Skip to content

1. What, in your own words, is cyber resilience and how is it different from protection or security?

In my understanding, cyber resilience means being ready for cyberattacks and knowing how to respond and recover if one happens. It is about making sure that work can continue even after a security incident. To me, cyber protection or cybersecurity is mainly about preventing attacks by using tools such as strong passwords, antivirus software, firewalls, and encryption. Cyber resilience is different because it also focuses on recovering quickly and reducing the impact if an attack is successful. In other words, cybersecurity tries to stop attacks, while cyber resilience helps an organization continue operating and recover when prevention is not enough.

a. What is one thing you can do to build cyber resilience?

One effective way to build cyber resilience is to regularly back up important data and test the backups. This ensures that information can be restored quickly after ransomware attacks, hardware failures, or accidental deletion.

b. What might get in the way of building cyber resilience?

Limited budgets, lack of employee awareness, outdated technology, lack of knowledge, and resistance to following security policies can make it difficult to build cyber resilience. Organizations may also underestimate cyber risks until an incident occurs.

c. Why is cyber resilience an effective response to human-centric vulnerabilities?

Many cyber incidents result from human mistakes such as clicking phishing links, using weak passwords, or accidentally sharing confidential information. Since people will occasionally make errors, cyber resilience focuses on minimizing damage, detecting incidents quickly, and recovering efficiently instead of relying solely on perfect human behavior.

2. Cybersecurity Culture

a. What are 2–3 behaviors you would like to see people do to help the organization be cyber secure?

Some of the methods can be: - Report/avoid suspicious emails, websites, or messages immediately. - Use strong, unique passwords and enable multi-factor authentication (MFA). - Follow data handling policies and avoid sharing confidential information through unauthorized tools.

b. What are the values, attitudes, and beliefs that would drive these behaviors?

  • Personal responsibility for protecting organizational information/personal information
  • Belief that cybersecurity is everyone’s responsibility, not just the IT department’s.
  • Openness to reporting mistakes without fear of punishment.
  • commitment to continuous learning about cyber threats and putting into use.

c. What mechanisms can you employ to create these values, attitudes, and beliefs?

Through: - Regular cybersecurity awareness training through early learning. - Simulated phishing exercises. - Strong leadership that models secure behavior. - Clear policies with fair consequences for repeated unsafe actions. - Regular communication about emerging cyber threats and lessons learned.

3. Top Two Human-Centric Security Concerns from GenAI Tools

Concern 1: Accidental disclosure of confidential information

a. Why is this a concern? Employees may unknowingly enter sensitive information such as customer records, passwords, financial data, source code, or business strategies into public AI tools. Depending on the organization’s policies and the AI service used, this information could be stored or processed externally, increasing the risk of data exposure. Example: A software developer copies proprietary source code; lets say from dell OS into ChatGPT to debug an error. This exposes confidential intellectual property outside the organization’s approved systems. b. How to minimize this risk? - Never enter confidential, personal, or proprietary information into public AI tools. - Use only organization-approved AI platforms. - Remove or anonymize sensitive information before using AI. c. What mechanism can encourage these behaviors? Implement a clear AI usage policy, provide regular employee training on responsible AI use, and display reminders within AI tools explaining what information should never be shared.

Concern 2: Overreliance on AI-generated information

a. Why is this a concern? Generative AI can produce incorrect, outdated, or fabricated information that appears convincing. Employees who accept AI responses without verification may make poor decisions, introduce security vulnerabilities, or spread misinformation since AI generates information base on input values but not on how event occurs in real life. Example: A system administrator asks an AI tool how to configure a firewall and follows the instructions without verification. The AI-generated configuration accidentally leaves important network ports exposed, creating a security risk or asking about students detail with few inputs may not provide actual detain about the students.

b. How to minimize this risk? - Verify AI-generated information using trusted organizational policies or official documentation. - Treat AI as a support tool rather than a final authority. - Seek expert review before implementing important technical or business decisions.

c. What mechanism can encourage these behaviors? - Provide AI literacy training that teaches employees how to evaluate AI responses critically. - Include AI verification as part of standard operating procedures and encourage managers to recognize careful verification rather than simply rewarding speed.