Skip to content

Session 06: Human Security

Assignment(s)

Answer the prompted questions.

Questions and Responses

1. What, in your own words, is ‘cyber resilience’ and how is it different than ‘protection’ or ’security’?

Cyber resilience is separate from protection and security in the sense that it focuses on efficient recovery and minimizing damage caused to a system, rather than just designing mechanisms that defend against attackers or prevent security breaches. It operates on the assumption that attackers can breach the existing defenses and is always acclimating to new threats to ensure that an organization can return to an equivalent or improved performance level.

1a. What is one thing you can do to build cyber resilience?

Improving workforce culture (e.g., developing training models that teach employees how to effectively detect and avoid phishing emails) can build cyber resilience. Dr. Pearlson explained in her lecture a causal chain for building culture around cyber resilience: external influences and managerial mechanisms can help push an organization-wide cultural change.

1b. What might get in the way of building cyber resilience?

Human error is a significant obstacle to building cyber resilience. People use weak passwords, fall for phishing scams, and often do not understand the importance of cybersecurity in the workspace.

1c. Why is cyber resilience an effective response to human-centric vulnerabilities?

Cyber resilience builds cybersecurity literacy and awareness on an organizational level, holding individual employees more accountable for their potentially careless behavior. By driving the beliefs, values, and actions of cyber resilience, humans can prevent becoming a common entry point for cybersecurity tasks–thus eliminating a lot of the human-centric vulnerabilities.

2. A cybersecurity culture is defined as the “values, attitudes and beliefs that drive cyber-resilient behaviors”. The culture is created by managerial mechanisms like governance mechanisms, reward systems, consequences, leadership, priorities, performance evaluation, and more.

2a. What are 2-3 behaviors you would like to see the people do to help the organization be cyber secure?

  • Being aware of the indicators of phishing emails and being comfortable reporting unusual/suspicious behavior

  • Deliberately choosing passwords that are stronger and securely storing them

  • Being mindful of sharing other personal details and/or confidential information about the organization to disguised bad actors

2b. What are the values, attitudes and beliefs that would drive these behaviors?

The belief that “cybersecurity is part of everyone’s job” can support individual responsibility and ability to detect/prevent vulnerabilities; this also shifts some weight off the IT team, which cannot combat all of the potential human-centric vulnerabilities.

2c. What are the mechanisms you can employ to create the values, attitudes and beliefs?

Performance evaluation, reward/punishment systems (I recall Dr. Pearlson talking about how employees who weren’t able to complete multiple cyber drill satisfactorily were fired), the designation of a cultural leader, and communication plans are all effective mechanisms that create these values, attitudes, and beliefs of cyber resilience. These mechanisms consistently out-perform a simple annual compliance training.

3 .What do you consider the top 2 human-centric security concerns or vulnerabilities from the use of GenAI tools (ChatGPT, Claude, etc)?

  • Carelessly inputting sensitive information that might become an entry point for a data breach and thus compromise security–this is caused by a false belief that the conversations between a user and GenAI remain strictly private and do not enter the public domain.

  • Trusting GenAI’s outputs without question: according to the Stanford Index on AI, GenAI, while it hallucinates less for simple/everyday prompts, it can still produce false information as prompts become more complex and obscure. Hallucination rates across 26 different LLMs (including Grok, Claude 4.5 Haiku, MiMo-V2-Pro, etc.) ranged from 22% to a whopping 94%.

3a. For each concern, explain why this is a concern? Provide a short example to illustrate the risk you see. Be as specific as possible.

  • Sensitive intellectual property, organizational secrets, and other confidential information can be leaked to the public unknowingly once fed to GenAI.

  • Misinformation and disinformation skew production outcomes and potentially perpetuate harmful biases (e.g., racial, gender-related, etc.).

3b. What behavior(s) would minimize the risk of a negative impact for this concern?

Through the aforementioned managerial mechanisms, organizations can push the behavior of treating AI as an assistant, not a crutch. When GenAI is used with accountability and awareness, employees become more in touch with the information they insert in their prompts; on the flip-side, they learn to differentiate truth from hallucination in GenAI’s outputs.

3c. What is a mechanism you can use to drive the values, attitudes, and beliefs that would encourage the behavior(s) you seek?

Implementing AI governance policies: organizations and not only put explicit bans on inputting client information, trade secrets, or proprietary software into public models, and they can also mandate that human employees review and sign-off on all AI-generated content, rather than blindly accepting its usage.