Session 7: Human security¶
“AI (Claude) has been used to provide answers to simple questions like “What is .., what does.. what are the risks..”. All demos are my own”
What, in your own words, is ‘cyber resilience’ and how is it different than ‘protection’ or ’security’?¶
Protection = keeping the bad guys out
(Cyber)security = Confidentiality + Integrity + Availability
- Confidentiality = keeping data private and accessible only to authorized people
- Integrity = making sure data isn’t tampered with or corrupted
- Availability = ensuring systems and data are accessible when needed
(Cyber)resilience = assume the bad guys will get in and have a plan to minimize damage and restore operations
What is one thing you can do to build cyber resilience?¶
Enable multi-factor authentication (MFA). Even if a password gets stolen or guessed, an attacker still can’t get in without the second factor (a code from your phone, a fingerprint, a hardware key, etc.)
What might get in the way of building cyber resilience?¶
Alert fatigue — too many warnings, pop-ups, or security prompts can cause people to start ignoring them, including legitimate ones.
One of my customer is very strict on MFA rules and I have to confirm a code on my phone multiple times on a daily basis. When you are in the middle of an important and urgent task, it’s tempting to pay less attention to the process..
A cybersecurity culture is defined as the “values, attitudes and beliefs that drive cyber-resilient behaviors”. The culture is created by managerial mechanisms like reward systems, consequences, leadership, priorities, performance evaluation, and more.¶
What are 2-3 behaviors you would like to see the people do to help the organization be cyber secure?¶
-
Behaviour #1 : As soon as something feels off, verify through a separate channel (call the person directly, don’t reply to the email) before acting
-
Behaviour #2 : If someone thinks they clicked something bad, notices a strange system behavior, or even just isn’t sure — they should report it right away rather than staying quiet out of embarrassment or fear of getting in trouble
-
Behaviour #3 : At the executive level, play with the same rules as for the employees. No shortcuts.
What are the values, attitudes and beliefs that would drive these behaviors?¶
-
Behaviour #1 : self-efficacy, threat awareness
-
Behaviour #2 : teamwork, collaboration with IT
-
Behaviour #3 : top management participation
What are the mechanisms you can employ to create the values, attitudes and beliefs?¶
-
Self-efficacy : identify enthusiastic people in each team/department as informal “security champions” who model good behavior and answer quick questions
-
Threat awareness : share stories on what happened elsewhere (no drama, not to much techno, just state the facts)
-
Collaboration with IT : the more you collaborate with IT = the more they collaborate with you
-
Top management participation : be visible, be involved in trainings, repeat the message over and over
What are your top 2 security concerns or vulnerabilities from the use of GenAI tools (ChatGPT, Claude, etc)?¶
Data/IP leakage through prompts and training exposure
People often paste sensitive information — proprietary code, customer data, internal strategy documents, personal identifiable information (PII) — directly into GenAI tools without thinking about where that data goes
Overtrust in AI-generated output (hallucinations and manipulation)
GenAI tools can produce confident-sounding but incorrect, biased, or fabricated information (“hallucinations”) — and people increasingly treat AI output as authoritative without verifying it. Bad code, flawed analysis, or wrong facts get shipped because no one double-checked
For each concern, explain why this is a concern? Provide a short example to illustrate the risk you see. Be as specific as possible.¶
Data/IP leakage through prompts and training exposure
One of customers design and manufacture test equipments for the telecom industry. For some products, the casing can be copied, the electronics is not that complex, the user interface is comparable to others but there are special signal processing routines nobody can easily reproduce. It takes years of field experience to create those routines. But, that’s just C/C++ code, isn’t it ? What if a developper copy-paste “just a class to refactor…” ? Then, you IP is gone…
Overtrust in AI-generated output (hallucinations)
It happened to me when I asked a question about the (legal) types of corporations. The intent was to select the best fit for our new company. The answer generated was not wrong by itself but did not take into account the juridictions. Some do not exist in all countries, states or provinces. At first sight, the answer was well structured and the AI was highly confident.
What behavior(s) would minimize the risk of a negative impact for this concern?¶
Data/IP leakage through prompts and training exposure
-
Enforce strict “No AI” policies for specific and limited pieces of code. Limit who can read those pieces of code in your source repo. Even a very basic header with “No AI allowed her” could help.
-
Make tools available and tell the developpers which one is company-approved and for what purpose. Don’t ever imagine you could block everybody and everything !
-
Remove sensitive/ client data before inputting it into AI
Overtrust in AI-generated output (hallucinations)
-
Learn how to prompt efficently. Context is paramount. In my example, juridictions are important, you should mention it in the prompt
-
Use pair-AI review. They don’t have the same pain points
What is a mechanism you can use to drive the values, attitudes, and beliefs that would encourage the behavior(s) you seek?¶
One strong mechanism: storytelling paired with social norming — using narrative and peer example to shape culture, rather than rules and mandates alone.
People don’t change behavior because a policy says so; they change because they believe the behavior matters and see it as “what people like me do.” Values and attitudes shift through identity and emotion, not just information.