AWS Summit Stockholm 2025 - Cyber Hygiene: Lessons from Medical History for IT-Security

The Parable of Ignes Semovvice and the Dawn of Hygiene [02:11]

• In the 1840s, Dr. Ignes Semovvice observed a stark difference in mortality rates from childbed fever between doctors' and midwives' maternity wards, finding rates of 10-18% versus 3%.
• He hypothesized that doctors, who often went from performing autopsies to delivering babies without washing their hands, were unknowingly transferring deadly pathogens.
• An experiment involving mandatory handwashing with chlorinated lime solution drastically reduced mortality rates from 18% to 2%, and further improvements with instrument cleaning brought it down to 1%.
• Despite clear results, Semovvice faced massive resistance from the medical community for decades before handwashing became standard practice.

A simple act, washing your hands, had a profound life-saving impact.

From Medical Crisis to Digital Risk: The Ubiquity of Hygiene Issues [03:50]

• The speaker draws a parallel between Semovvice's struggle and the common excuses heard from cloud architects and product owners regarding basic security measures like patch management: "We don't have time," "It'll break something," "It's not our top priority."
• History shows that breakthroughs often come from mastering the basics, not just advanced technology.
• Today's complex cloud environments (AWS) present immense flexibility and speed but also introduce significant risk, with most breaches stemming from "hygiene problems" rather than elite hackers or advanced persistent threats.
• Digital environments, including cloud accounts, data centers, and SaaS platforms, are the modern equivalent of 19th-century hospitals—hotspots of opportunity and risk.

And just like in the 19th century hospitals, most of today's breaches are not caused by elite hackers or nation states attack or an advanced persistent threat or the newest Chinese zero day vulnerability. They are caused by hygiene problems.

The Equifax Breach: A Costly Lesson in Neglecting the Basics [06:17]

• The Equifax breach in 2017, a massive data breach exposing 143 million people's personal data, had an unpatched software vulnerability as its root cause.
• This was not a zero-day exploit or a sophisticated malware attack, but a known flaw with an available fix that the company failed to implement.
• The incident cost Equifax $1.38 billion, along with massive financial losses, regulatory fines, lawsuits, and a significant loss of consumer trust.
• This event exemplifies how neglecting basic cyber hygiene—specifically patching—can have catastrophic consequences.

For me, that's a digital equivalent of a doctor performing an autopsy and then going straight into another patient and doing surgery without washing their hands.

Defining and Implementing Core Cyber Hygiene Practices [08:09]

• Cyber hygiene involves daily routine practices to keep digital environments clean and secure, akin to personal hygiene for health.
• Key practices include patching vulnerabilities (which historically caused up to 44% of breaches, though this has decreased to around 20% in recent years), access control, segmentation, backups, and Multi-Factor Authentication (MFA).
• MFA alone can reduce account takeover by 99%.
• Training users to recognize phishing attempts, crucial with advanced AI-generated phishing emails, can cut success rates by 50%.
• Regular, trusted backups turn ransomware incidents into recovery exercises rather than crises, following principles like the 3-2-1 backup strategy (three copies, two media types, one offsite).
• Secure configurations, such as avoiding publicly accessible vSphere or open RDP ports, are also fundamental.

Patching, access control, segmentation, backup, MFA. These are simple practices but effective.

The Challenges and Costs of Cyber Hygiene Inertia [11:52]

• Despite the known benefits, organizations struggle with maintaining cyber hygiene due to complex IT environments spanning on-premise, multicloud, and legacy systems.
• Hesitation to invest in safe patching infrastructure (redundancy, rolling updates) stems from the perceived lack of immediate functionality, yet resilience itself is a competitive advantage.
• A cloud architect's reluctance to patch due to fear of downtime led to weeks of outage after a ransomware attack, demonstrating that the risk of not patching is often greater.
• Misconfigurations have become a major cause of breaches in the cloud era, highlighting the need for tools and processes to manage human error.
• Security fatigue—delaying updates, reusing passwords, skipping MFA—contributes to this inertia, mirroring the resistance Semovvice faced.

But resilience is functionality. And it's a competitive advantage to be able to patch without downtime, not a luxury.

