Skip to content

Session 6: Human security

July 6th,2026

Homework Introduction

What, in your own words, is ‘cyber resilience’ and how is it different than ‘protection’ or ’security’?

Cyber resilience starts from the assumption that security can never be perfect. Since it’s impossible to build a completely secure system, we need to design an ecosystem that can recover quickly and minimize damage when something goes wrong.

  • a. What is one thing you can do to build cyber resilience? Build system with an assumption that security can never be perfect. In parallel, we should think how can we minimize the damage.

  • b. What might get in the way of building cyber resilience?

  • Humans take shortcuts when procedures are inconvenient.
  • We can update security system but we can not update human easily.
  • We can not evaluate the cost for building cyber resilience easily.
  • Most of the time system include another company’s system. We can not touch all of them.

  • We can not stop the system easily for maintainance.

  • c. Why is cyber resilience an effective response to human-centric vulnerabilities? Even if a system is technically secure, human behavior can still become a huge security hole. Since we can’t eliminate human error through protection alone, resilience is effective because it assumes mistakes will happen and focuses on limiting the damage and recovering quickly

A cybersecurity culture is defined as the “values, attitudes and beliefs that drive cyber-resilient behaviors”. The culture is created by managerial mechanisms like governance mechanisms, reward systems, consequences, leadership, priorities, performance evaluation, and more.

  • a. What are 2-3 behaviors you would like to see the people do to help the organization be cyber secure?

    1. memolize password on paper and keep it near by PC.
    2. click phishing links
    3. To be acquired

  • b. What are the values, attitudes and beliefs that would drive these behaviors?

    1. A sence of ownership. Making responsibilities clear for both individuals and the company
    2. Making cyber security as a habituation.
    3. A sense of valuing normalcy.

  • c. What are the mechanisms you can employ to create the values, attitudes and beliefs? What do you consider the top 2 human-centric security concerns or vulnerabilities from the use of GenAI tools (ChatGPT, Claude, etc)?

    Question A: Mechanisms you can employ to create the values, attitudes and beliefs 1. Usual training. 2. Making evaluating system their attitude and actions. 3. making opportunity for talking about security.

    Question B: 2 human-centric security concerns or vulnerabilities from the use of GenAI tools (ChatGPT, Claude, etc) 1. One major concern is that people may paste confidential information into prompts. - a. Explain why this is a concern? Provide a short example to illustrate the risk you see. Be as specific as possible. Once we input the security data into prompt, it will store the data into thier server. - b. What behavior(s) would minimize the risk of a negative impact for this concern? We need to check the contract or privacy policie. - c. What is a mechanism you can use to drive the values, attitudes, and beliefs that would encourage the behavior(s) you seek? Showing the risk by input security data.

    1. Another concern is over-reliance on AI.

      • a. Explain why this is a concern? Provide a short example to illustrate the risk you see. Be as specific as possible. AI still sometimes answer wrong information.

      • b. What behavior(s) would minimize the risk of a negative impact for this concern? We should know the appropriate risk.

      • c. What is a mechanism you can use to drive the values, attitudes, and beliefs that would encourage the behavior(s) you seek? We should do usual training for knowing the behavior of AI and principal.

Memo

Practical Methods for Decapping Chips