal.

位置就在客訴系統裡

Fundamentally, this is about technology and innovation.

網路安全基本上，和科技、創新有關

Innovation is good; it makes our lives better.

創新是好事，讓生活更便利

Most of the modern cars we drive today are fundamentally computers on wheels.

現在的車子，其實就是有輪子的電腦

They tell us where to go to avoid traffic, when to take them in for maintenance

會告訴我們走哪不會塞車 什麼時候該保養

and then give us all kinds of modern-day conveniences.

提供各種現代世界的便利

Many people use connected medical devices like pacemakers

許多人用可連線醫療裝置 像是心律調節器

and glucose monitors with insulin pumps.

還有，搭配胰島素幫浦的血糖監測器

These devices make these people's lives better

這些裝置讓病人日子更好過

and sometimes even extend their lives.

也可能延長壽命

But anything that can be interconnected can be hacked when it's connected.

不過任何可連線裝置 只要連線都可能被駭

Did you know that the former US Vice President Dick Cheney

你知道嗎？ 美國前副總統迪克錢尼

kept his pacemaker disconnected from Wi-Fi before he received a heart transplant?

在心臟移植前 總是不讓心律調節器連到wifi

I will let you figure out why.

原因我留給你自己想

In a digitally interconnected world, cyber risks are literally everywhere.

數位互相連結的現在 網路危機無處不在

For years, my colleagues and I have been talking about

幾年來，我和同事都有聊到

this elusive notion of cybersecurity culture.

網路安全文化有多匱乏

Cybersecurity culture is when everybody in the organization

網路安全文化，是同一組織的人

believes that cybersecurity is their job,

都視網路安全為己任

knows what to do and what not to do

知道什麼該做、什麼不該做

and does the right thing.

而且只做對的事

Unfortunately, I can't tell you which companies do this well,

但我不能明講哪些公司做得不錯

because by doing so, I would put a juicy target on their backs

如果講了，反而會讓他們 招來有心人士的攻擊

for ambitious attackers.

But what I can do is make cybersecurity less mysterious,

我能做的，是讓網路安全更普及

bring it out into the open and talk about it.

讓它不那麼神秘，大家一起討論

There should be no mystery or secrecy within an organization.

組織中不該有任何謎團和秘密

When something is invisible and it's working,

當一樣東西在運作 不過我們看不到

we don't know that it's there until it's not there.

那只有在它停止運作時 我們才會注意到它

Kind of like toilet paper.

有點像衛生紙

When the COVID-19 pandemic began,

疫情爆發後

what has been there all of a sudden became super important

本來常見的東西突然變得很重要

because we couldn't find it anywhere.

因為供貨不足，其他地方找不到

Cybersecurity is just like that:

網路安全也是這個概念

when it's working, we don't know, and we don't care.

正常運作時我們沒感覺，也不在意

But when it's not working,

但失靈的時候

it can be really, really bad.

情況就可能很慘

Toilet paper is pretty straightforward.

衛生紙很好懂

Cybersecurity is mysterious and complex.

網路安全很神祕複雜

And I actually think it starts with the notion of psychological safety.

不過我想能從心理安全感開始

This notion was popularized by an organizational behavior scientist,

這概念最早 由一位組織行為學家提出

Amy Edmondson.

她叫艾美艾德蒙森

Amy studied behavior of medical teams in high-stakes situations like hospitals,

她研究醫療團隊在高風險情境中的行為

像是在醫院，一出錯就會要人命

where mistakes could be fatal.

And she found out that nurses were not comfortable

她發現護理師 不太好意思給醫生建議

bringing up suggestions to the doctors

because of the fear of questioning authority.

因為護理師不敢質疑有權威的人

Amy helped improve medical teams

艾美幫助醫療團隊

to make nurses more comfortable bringing up suggestions to the doctors

讓護理師能更放心地給醫生治療建議

for patient treatment

without the fear of being scolded or demeaned.

不用怕被罵、被羞辱

For that to happen, doctors needed to listen and be receptive --

要做到這點，醫生得願意傾聽 虛心接受建言，不批評

without judging.

Psychological safety is when everybody is comfortable speaking up

要有心理安全感 就要讓大家都敢發言

and pointing things out.

敢指出問題

I want cybersecurity to be the same.

我希望網路安全也能如此

And I want cybersecurity practitioners to be comfortable bringing suggestions up

我希望網路安全從業人員 都能放心提意見

to senior executives or software developers,

給主管、軟體開發師建議

without being dismissed as those people who continue to talk about

而不是被當成危言聳聽的人 而被草草打發

horrors and errors,

and say no.

Not doing so is really hard

要這些負責創造數位產品的人

for the individuals who are responsible for the creation of digital products

接受意見是很難的

because fundamentally, it's about their pride and joy in their creations.

基本上，產品就是 他們的驕傲、喜悅和創造

I once tried talking to a senior software development executive

我曾經試著建議一位高階開發主管

about the need to do better security.

提出安全措施要加強

You know what he said?

你知道怎麼回我嗎？

"Are you telling me we're developing insecure code?"

「你的意思是我們的東西不安全嗎？」

In other words, what he heard was, "Your baby is ugly."

換句話說，我的建議 在他耳裡聽起來像「你的小孩很醜」

What if instead of focusing on what not to do,

相較於專注在「哪些事不該做」

we focused on what to do?

