Skip to content

Class 6 - Human security

What, in your own words, is ‘cyber resilience’ and how is it different than ‘protection’ or ’security’?

  • What is one thing you can do to build cyber resilience?
  • What might get in the way of building cyber resilience?
  • Why is cyber resilience an effective response to human-centric vulnerabilities?

Cyber resilience to me is how someone or company can continue to operate or how fast they can revolver from a security incident. Protection and security are steps you can take to have good cyber resilience. One thing to build cyber resilience is to have a good policy in place on what to do and how to mitigate the attack . Some of this can be making sure backups and how to restore the data are in place. What can get in the way of building resilience is a company complacent on having security measures in place of that it costs money and is hard to show a return on investment. Cyber resilience is an effective response to human-centric vulnerabilities because to error is human and all it takes is one phishing email or a weak password.

A cybersecurity culture is defined as the “values, attitudes and beliefs that drive cyber-resilient behaviors”. The culture is created by managerial mechanisms like governance mechanisms, reward systems, consequences, leadership, priorities, performance evaluation, and more.

  • What are 2-3 behaviors you would like to see the people do to help the organization be cyber secure?

  • Report suspicious emails, messages, or activity immediately.

  • Use strong, unique passwords and enable multi-factor authentication (MFA).

  • Keep software and devices updated by installing security patches as soon as they are available.

  • What are the values, attitudes and beliefs that would drive these behaviors?

Employees should value protecting company data and understand that cybersecurity is everyone’s responsibility. They should believe that reporting potential threats is helpful rather than punitive and recognize that following security policies protects both the organization and themselves.

  • What are the mechanisms you can employ to create the values, attitudes and beliefs?

Leadership should consistently emphasize the importance of cybersecurity through regular communication and by following security policies themselves. Organizations should provide ongoing cybersecurity awareness training, conduct phishing simulations, recognize employees who demonstrate secure behavior, and establish clear policies with consistent accountability for failing to follow security requirements.

What do you consider the top 2 human-centric security concerns or vulnerabilities from the use of GenAI tools (ChatGPT, Claude, etc)?

  • For each concern, explain why this is a concern? Provide a short example to illustrate the risk you see. Be as specific as possible.
  • What behavior(s) would minimize the risk of a negative impact for this concern?
  • What is a mechanism you can use to drive the values, attitudes, and beliefs that would encourage the behavior(s) you seek?

My top two human-centric security concerns are blindly following what AI returns to you and leaking confidential information. For blindly trusting the results if you used AI to provide code the AI could make errors or have vulnerabilities that could leak data or other user information. One way to minimize this is to review the code but if someone asked AI to write it they may have no idea what good and safe code is. The biggest mechanism to help combat this is education and making sure that the induvulds have the knowledge to be able to review. You also need to change the culture that AI does it better, faster and has no mistakes it is often not the case. As for leaking confidential information this is a major issue if you are in a cooperative industry or the possibility of leaking customer data. Leaking data can possibly bring lawsuits against you or your company and if the data is a new product it could get to your competitor and they can get an edge on your company. One behavior to minimize this is not just asking AI everything and not looking at what data is being sent. The best mechanism I feel is for education and a policy of what can be sent to AI.