Human Security¶
1. Cyber Resilience¶
Cyber resilience means an organization’s ability to prepare for cyber threats, withstand an attack, continue its important activities, and recover quickly afterward. In simple words, security tries to stop something bad from happening, while resilience also prepares us for the possibility that something may get through.
For example, cybersecurity protection may involve antivirus software, firewalls, and strong passwords to prevent an attack. Cyber resilience goes a step further by asking: “What will we do if the attack succeeds?”
a. What is one thing you can do to build cyber resilience?¶
One important thing I can do is regularly back up important data and make sure that the backups can actually be restored. If files are deleted, corrupted, or encrypted by ransomware, a reliable backup can help us recover without losing everything.
b. What might get in the way of building cyber resilience?¶
One major obstacle is human behavior. People may ignore security rules, use weak passwords, click suspicious links, or fail to report mistakes because they are afraid of getting blamed. Lack of training, limited budgets, outdated systems, and poor management support can also make resilience difficult.
c. Why is cyber resilience an effective response to human-centric vulnerabilities?¶
Humans can make mistakes even when security systems are strong. Someone may accidentally open a phishing email, share sensitive information, or use an unsafe USB drive. Cyber resilience recognizes that mistakes cannot always be completely eliminated. Instead, it focuses on reducing the damage, detecting problems early, responding quickly, and recovering from them.
2. Cybersecurity Culture¶
a. What are 2–3 behaviors you would like to see people do to help the organization be cyber secure?¶
I would like people in the organization to: Think before clicking on unknown links, attachments, or messages. Use strong and unique passwords and enable multi-factor authentication (MFA) where available. Report suspicious activity or mistakes immediately, instead of hiding them.
b. What are the values, attitudes, and beliefs that would drive these behaviors?¶
The following values and attitudes would encourage these behaviors: Responsibility – Everyone understands that cybersecurity is their responsibility, not only the IT department’s. Awareness – People understand that even a simple action, such as clicking a link, can create a security problem. Honesty and openness – People feel comfortable reporting mistakes without being embarrassed or unnecessarily blamed. Care and caution – People develop the habit of checking before they click, download, or share information.
c. What are the mechanisms you can employ to create the values, attitudes, and beliefs?¶
Some useful mechanisms are: Regular cybersecurity awareness training. Short phishing-awareness exercises and simulations. Leadership demonstrating good cybersecurity practices. Clear cybersecurity policies and simple guidelines. Recognizing and rewarding employees who demonstrate good security behavior. Creating a no-blame reporting culture, where people can report mistakes quickly. Including cybersecurity behavior in performance discussions or evaluations.
3. Human-Centric Security Concerns from GenAI¶
I consider the two biggest human-centric concerns to be: 1. Accidental disclosure of sensitive or confidential information 2. Over-reliance on AI and failure to verify AI-generated information
Concern 1: Accidental disclosure of sensitive information¶
Generative AI tools can make it very easy for people to paste information into a chatbot without thinking about whether that information is confidential.
For example, an employee might paste a student’s personal information, an employee’s salary details, a password, an internal document, or confidential school information into ChatGPT and ask it to “summarize this.” The person may simply be trying to save time, but they have potentially exposed sensitive information to an external AI service.
a. Why is this a concern? The main concern is loss of control over sensitive information. Once confidential information is entered into an external service, the organization needs to understand how that service handles the information and what protections are available.
b. What behaviors would minimize the risk? People should: Never enter passwords, confidential personal information, or sensitive organizational information into public AI tools. Remove names and other identifying information before using AI for legitimate tasks. Follow the organization’s approved AI-use policy. Use organization-approved AI tools when handling sensitive information. Ask for permission when unsure whether information can be shared with an AI system.
c. What mechanism could encourage these behaviors? An organization can create a clear GenAI acceptable-use policy that gives employees simple examples of what can and cannot be entered into AI tools. Regular training and short reminders can reinforce the policy.
Concern 2: Over-reliance on AI-generated information¶
A second major concern is that people may trust AI-generated answers without checking them. AI can produce answers that sound very convincing but may contain incorrect, outdated, or completely invented information.
a. Why is this a concern? People may assume that because an AI response sounds professional, it must be correct. For example, a teacher might ask an AI tool to generate information about a cybersecurity topic and directly use the answer in teaching material. If the AI gives an incorrect definition or an inaccurate example, students may learn incorrect information. Another example is an employee asking AI to generate a technical command and running it without understanding what it does. An incorrect command could potentially cause data loss or system problems.
b. What behaviors would minimize the risk? People should develop a “trust but verify” approach: Check important AI-generated information against reliable sources. Do not automatically accept AI-generated facts, references, calculations, or technical instructions. Use human judgment before making important decisions. Treat AI as an assistant, rather than the final authority. Clearly identify when information has been generated or assisted by AI when appropriate.
c. What mechanism could encourage these behaviors? The organization can establish a GenAI review and verification policy. For important work, employees should be required to verify AI-generated information using trusted sources before using it. Training can also include examples of AI hallucinations and exercises where employees identify incorrect AI answers. This helps create the belief that AI is useful, but it is not automatically correct.