The Business Case for Cyber Hygiene: Financial Impact and ROI [15:49]

• Cyber hygiene is not just smart from a security perspective but also from a business standpoint, as demonstrated by significant breach costs.
• IBM's global breach report pegs the average cost at $4.45 million, with examples like Uber ($148 million), Equifax ($1.38 billion), Maersk ($300 million), Merck ($870 million), and the City of Baltimore ($18 million) illustrating the financial devastation.
• Even credential stuffing attacks (23andMe, $30 million) and phishing (Marks & Spencer, $400 million+) incur substantial costs.
• It is cheaper to invest in cyber hygiene than to pay for the consequences of preventable breaches, framing these investments as risk mitigation protecting uptime, brand equity, and competitiveness.
• The cost of a single fatal traffic incident in Sweden (40.5 million kroners) led to societal investments in safer roads, demonstrating how societies prioritize mitigating expensive risks.

These are not theoretical numbers. These are receipts.

Quantifying Downtime and the Value of Resilience Investment [20:00]

• The main cost driver of breaches is system downtime, and organizations need to calculate the cost of their own downtime.
• A simplified AWS architecture example shows a resilience cost of approximately $6,000 per year for an RDS setup with dual availability zones, which is minimal compared to the potential cost of downtime.
• This resilience investment not only ensures infrastructure reliability but also enables zero-downtime patching, directly supporting cyber hygiene by removing the friction of patching disrupting operations.
• The cost of downtime for a small company with $100,000 annual revenue was calculated at $1,57 for a five-hour downtime event, underscoring the rapid accumulation of costs.
• The average recovery time for ransomware is three weeks, far exceeding the break-even point for resilience investments, highlighting the critical importance of proactive measures.

The kicker is the average recovery time for ransomware is three weeks.

Building a Systemic Approach to Cyber Hygiene: Culture Over Policy [26:14]

• Just as hospitals evolved from individual handwashing efforts to systematic, ingrained hygiene protocols with visual reminders and checklists, cyber hygiene needs to become systemic.
• Practices like sterile gloves (MFA), staff training, spare supplies (backups), and isolating infectious patients (segmentation, least privilege) have direct cyber hygiene parallels.
• Real-time telemetry monitoring network traffic is crucial for understanding the health of the IT environment, much like a heart monitor for a patient.
• Security must become everyone's job, not just for sock analysts, but for DevOps, HR, finance, interns, and executives.
• A security culture where developers, finance teams, and executives engage proactively fosters shared responsibility, similar to the AWS shared responsibility model.
• The rapid shift to universal hand hygiene during COVID-19 demonstrates that cultural change for critical behaviors is achievable when the 'why' is understood and supported.

Security isn't a silo. It is a culture. and culture starts with education, expectation and encouragement.

The Path Forward: From Hopeful to Hygienic [32:17]

• Assessing cyber hygiene involves asking critical questions, such as knowing your critical assets, and moving beyond hopeful assumptions to honest self-assessment.
• Removing the stigma of breaches is essential for fostering a no-blame reporting culture where employees feel safe to report issues.
• From day one, employees must understand hygiene, its importance, and their role, transforming checklists into shared responsibility.
• Tools like Windows Server Update Service (2005) and Kubernetes rolling updates (2016) provide modern equivalents to soap and sinks, enabling better hygiene.
• The persistence of breaches due to unpatched vulnerabilities, even after tools are available, highlights the ongoing need to make cyber hygiene non-negotiable.

The basics work and mastering them will make you 90% more secure than most.

Actionable Takeaways and the Cloud Health Check Offer [38:47]

• Key takeaways include treating cyber hygiene like handwashing—an ongoing, cultural imperative, not a one-time checklist.
• Essential practices like patching, MFA, training, backups, and access restriction must be done consistently and everywhere.
• Contextualized visibility into the IT estate is crucial for effective cyber hygiene.
• The presentation concludes by inviting attendees to Trend Micro's booth for a sponsored cloud health check, using their cyber risk exposure tool to assess cloud environments, uncover misconfigurations, and provide a roadmap for prioritizing hygiene gaps.

Swing by our booth, bring your questions and uh let's have a conversation about how we might help you make your cyber hygiene second nature for your cloud environment.