Security Trek: The Next Generation

The speaker looks back at the early days of public security outreach, when mainstream audiences had little understanding of information security or privacy. Awareness has improved since then, the argument goes, but the next challenge is turning that concern into concrete protective action. Small organizations often cannot afford in-house security staff, and graduates with security degrees frequently struggle to land jobs without practical experience.

The central message is that security depends more on process than on products. The speaker advises listeners to judge vendors by whether they focus on investor growth rather than customers, and suggests calling a vendor's sales team with technical questions to see whether anyone knowledgeable answers. Generic awareness training that covers outdated attacks is criticized, and the talk pushes back on the misconception that open source means exposed data. Star Trek episodes serve as analogies for explaining incidents to lay people.

The talk then describes a volunteer program that refurbishes donated computers, installs a Linux Mint build configured to CIS controls, and teaches students and their parents about privacy and security, while giving volunteers real-world experience. The speaker notes that Nevada recognized CIS controls as a definition of reasonable security, and recommends that listeners use that reference to justify process-focused spending to management.