The following podcast contains advertising.

To access an ad-free version of the LawFair podcast,

become a material supporter of LawFair at patreon.com slash law fair.

That's patreon.com slash law fair.

Also, check out LawFair's other podcast offerings,

rational security, chatter, law fair no bull, and the aftermath.

So some of our users, for example, say, well, I'm not a target.

Nobody's going to care about what I'm doing because I'm just the librarian.

Or I don't work on anything that would be interesting to these foreign governments.

But the task is that all they care about is how they get in.

And once they get in, even if it's through an admin assistant to or an accountant's desktop,

then they look to move laterally throughout the network.

So it's not enough to just secure certain accounts or certain servers.

We have to lock down and protect everything as much as we possibly can.

And then there's the task of end user communication and education.

By far, the easiest way for an outside actor to get in is through a fishing email.

Somebody is in a hurry and clicks on something without thinking about whether it completely makes sense

or without inspecting the information about the email to see if it's legitimate.

And then software can be downloaded onto their computer from a website or something without being any the wiser.

I'm Cody Poplin, and this is a law fair podcast October 10, 2015.

That was Helen Mormon, the Chief Information Officer at the Brookings Institution,

discussing the difficulties of securing a large public-facing organization from a vast array of cyber-attacks.

...