Skip to content

Human Security

Class 6 - Human Security — July 9, 2026

Speaker

Keri Pearlson — Presentation

Video Lecture — Homework

Homework assignments

Homework assignment

1. Cyber resilience

What, in your own words, is cyber resilience and how is it different from protection or security?

  • a. What is one thing you can do to build cyber resilience?
  • b. What might get in the way of building cyber resilience?
  • c. Why is cyber resilience an effective response to human-centric vulnerabilities?

2. Values, attitudes, and beliefs that drive cyber-resilient behaviors

A cybersecurity culture is defined as the “values, attitudes and beliefs that drive cyber-resilient behaviors.” The culture is created by managerial mechanisms such as governance mechanisms, reward systems, consequences, leadership, priorities, performance evaluation, and more.

  • a. What are 2–3 behaviors you would like to see people adopt to help the organization be cyber secure?
  • b. What are the values, attitudes, and beliefs that would drive these behaviors?
  • c. What mechanisms can you employ to create these values, attitudes, and beliefs?

3. Human-centric security concerns from the use of GenAI tools

What do you consider the top two human-centric security concerns or vulnerabilities arising from the use of GenAI tools such as ChatGPT, Claude, and others?

  • a. For each concern, explain why it is a concern. Provide a short example to illustrate the risk you see. Be as specific as possible.
  • b. What behavior or behaviors would minimize the risk of a negative impact from this concern?
  • c. What mechanism can you use to drive the values, attitudes, and beliefs that would encourage the behaviors you seek?
✅ 1. Cyber resilience

1. Cyber resilience

What, in your own words, is cyber resilience, and how is it different from protection or security?

  • Cyber resilience is about being prepared for something to go wrong. When things do go wrong you should do your best to limit damage, be able to continue to function, recover fast and learn from the attack. Protection is about protecting the system and preventing attacks while somone who is resilient knows that 100% protection is impossible and that eventually a successful attack may happen, so the protecion failed but if you are resilient then you have a plan to minimize damage. Security or protection is necessary but that is not enough by itself. Somone resilient still protects their system, but also prepares for what happens when the protection fails. If you expect to be attacked, you have a plan to minimize the damage, respond swiftly, get operations back to normal quickly and learn from the attack to be better prepared for future incidents.

  • a. What is one thing you can do to build cyber resilience?

    • One thing that can build cyber resiliance is Table-top exercises to practice response. An orginization could simulate a phishing attempt, ransomware attack, comprimised account or accidental leaking or exposure of sensitive data, and train the employees how to react. The employees should know how to detect attacks and know what to do. They should know who to notify, know how to minimize damage so the organisation can continue to operate quickly. I think such an exercise is better than just a written plan because this trains the employees so they do not panic under stress and do not need to ask questions or look for the written plan, the employess have been trained and should be prepared for an attack or incident.

  • b. What might get in the way of building cyber resilience?

    • Some people might think that cyber security should be in the hands of the IT department so those people may not think they should worry about cyber security. Some people may be afraid to report mistakes or do not know how or who to contact if an incident happens.

  • c. Why is cyber resilience an effective response to human-centric vulnerabilities?

    • It’s just human to make mistakes, people will make mistakes, click on a wrong link, blindly trust messages, use poor passwords or make poor decisions under pressure. Cyber resilience is effective because it expects mistakes and/or attacks to happen but have procedures to detect them, limit the impact, respond quickly and recover quickly.
✅ 2. Values, attitudes, and beliefs that drive cyber-resilient behaviors

2. Values, attitudes, and beliefs that drive cyber-resilient behaviors

A cybersecurity culture is defined as the “values, attitudes and beliefs that drive cyber-resilient behaviors.” The culture is created by managerial mechanisms such as governance mechanisms, reward systems, consequences, leadership, priorities, performance evaluation, and more.

  • a. What are 2–3 behaviors you would like to see people adopt to help the organization be cyber secure?

