(TL04) (INCYBER) Youna CHOSSE-BENTABED

Value of the Information & Strength of the Argument

The talk provides valuable insights into the human aspects of cybersecurity, offering a clear explanation of social engineering techniques and their psychological underpinnings. The speaker effectively uses real-world examples, such as the deepfake fraud and the dress illusion, to illustrate complex concepts. The argumentation is persuasive, emphasizing the need to shift from a negative security posture (fear of clicking) to a positive one (ability to respond). However, the talk is largely based on the speaker’s expertise and anecdotal evidence, with limited rigorous scientific backing. The practical demonstration of an attack is compelling but could benefit from more detailed mitigation strategies.

Scientific Rigor, Source Quality, Title Accuracy

The speaker references established frameworks like Kahneman’s dual-system theory and Cialdini’s principles, which are well-known in psychology and persuasion literature. She also mentions the MICE framework used by intelligence agencies. However, specific sources for statistics (e.g., 80% of breaches involve human factor, 180 days to detect) are not cited. The title is minimal and does not convey the content’s depth, but it is not misleading. The talk is an expert opinion rather than a peer-reviewed presentation, so the scientific rigor is moderate. The description provides links to the INCYBER forum and LinkedIn, which are relevant but not direct sources for the claims made.

The title is minimal, only indicating the speaker's name and event, but the content matches the expected topic of cybersecurity and human factors.

7/10

The speaker demonstrates practical expertise in social engineering and human risk management, with concrete examples and references to established frameworks (Cialdini, Kahneman). However, some claims lack precise citations and the presentation is largely anecdotal.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 00:00Introduction: the human factor in cybersecurity, the 200,000-year gap between stone tools and modern technology, and the exploitation of slow human evolution.
• 01:00Interactive demonstration with the dress illusion to illustrate how attackers create narratives we believe.
• 02:00Case study: the Hong Kong deepfake fraud where a finance director transferred $25 million.
• 03:00Statistics: over 80% of breaches involve the human factor, and it takes about 180 days to detect an intrusion.
• 04:00Definition of social engineering and the role of cognitive biases (urgency, authority, reciprocity).
• 05:00Introduction of MICE and Cialdini's principles of persuasion.
• 06:00Target profiling: employees, subcontractors, and executives (HVTs).
• 07:00Human kill chain: reconnaissance, targeting, vulnerability analysis, and exploitation.
• 08:00Practical demonstration: OSINT, domain squatting, and credential harvesting.
• 09:00Discussion on data leaks and their exploitation for physical attacks (e.g., kidnappings).
• 10:00Human risk management: from compliance to maturity, and the maturity staircase (awareness, visibility, capability, resilience).
• 11:00Impact of AI: industrialization of threats, realism, and the inability to trust what we see or hear.
• 12:00Conclusion: positive security culture vs. negative security, and the human as both problem and solution.
• 13:00Q&A: discussion on data leaks and mitigation strategies.

• INCYBER Forum Europe — Event website for the INCYBER Forum where the talk was given.
• INCYBER Forum Europe LinkedIn — LinkedIn page of the INCYBER Forum Europe.

• Verizon Data Breach Investigations Report — Annual report often cited for statistics on human factor in breaches.