Homework 06

  1. What is Cyber Resilience and how is it different from Protection or Security?

Cyber resilience is an organization’s ability to prepare for, respond to, recover from, and continue operating during and after a cyberattack or security incident.

It recognizes that no system is completely safe, so the focus is on minimizing damage and recovering quickly.

Cyber protection or cybersecurity mainly focuses on preventing attacks by using tools such as firewalls, antivirus software, encryption, and access controls.

Protection tries to stop threats before they happen, whereas cyber resilience assumes that attacks may still succeed and ensures the organization can recover with minimal disruption.

a. One thing I can do to build cyber resilience

I can regularly back up important files and test that the backups can be restored. This ensures that even if data is lost because of ransomware or accidental deletion, it can be recovered quickly.

b. What might get in the way of building cyber resilience?

Some common obstacles include:

  • Lack of cybersecurity awareness and training.
  • Limited budget or resources.
  • Employees ignoring security policies for convenience.
  • Outdated software and systems.
  • Poor communication during security incidents.

c. Why is cyber resilience an effective response to human-centric vulnerabilities?

Many cyberattacks succeed because of human mistakes such as clicking phishing emails, using weak passwords, or accidentally sharing sensitive information.

Cyber resilience accepts that people can make mistakes and focuses on reducing the impact through backups, incident response plans, employee training, and quick recovery processes.

2.* Building a Cybersecurity Culture*

A cybersecurity culture encourages everyone in an organization to take responsibility for protecting information and systems.

a. 2–3 behaviors people should demonstrate * Report suspicious emails or activities immediately. * Use strong, unique passwords and enable multi-factor authentication (MFA). * Follow organizational security policies and complete cybersecurity training regularly.

b. Values, attitudes, and beliefs that support these behaviors * Everyone is responsible for cybersecurity. * Protecting company data protects customers and the organization. * Reporting mistakes early is better than hiding them. * Continuous learning helps defend against new cyber threats.

c. Mechanisms to create these values and attitudes

Organizations can encourage good security behavior by:

  • Providing regular cybersecurity awareness training.
  • Rewarding employees who report phishing attempts or security issues.
  • Having leadership demonstrate good cybersecurity practices.
  • Including cybersecurity responsibilities in employee performance evaluations.

  • Conducting phishing simulations and providing constructive feedback.

  • Human-Centric Security Concerns with Generative AI (ChatGPT, Claude, etc.)

Concern 1: Sharing Confidential Information with AI

a. Why is this a concern?

Employees may copy confidential information such as customer records, passwords, financial reports, or source code into AI tools to get assistance. This may expose sensitive information if organizational policies are not followed.

Example:

An employee pastes confidential financial statements into ChatGPT and asks it to summarize the report. This could violate company confidentiality policies.

b. Behaviors that minimize the risk

  • Never enter confidential or personal information into public AI tools.
  • Remove sensitive information before using AI.
  • Use only organization-approved AI systems.

c. Mechanism to encourage good behavior

  • Establish a clear AI usage policy.
  • Provide AI awareness training.
  • Require employees to complete AI security training before using AI tools.
  • Conduct regular reminders about handling sensitive data.

Concern 2: Trusting AI Responses Without Verification

a. Why is this a concern?

AI systems sometimes produce incorrect or misleading information (known as “hallucinations”). If employees accept AI-generated answers without checking them, poor decisions or security problems may result.

Example:

A software developer asks AI to generate authentication code and copies it directly into an application without reviewing it. The generated code contains security weaknesses that attackers later exploit.

b. Behaviors that minimize the risk

  • Always verify AI-generated information using trusted sources.
  • Review AI-generated code before deployment.
  • Treat AI as an assistant, not as the final decision-maker.

c. Mechanism to encourage these behaviors

  • Require peer review for AI-generated work.
  • Create policies requiring verification before implementation.
  • Include AI verification procedures in development and business workflows.
  • Train employees on the limitations of AI systems.