Session 6: Human security¶
Questions¶
What, in your own words, is ‘cyber resilience’ and how is it different than ‘protection’ or ’security’? La cyber-résilience est la capacité d’une entreprise à prévenir, à résister et à se remettre des incidents de cybersécurité. La cyber-résilience est un concept qui rassemble la continuité des activités, la sécurité des systèmes d’information et la résilience organisationnelle. Elle décrit la capacité à continuer à produire les résultats escomptés malgré des cyber-événements compromettants, tels que des cyberattaques, des catastrophes naturelles ou des récessions économiques. Un niveau mesuré de compétence et de résilience en matière de sécurité de l’information influe sur la capacité d’une entreprise à poursuivre ses activités avec peu ou pas de temps d’arrêt. La cyber résilience implique la mise en place de mesures de prévention, de détection et de réponse aux incidents, ainsi que la planification de la reprise après le sinistre et la continuité des activités.
Cyber resilience is an organization’s ability to prevent, withstand, and recover from cybersecurity incidents. Cyber resilience is a concept that encompasses business continuity, information system security, and organizational resilience. It describes the ability to continue producing the expected results despite compromising cyber events, such as cyberattacks, natural disasters, or economic recessions. A moderate level of competence and resilience in information security affects a company’s ability to continue its operations with little or no downtime. Cyber resilience involves implementing measures for prevention, detection, and incident response, as well as disaster recovery and business continuity planning.
a. What is one thing you can do to build cyber resilience? * Integrate the concept inside the organization, from the technical chooses to the company culture
b. What might get in the way of building cyber resilience? * It’s complextiy to implement it. * The lack of engagement of the workers
c. Why is cyber resilience an effective response to human-centric vulnerabilities? * because Cyber security turns being a concern for all the people of an organization
A cybersecurity culture is defined as the “values, attitudes and beliefs that drive cyber-resilient behaviors”. The culture is created by managerial mechanisms like governance mechanisms, reward systems, consequences, leadership, priorities, performance evaluation, and more. a. What are 2-3 behaviors you would like to see the people do to help the organization be cyber secure? * Be careful with passwords * Be careful with emails/attachments/urls * Be aware ans collaborate when there are doubts
b. What are the values, attitudes and beliefs that would drive these behaviors?
- Knowledge of risks
- Active attitude to detect potential attacks mostly by emails (phishing, false emails for bank transfer)
-
That cyber attacks can be a big and serious problem
c. What are the mechanisms you can employ to create the values, attitudes and beliefs? * list of cyber attacks avoided thanks to each person in the organization who have detected it. The list include the name of the worker and can be spread to the whole organization and included in a thank you email sent by the director/manager/CEO. * Rewards
What do you consider the top 2 human-centric security concerns or vulnerabilities from the use of GenAI tools (ChatGPT, Claude, etc)? a. For each concern, explain why this is a concern? Provide a short example to illustrate the risk you see. Be as specific as possible. * privacy leaks (name, places, addresses, recognition of locations, artwork and original creations) * misinformation and content errors (for instance, in legal context, false law articles (article in NYT), or daily life for instance for health advises or travel advices (article in le Canard Enchaîné)
b. What behavior(s) would minimize the risk of a negative impact for this concern?
- limits by AI agent programmers and laws
-
disclaimers in the content generated for general users
c. What is a mechanism you can use to drive the values, attitudes, and beliefs that would encourage the behavior(s) you seek? * engagement with the company * valuable answer from the technical departament when something, like phishing email, is detected and forwarded by a worker from other department. * award when good behaviors are adopted