我們不如專注在「該做什麼事？」

Like, how do we develop better software

像是，如何開發更好的軟體

and protect our customer information at the same time?

同時也保護好顧客資料

Or how do we make sure that our organization is able to operate

或是，怎麼做能確保組織妥善運行

in crisis, under attack or in an emergency?

即便在危機時刻、遭攻擊的時候

And what if we reward good things that people do in cybersecurity in some way

如果我們獎勵 人們在網路安全上做的好事

and encourage them to do so,

並鼓勵大家多做

like reporting security incidents,

像是，回報安全疑慮

reporting potential phishing emails,

檢舉可疑的釣魚郵件

or finding and fixing software security bugs

或是找到、修補軟體漏洞

in the software that they develop?

各種自家軟體都算

And what if we tied these good security actions to performance evaluations

然後把這些行為列入考績

to make it really matter?

讓大家都重視呢？

I would love for us to communicate these good cybersecurity things

我很樂意為大家 討論這些關於網路安全的好事

and encourage them in some sort of company-wide communications

也鼓勵更多公司內部溝通

like newsletters, blogs, websites, microsites --

像是在通訊、部落格 網站、微型網站……等等

whatever we use to communicate to our organization.

任何公司溝通的平台

What if a company announced a competition for who finds the most security bugs

如果有公司舉辦找漏洞大賽呢?

and fixes them in a two-week development sprint

比兩週，看誰能找出且修補最多漏洞

and then announces the winner of the competition for the quarter

並在大廳公開表揚這一季的贏家

at a large company virtual town hall,

and then rewards these people, these winners, with something meaningful,

而且給他們有意義的獎賞

like a week's vacation or a bonus.

像是讓他們休假一週或給獎金

Others will see the celebration and recognition,

其他人看到這樣的表揚和認可之後

and they'll want to do the same.

就會想跟進和他們一樣

In the energy industry,

在能源產業

there is a really strong culture of safety.

他們的職業安全文化很強

People care about this culture, are proud of it,

他們很注重職安，也引以為傲

and there is a collective reinforcement of this culture

大家一起維護這個文化

to make sure that nobody gets hurt.

確保沒有人受傷

One of the ways they exhibit and keep this safety conscious culture going

讓職安觀念長存的其中一個方法

is by counting and visibly displaying days since the last safety incident.

是計算、公開距離上一次意外的天數

And then everybody works really hard not to have that count go back to zero

大家共同努力，不想讓數字歸零

because that means that somebody did get hurt.

如果歸零，就是有人受傷了

Cybersecurity is the same as safety.

網路安全也同樣是安全

What if we all agree

如果我們達成共識

to keep that count of days since the last cybersecurity incident

要讓距離上一次 網路安全危害的日子持續累積

going on forever

and then work really hard not to have it reset to zero?

努力不讓數字歸零呢？

And then certain things are a no-no,

確立某些事不能做

and we need to clearly communicate to our organizations what they are

我們也要跟組織溝通清楚 哪些事是大忌

in an easily digestible and maybe even fun way,

溝通方法要好懂，甚至有趣

like gamification or simulations,

像是遊戲化、模擬器……等

to make sure that people can remember this.

確保大家都能記得

And if somebody does something they're not supposed to do,

如果有人做了不該做的事

they should face some sort of consequences.

就該受到相對的懲處

So, for example, if an employee buys equipment on Amazon or eBay

舉例來說，員工在亞馬遜、eBay上買器材

or uses personal Dropbox for their company business,

或用個人Dropbox處理公司業務

then they should face some sort of consequences.

那就該受處罰

And when this happens, executives should get the same treatment

如果管理階層做了這些事 也一樣要受處罰

as regular employees,

because if they don't, then people won't believe that it's real

如果他們可以免責 其他員工也就不會認真

and will go back to their old behaviors.

情況就不會改變

It's OK to talk about mistakes,

談論錯誤是可以的

but just like a teenager who violates the rules tells us about it,

但就像青少年自首犯錯

we appreciate that they told us about it,

我們讚許他的誠實

but there should still be some sort of consequences.

但處罰還是要有

Cybersecurity is a journey.

網路安全是一趟旅程

It's not a destination,

不是一個目的地

and we need to keep working on it.

我們要不停地努力

I would love for us to celebrate cybersecurity people

我想看到大家稱讚網路安全人員 就像在稱讚其他英雄一樣

like the heroes that they are.

If we think about it, they are firefighters,

你想想，他們是消防員

emergency room doctors and nurses,

急診室的醫護人員

law enforcement, risk executives and business strategists

執法單位、風險管理師、商業策略家

all in the same persona.

集於一身

And they help us protect our modern life that we like so much.

他們幫助我們 保護我們所熱愛的現代生活

They protect our identities, our inventions, our intellectual property,

保護我們的個資、發明和智慧財產權

our electric grid, medical devices,

還有電力網路、醫療設備

connected cars and myriad other things.

智慧汽車等數不盡的東西

And I'd like to be on that team.

我希望自己也是一員

So let's agree that this thing is with us to stay,

讓我們同意，這是我們都接受的

let's create a safe environment to learn from our mistakes,

讓我們從錯誤學習，建立安全的環境

and let's commit to making things better.

一起讓事情變得更好

Thank you.

謝謝