Session 6: Human Security
Assignments
Class
The session started with a review of the previous week's assignments. I demonstrated my attempt to extend the Flush+Reload attack across two Proxmox virtual machines, which led to a discussion about shared physical memory, cache hierarchies, and why the attack does not work between isolated VMs. Other students also shared their progress on the operating system security assignments.
The main lecture was given by Kerri, who introduced the human side of cybersecurity. The lecture explored how people, organizational culture, and decision-making influence security, and why technical controls alone are not enough to protect systems. Topics included phishing, social engineering, human-centered security, AI-related risks, and the importance of building secure organizations through both technology and human processes.
After the lecture, the instructors discussed the final project, encouraging students to analyze and strengthen the security of a computing system by considering both technical and human factors.
Assignment Work
The following sections explore the three main topics discussed during this session and answer the accompanying assignment questions.
Cyber Resilience
Throughout this course we have mostly focused on preventing attacks through technical controls such as encryption, firewalls, VPNs, and operating system security. This session shifted the focus toward people. One of the ideas I took away was the difference between security and resilience.
It made sense to think about it in terms of fire safety. We do our best to prevent fires from happening through good building design, electrical standards, and safe practices. However, fires can still occur because of human mistakes, technical failures, or deliberate actions. When that happens, buildings with smoke detectors, fire extinguishers, evacuation plans, and trained occupants are much more likely to minimize the damage and recover quickly. Without these measures, the consequences can be far more severe and long lasting.
Cybersecurity follows a similar principle. Security aims to prevent attacks from happening, while cyber resilience assumes that attacks and human mistakes are inevitable. Instead of only trying to stop every incident, resilience is about preparing for failure, recovering quickly, and continuing to operate when something eventually goes wrong.
Building Cyber Resilience
One practical way to improve cyber resilience is to maintain reliable backups and regularly test that they can actually be restored. Backups that have never been tested may not be useful when they are needed most. Recovery procedures should be practiced before an incident occurs rather than during one.
One challenge to building resilience is that it often feels like preparing for something that may never happen. Organizations naturally prioritize new features and day to day work over disaster recovery planning. Time, budget, and confidence that "it won't happen to us" can all become barriers.
Coming back to the fire analogy, most people have participated in a fire drill. They can feel inconvenient, especially when nothing is wrong, but the purpose is to ensure everyone knows the quickest evacuation route and where to gather safely. We also regularly inspect smoke detectors and fire extinguishers, even though we hope they are never needed. These preparations may seem unnecessary until the day they become essential.
Cyber resilience follows the same principle. Organizations should regularly test backups, practice incident response procedures, and verify that recovery plans actually work before an incident occurs. Just like a fire drill, these exercises build familiarity and confidence so that people know what to do when something goes wrong.
These exercises also expose weaknesses in procedures while the consequences are still low, allowing them to be corrected before a real incident occurs.
Because humans will always make mistakes, organizations should focus not only on preventing errors but also on ensuring that those errors do not become catastrophic incidents.
Building a Security Culture
Cybersecurity is not only about technology but also about people. Firewalls, encryption, and antivirus software can provide strong technical protection, but they are much less effective if employees do not understand their role in keeping the organization secure. A strong cybersecurity culture encourages secure behavior until it becomes part of everyday work rather than something people only think about during annual training.
Some of the behaviors I would like to encourage include:
- Feeling comfortable reporting suspicious emails or unusual activity as soon as they notice it.
- Verifying unusual requests before sharing information or transferring money.
- Thinking carefully before entering company information into online services.
These behaviors are supported by values such as personal responsibility, openness, and the understanding that security is everyone's responsibility rather than only the responsibility of the IT department. People should also feel comfortable reporting mistakes without fear of punishment, since early reporting often limits the damage.
Creating this culture requires more than written policies. Leadership should set a good example by following the same security practices expected of everyone else. Regular awareness training, phishing simulations, and cyber drills can reinforce good habits through practice rather than theory. Recognizing employees who report potential security issues or suggest improvements also helps build a culture where cybersecurity becomes a shared responsibility instead of simply another workplace requirement.
Human-Centric Risks of Generative AI
Generative AI tools such as ChatGPT and Claude have quickly become useful productivity tools, but they also introduce new risks that are centered around human behavior rather than software vulnerabilities.
Sharing Confidential Information
One of the biggest risks is that users may unintentionally share confidential information with public AI services. Because interacting with an AI feels similar to chatting with a colleague, it can be easy to forget that the information is being sent to an external service.
For example, a software developer might paste proprietary source code into ChatGPT to help debug a problem. While the AI may provide a useful answer, sensitive intellectual property has now been shared outside the organization.
The safest behavior is to avoid submitting confidential information unless an approved enterprise AI platform is available. When possible, sensitive information should be removed before using AI tools.
Organizations can encourage this behavior through clear AI usage policies, practical training, and technical controls such as Data Loss Prevention systems that warn users before sensitive information leaves the organization.
Trusting AI Without Verification
Another concern is that AI often produces answers that appear highly confident even when they contain factual mistakes, insecure code, or fabricated references. Because the responses are well written, users may trust them without sufficient verification.
For example, a developer could copy AI-generated authentication code directly into a production system without fully reviewing it. If the generated code contains a subtle security flaw, the vulnerability becomes part of the application.
The best way to reduce this risk is to treat AI as an assistant that always agrees with you rather than an authority. Important information should always be verified, and AI-generated code or documentation should be reviewed before it is used.
Organizations can reinforce this mindset through training that demonstrates real examples of AI mistakes and by encouraging peer review of AI-assisted work. In both examples, the AI itself is not the primary vulnerability. The greatest risk comes from how people choose to use and trust these tools, making awareness and critical thinking even more important than the technology itself.
Reflections
Dwight from The Office is an interesting example because he demonstrates several aspects of critical thinking. He doesn't blindly follow what people tell him. He analyzes situations, makes plans, prepares for unlikely scenarios, and often thinks several steps ahead. Those are all valuable qualities that are also important in cybersecurity.
The problem is that he sometimes starts from faulty assumptions or ignores the broader context. Critical thinking is not only about questioning information or planning ahead. It also requires evaluating whether your assumptions are correct, considering alternative explanations, examining the available evidence, and judging whether your response is appropriate for the situation.
-
Good critical thinking: "People panic in emergencies. We should practice emergency procedures."
-
Dwight's version: "I'll start an actual fire to make the drill realistic."