    1. People shouldnot be afraid to report their mistakes and/or suspicious activities. If someone clicks a link that they think may be suspicious or if they send information to the wrong person they should report it as soon as possible rather than hiding it or hoping it doesn’t cause an issue.

    2. People should be careful about what they give AI tools access to. They should consider what information is really necessary for the AI tool and avoid sending personal or confidential data

  • b. What are the values, attitudes, and beliefs that would drive these behaviors?

    1. For people to report their own mistakes they should not fear punishment or embarrasement, they should believe reporting to be responsible behaviour.

    2. Using AI can speed up workflow but people should believe that information has value and should be treated responsibly. People using AI have a responsibility to understand what data is being shared and should be critical of the output from the AI, and not just blindly take AI output as truth or being correct.

  • c. What mechanisms can you employ to create these values, attitudes, and beliefs?

    1. The leaders should lead by example, they should report their own mistakes and follow AI policies so the staff sees that security is is a priority to the company and everyone should follow the rules, even the leaders.

    2. Being secure should be easy for employees, reporting should be easy and hassle free, AI use policies should be clear and explained to them why they are in place to make them really understand that security is a priority.

✅ 3. Human-centric security concerns from the use of GenAI tools

3. Human-centric security concerns from the use of GenAI tools

What do you consider the top two human-centric security concerns or vulnerabilities arising from the use of GenAI tools such as ChatGPT, Claude, and others?

  • My main concern with use of AI is people becoming too reliant on them and lose critical thinking. Another concern is leaking sensitive data to AI just to speed up the workflow and not being careful enough.

  • a. For each concern, explain why it is a concern. Provide a short example to illustrate the risk you see. Be as specific as possible.

    • When people become too reliant on AI they may, with time, stop questioning AI output because the answers are fast and convincing. The AI answers can sound like the AI knows exacly what they are talking about but can contain incorrect facts or hallucinations. A direct example is using AI too much on programming tasks, if a programmer uses AI too much then the programmer can become stagnant in their skills and stop being critical of AI generated code.

    • If an employee accidentally leaks sensitive information to AI then you can never be really sure how or what the AI does with that information. Another example is if an employee gives sensitive information to AI to speed up workflow then the AI may give a convincing output but if not all information is present in the AI prompt then it may misunderstand an important detail and recommend something wrong. If the employee just accepts the reply without critical thinking and verification and uses the response in production then it could lead to new vulnerabilities while the employee may believe that they were actually improving security.

  • b. What behavior or behaviors would minimize the risk of a negative impact from this concern?

    • People should treat AI response as a proposal that should be evaluated rather than an authority that should be obeyed. Important claims should be verified and anything that could potentially have negative consequences should involve human review before being used. For low level risk tasks such as brainstorming then human verification and review may not be necessary but anything involving security, finance, personal data, legal stuff or company sensitive information should require human verification and review.

    • People should pause before giving information to Ai and think if the information is public information or if it is internal, confidential or proprietary. The employees should know if the AI being used is approved by the company. The company should encourage employees to only use approved AI and make it normal to ask questions if they are unsure. Another thing about giving data to AI, often the AI would not necessarily need the full document or dataset to give a good answer, and sensitive information can alse be removed or made anonymous first and still get a clear response.

  • c. What mechanism can you use to drive the values, attitudes, and beliefs that would encourage the behaviors you seek?

    • The employees should be trained to use AI and use real examples of incorrect AI outputs so they see how difficult it can be to detect errors. People should not necessarily believe that AI is not to be trusted but treat it as a powerful tool that should be evaluated based on the possible consequensces if it is wrong.

    • Leadership matters a lot, they should show that responsible AI use is valued as well as being productive. If employees believe that they will only be rewared for fast work they may take shortcuts. If they believe that being responsible is part of good performance then secure behaviour is more likely to become a bigger part of the culture of the company.