355: Eric O'Neill – Hackers Don't Break In, They Log In: Trust as the New Perimeter

Today, Steve is joined by former FBI agent Eric O’Neill. Eric is a cyber security expert and author, but he’s probably most well-known as the man who brought down Peter Hanssen, a Russian spy who became one of the most notorious double agents in the history of US intelligence. Steve and Eric discuss cyber preparedness in today’s business world, insider threats, and cyber resilience in a rapidly changing world.  **Key Takeaways:** 1. Cybercrime is a trillion-dollar business and businesses would be wise to make defending against it a top priority. 2. A business’ information should be segmented, with no one person having access to everything. 3. Deepfakes will increasingly be used to influence employees, businesses, and voters. **Tune in to hear more about:** 1. Building a culture of cyber vigilance (**5:46**) 2. The insider threat (**8:44**) 3. Eric’s PAID strategy (**20:47**) **Standout Quotes:** 1. “What most corporations and companies must worry about critically, it should be at the top of their risk portfolio, is cybercrime, which is the fastest-growing business on Earth.” - Eric O’Neill 2. “Every single person in IT that is a systems administrator, who can elevate privileges, who can create accounts, who can reset passwords, those tend to be the most targeted individuals in an organization, and the accounts, the individuals, the roles that attackers most want to compromise.” - Eric O’Neill 3. "Attackers don't care who you are, they don't care what you do, they don't care whether you're big or small. They only care whether you're vulnerable. And if you are vulnerable, you will be attacked by a cyber criminal group, and if you don't prepare ahead of the attack, then you'll be a victim.” Eric O’Neill **Read** the transcript of this episode **Subscribe** to the ISF Podcast wherever you listen to podcasts **Connect** with us on LinkedIn and Twitter *From the* Information Security Forum*, the leading authority on cyber, information security, and risk management.*