# 219: Not Obviously Negligent

- Show: [Embedded.fm](https://hardwarepodcasts.com/podcast/embedded-fm)
- Published: 2017-10-12
- Length: 1h 14m
- Episode: 219
- Page: https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent
- Listen: https://makingembeddedsystems.libsyn.com/219-not-obviously-negligent

## Summary

Kelly Shortridge, a Product Manager at SecurityScorecard, discusses the intersection of behavioral economics and information security, arguing that human cognitive biases drive many security failures. She explains how defenders often focus on complex, high-value threats while ignoring 'low hanging fruit' like unpatched servers or default passwords, a phenomenon she links to prospect theory and risk aversion. Shortridge advocates for 'resilience' over static hardening, suggesting strategies like Chaos Monkey, deception technology, and raising the cost for attackers through basic hygiene like 2FA and password managers. She emphasizes that security must be designed with usability in mind to overcome user inertia and cognitive load, moving the industry from a state of 'depression' to 'acceptance' by making security habits easier to maintain.

## Chapters

- [0:06](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=6) Introduction: Kelly Shortridge and SecurityScorecard
- [1:23](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=83) Lightning Round: Books, Passwords, and Game Theory
- [7:55](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=475) Defining Security Expertise and Behavioral Economics
- [10:27](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=627) Convincing Engineers: Business Value and Low Hanging Fruit
- [12:21](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=741) The Equifax Breach and the Cost of Inaction
- [17:56](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=1076) Resilience, Grief, and Moving Beyond Hardening
- [23:15](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=1395) Chaos Monkey, Deception, and Spooking Attackers
- [32:19](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=1939) Securing IoT Devices and Avoiding Wired Magazine Covers
- [36:46](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=2206) Usability: Password Managers, 2FA, and PGP
- [43:02](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=2582) Building Resilient Systems and Asset Management
- [49:44](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=2984) Keeping Up with Security News and Twitter
- [54:04](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=3244) Behavioral Economics: Choice, Bias, and Empathy
- [1:04:33](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=3873) Gamification and Behavioral Design in Security
- [1:06:02](https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent#t=3962) Listener Questions: IoT, Medical Devices, and BLE

## Topics

- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Embedded firmware](https://hardwarepodcasts.com/topic/embedded-firmware)
- [Connected products & IoT](https://hardwarepodcasts.com/topic/connected-products-and-iot)
- [AI & machine learning](https://hardwarepodcasts.com/topic/ai-and-machine-learning)

## Most relevant to

early-stage companies

## Mentioned

- SecurityScorecard (company)
- Thinking Fast and Slow (other)
- What Works (other)
- Equifax (company)
- Chaos Monkey (other)
- Netflix (company)
- VeraCrypt (product)
- Kaspersky (company)
- Signal (product)
- PGP (other)

## Related episodes from other shows

- [Common Cybersecurity Threats and What to Do about Them with Dana Mantilia](https://hardwarepodcasts.com/podcast/manufacturing-happy-hour/2021-11-09-common-cybersecurity-threats-and-what-to-do-about-them-with-dana-mantilia) (Manufacturing Happy Hour)
- [Approaching Cybersecurity & Usability as a SaMD Company](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-05-28-approaching-cybersecurity-usability-as-a-samd-company) (Global Medical Device Podcast)
- [011 - Making Too Many Assumptions](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2018-06-03-011-making-too-many-assumptions) (Unnamed Reverse Engineering Podcast)
- [Cybersecurity, Startups, and Examining Unconscious Bias with Galina Antova](https://hardwarepodcasts.com/podcast/manufacturing-happy-hour/2020-06-30-cybersecurity-startups-and-examining-unconscious-bias-with-galina-antova) (Manufacturing Happy Hour)
- [118: Behavioral Science of Subtraction in Product Design](https://hardwarepodcasts.com/podcast/product-startup/2022-03-16-118-behavioral-science-of-subtraction-in-product-design) (Product Startup)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/embedded-fm/2017-10-12-219-not-obviously-negligent. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Embedded.fm.