Session 6: Human Security¶

The Setup¶

Meet Alex — a student at a tech company doing an internship.
Meet Eve — an attacker. Eve never touches a single line of code.
Eve only needs one thing: a human who makes a bad decision.

Story 1: The Phishing Attack¶

Eve sends an email:

  From: IT-Support@c0mpany.com
  Subject: Urgent — your account will be suspended

  Click here to verify your credentials → [link]

Alex is busy. The email looks real. Alex clicks.

  Alex types:  username / password

  Eve receives: username / password ✓

Eve is in. No hacking needed.

Why did this work?¶

Alex was not stupid — Alex was busy and distracted
The email created urgency (“urgent”, “suspended”)
Humans are wired to respond to authority and fear

What is the fix?¶

Pause before clicking — even 5 seconds helps
Hover over links before clicking — does the URL look right?
Report suspicious emails — don’t just delete them

Story 2: The AI Mistake¶

Alex wants to finish a report fast. Alex opens ChatGPT and pastes:

  "Here are our Q3 customer sales figures: [full spreadsheet]
   Please summarize this for the board."

ChatGPT helps. Report is done in 2 minutes.

But now:

  Customer names ──────────────────► Third-party server
  Contract values ─────────────────► Third-party server
  Internal financials ─────────────► Third-party server

The data left the building. Nobody noticed.

This is called Shadow AI — using AI tools that IT never approved.

And then…¶

A week later Alex asks the AI:

“Is this email attachment safe to open?”

AI says: “Yes, it looks like a standard PDF.”

Alex opens it. It was malware.

AI hallucinated. It had no way to actually check the file.

  Alex trusted AI  ──► made a bad decision  ──► breach

Story 3: The Resilience Test¶

The company gets hit. Ransomware encrypts everything.

Company A — no plan:

  Attack happens
       │
       ▼
  Panic. Who do we call? 
  Where are the backups?
  Do we tell customers?
       │
       ▼
  3 weeks to recover. Reputation destroyed.

Company B — resilient:

  Attack happens
       │
       ▼
  Incident response team activates (practiced this 3x)
  Backups restored in 6 hours
  Customers notified within 24h
       │
       ▼
  Back to normal in 2 days.

Same attack. Completely different outcome.

The difference: Company B ran tabletop exercises — fake attack simulations — before the real one hit.

Story 4: Culture is Not a Poster on the Wall¶

Company C puts up a sign:

  ╔══════════════════════════════╗
  ║  CYBERSECURITY IS EVERYONE'S ║
  ║         RESPONSIBILITY       ║
  ╚══════════════════════════════╝

Then the CEO forwards a phishing email to the whole team without checking it.

Nobody reports suspicious emails because last time someone did, they got blamed.

The poster means nothing. The behavior of leaders is the culture.

Company D: - CEO personally reports phishing emails to IT → team follows - Employees who report mistakes are thanked, not punished - Security is in every team’s goals, not just IT’s

  Leader behavior  ──►  team beliefs  ──►  everyday actions

That is a cybersecurity culture.

The Big Picture¶

  Traditional security mindset:

  [Attacker] ──X──► [Firewall] ──X──► [Safe]


  Reality:

  [Attacker] ──X──► [Firewall] ──✓──► [Human] ──► [Breach]

The human is always in the loop.
The goal is not to remove humans — it is to make them the last line of defense that actually holds.

Key Points¶

Attackers exploit people, not just systems
Resilience = survive the attack, not just prevent it
Culture = what people actually do, not what the policy says
AI tools leak data silently and make mistakes confidently

AI Assistance¶

I used Claude AI (claude-sonnet-4-6) to structure this session based on the MIT lecture by Dr. Keri Pearlson (July 9, 2026). I provided the lecture slides and homework questions and asked for a scenario-based storytelling format suitable for high school students. All concepts are from the lecture.