Class 6 Human Security
Cybersecurity Reflection¶
*I have used AI assisted tasks, Gemini and Claude to get the answers.
Task 1: Cyber Resilience vs. Protection & Security What’s the difference?
If I had to put it in my own words: security is about keeping the bad guys out, and resilience is about what happens after they get in anyway. A security-first mindset is basically “build a better wall.” Resilience assumes the wall will eventually fail and asks a different question: how fast can we notice, contain the damage, keep the lights on, and get back to normal? It’s less about prevention and more about not falling apart when prevention doesn’t work.
a. One thing that would help build resilience Automated, offline backups that are actually tested, not just set and forgotten. It’s not enough to have backups sitting somewhere — someone needs to regularly try restoring from them, because a backup nobody has ever restored is basically a guess. If ransomware locks up the network, prevention has already failed at that point. What matters is whether there’s a clean, air-gapped copy of everything that the malware never touched, so the organization can recover without paying anyone a cent.
b. What gets in the way ● Prevention bias. A lot of organizations spend a fortune on firewalls and endpoint protection and then quietly assume that’s the whole job done. That confidence tends to starve the less glamorous stuff — incident response plans, continuity testing, tabletop exercises — of budget and attention.
● Silos. Recovering from a real incident means IT, legal, HR, communications, and leadership all pulling in the same direction at the same time. If those teams barely talk on a normal Tuesday, they’re not suddenly going to coordinate well at 2am during a breach.
c. Why resilience actually addresses the human element People are going to make mistakes — someone will eventually click the well-crafted phishing link or misconfigure a database, no matter how much training happens. That’s not pessimism, it’s just realistic. Resilience doesn’t pretend this won’t happen; it plans around it. Things like least-privilege access and network segmentation exist so that one person’s bad click costs you a single compromised laptop, not the entire company.
Task 2: Building a Cybersecurity Culture a. Behaviors worth encouraging ● Reporting things quickly and honestly — a weird email, a strange pop-up, even a mistake someone made themselves — without worrying they’ll get in trouble for it. ● Slowing down before acting on anything unexpected, especially money-related requests. Verifying through a separate channel — calling a known number rather than replying to the email — before wiring funds, changing payment details, or handing over credentials.
b. What has to be true for people to actually do that None of that happens automatically. People need to genuinely feel safe admitting a mistake — that reporting a mis-click gets a “thanks for flagging it” instead of a write-up. They need a baseline of healthy suspicion toward anything that feels urgent or out of place (“the CEO needs gift cards right now” should set off alarm bells, not urgency). And underneath both of those, they need to actually believe their own vigilance matters — that noticing something small genuinely protects coworkers and customers, rather than being a box-ticking exercise that IT handles anyway.
c. How you’d actually build that ● Make self-reporting low-stakes, or even rewarded. If someone clicks a phishing link and tells security within the hour, that should be treated as a win, not a failure — a quick shout-out beats a disciplinary note.
● Ditch the 45-minute compliance slideshow. Run phishing simulations that feel more like a game — people who catch the fake get recognized, and people who fall for it get a friendly one-minute explainer instead of a lecture.
● Have leadership go first. When an executive openly talks about the time they almost fell for something, it does more for culture than any policy memo, because it signals that even the people at the top aren’t above making mistakes.
Task 3: Human-Centric Security Concerns with Generative AI
Concern 1 — Sensitive data ending up in a public AI tool
People use GenAI to move faster — summarizing a meeting, cleaning up a draft, debugging a snippet of code. The catch is that a lot of public models can retain what’s typed into them, and that data isn’t necessarily gone once the chat window closes. Paste in source code, a customer record, or an unfinished financial report, and there’s a real chance that information persists somewhere outside the company’s control.
What would reduce the risk: Getting into the habit of stripping out names, numbers, and anything proprietary before hitting send — or better, only using an enterprise AI tool where the contract guarantees the data isn’t used for training.
How you’d drive that: A mix of policy and technology, because policy alone rarely holds. A browser extension or proxy that catches obvious PII or confidential-looking text before it reaches a public AI site, paired with a quick pop-up explaining why — not just a block, but a one-line reason people can actually learn from.
Concern 2 — AI-generated phishing and voice cloning Generative AI has quietly removed most of the old tells of a scam. Bad grammar, awkward phrasing, a robotic voice on a call — those used to be the giveaways, and now they’re mostly gone. A convincing, well-written email takes seconds to generate, and a voice clone needs only a few seconds of someone’s real audio to sound believable.
What would reduce the risk: Treating any sensitive request — a wire transfer, a password reset, a change to payment details — as unverified until it’s confirmed through a second, independent channel. That usually just means a phone call to a number that was saved beforehand, not one provided in the suspicious message itself.
How you’d drive that: Let people experience it rather than just hear about it. A tabletop exercise where a team walks through a realistic, AI-generated voice-cloning scam tends to do more than any slide ever could — once someone sees how convincing this stuff actually is, “I’d never fall for that” tends to disappear pretty fast, and the habit of double-checking starts to feel less like a rule and more like common sense.