Session 6 > Human Security

Class Notes > Human Security

Instructor: Keri Pearlson

The good guys are good, but the bad guys are getting badder…faster

• Families and organizations are inadequately prepared…against attacks
• Impossible to be 100% protected

• Recovery from an attack is costly

• BHAG > Big Hairy Audacious Goal

• Assume the bad guys will get in
• …need to think about minimizing damage and restore

Design for Resilience

• Technological preparation…must be done along with possible damage assessment
• Focus on ‘protection’ is not enough…my think about ‘cyber resilience’

Culture of Cybersecurity
- Human-centric issue needs human centric solutions

• Design for security…not just elegance or efficiencies

Reducing Human Risks

Culture of Cybersecurity = Values, attitudes, believes and perceptions that affect security

• Values + Attitudes + Beliefs + Perception (VAB+P)
• We do things that we think are important (and are easy to execute)
• We need to know how to report security risks…easily
• Training programs are great at setting guiderails…but fail to change VABP > no motivation
• ex: changing passwords frequently and to good ones
• Awareness must be constant…not periodic
• When the leader of an organization talks about Cybersecurity…the topic is given greater weight for attention by company staff
• Hire a marketing person to promote Cybersecurity VABP, engaging learning content with rewards
• People want to be rewarded
• People don’t want to be called out for failure (consequences)

Dynamic Organizational Cybersecurity Model

Measuring security

VAB Perspective…not training perspective

Using AI Securely

The dangers of one and done.

• The bad guys can use AI too

Attack surfaces…(?)

• AI governance sets the guardrails
• People tend to over trust a system that helps with their productivity

Homework

My takeaway from Keri Pearlson’s lecture is that…reagardless of how incredibly good we get at sophisticated cybersecurity techniques…the most vulnerable point of defense will always be > people.

In the Veritasium video titled The Internet Was Weeks Away From Disaster And No One Knew, a terrifying scenario was described whereby millions of Linux-based computer system on the planet was at risk of being compromised. A hacker (group?) was moments away from implementing a “backdoor” into these systems that would allow them kernel-level access. And while incredibly sophisticated cybersecurity attack methods and tools were employed to slowly build that backdoor…the initial, critical attack vector was directed at a person > Lasse Collin.

The open-source Linux operating system relies heavily on small programs and libraries, often the passion projects of individuals. Some useful small programs or libraries are heavily used in larger open-source projects…a component in a larger aggregate structure. These small components can become system vulnerabilites, primarily because it programming and ongoing maintenance is in the hands of one individual. A human vulnerability becomes a system vulnerability.

Lasse Collin’s data compression tool “xz”, widely used in many Linux os programs, inadvertently becomes the Linux operating system’s greatest vulnerability. A great tool with very poor cybersecurity defenses. An overworked programmer who was more than happy to receive help from a willing volunteer > who turned out to be a hacker.

What is ‘Cyber Resilience’? How is it different than ‘Protection’ or ‘Security’?

My gut feeling would lead me to define ‘protection’ and ‘security’ as intentional actions one takes once clear treats are identified and clear defense plans are designed. Or maybe it could be defined as something we do in reaction to or anticipation of dangers, a duality between 2 polar opposites. Newton’s 3rd law…”for every action there is an equal and opposite reaction” at work. Defense against Offense. The 300 Spartans vs the Persians.

image from the movie 300

Cyber Resilience on the other hand describes a mindset, an attitude that drives the actions necessary to pursue ‘protection and security’. A mindset born from a recognition of the statements made by Keri in her lecture:

• It is impossible to be 100% protected against cyber-attacks

The bad guys can use AI too

• We are inadequately prepared against cyber-attacks
• Recovery from an attack is costly

We are going to get hit. It is going to hurt. How do we:

• Prepare
• React
• Mitigate Damage
• Learn & Recover

…from the inevitable attacks.

I think the single most important thing that can be done to nurture Cyber-Resilience is knowledge through learning. We fear and are complacent to what we don’t understand. Speaking from my own personal experience, I would say that I don’t know how to be Cyber-Resilient because I did not know what I did not know I didn’t understand the magnitude of the issue, did not have the vocabulary to understand the technicalities of Cyber-Threats, and did not know how to begin to do anything about it. Cybersecurity knowledge makes possible, at the very least, that the problem is real and significant…and complacency and inaction is dangerous.

Cybersecurity Culture are ‘values, attitudes and beliefs that drive cyber-resilient behaviors’

I believe that the most important Cybersecurity behaviors to sustain a Cyber Resilient Culture for an organization should include:

• Cybersecurity knowledge competency > achieve a basic level of knowledge of the topic, risk and best defense practices
• Periodic stress testing of Cyber Resilience > selectively ‘probe’ and ‘break’ an organization’s cyber infrastructure

In an organization, Cybersecurity Culture values, attitudes and beliefs must necessarily be a group not individual endeavour. A culture is formed and made effective by the collective, not by individuals. Members of an organization must work as a team, with a shared desire to contribute to collective success. Winning together.

People, particularly those that work in industries where cyber-attacks have the biggest implications, are busy, stressed and likely overworked. Asking them to ‘take on extra work’ would likely not generate a lot of buy-in. I suppose the key is to make Cyber Resilient behavior not be an extra thing, but integrated into expectations of the roles and responsibilities of a job description. That is, salary and compensation will not only be a factor of individuals achieving KPIs but also actively adhering to the Cybersecurity Culture and policies that ensures the safety and survivability of the organization as well. To put it bluntly, the biggest, most effective motivator for workers in a capitalist system is money.

What are the top 2 Human-Centric security concerns or vulnerabilities from the use of GenAI tools

• A lack of recognition that any input as a GenAI prompt enters the public domain.

  • Prompt inputs are user iniitated private and organization data breaches
  • Become the training material for the GenAI that can be accessed by others using the same GenAI system asking a similar query
  • Privacy Breach Mitigation: Be wide-eyed cognizant that anything inputted into a GenAI system become public information

• Over attribution of trust to a GenAI tool because of the personal nature of the interface

  • GenAI interface and responses are intentionally friendly and affirming…lulling the user into a greater level of trust that it should be afforded
  • People forget that they are talking to a machine, not another human being
  • GenAI responses triggers a feeling of relief and progress, as troublesome questions inputted seem to generate useful answers
  • As GenAI produces more and more seemingly successful solutions to lessen the workload and stress of the user, the tendency is the increased reliance on the GenAI platform to ‘help’ with more and more tasks
  • The more success (and success high) that is generated with continuous GenAI use, the more the user will be inclined to trust the GenAI system with increasingly more sensitive information
  • GenAI Trust Mitigation: Do not give the AI a name (my brother-in-law call his ChatGPT “Chad”). Ask AI not to be overly positive or conversational (behave less like a human echo chamber)…but stay objective in answering questions.

Research

JMM

How to get AI not to be so friendly.

“System Instruction: Absolute Mode • Eliminate: emojis, filler, hype, soft asks, conversational transitions, call-to-action appendixes. • Assume: user retains high-perception despite blunt tone. • Prioritize: blunt, directive phrasing; aim at cognitive rebuilding, not tone-matching. • Disable: engagement/sentiment-boosting behaviors. • Suppress: metrics like satisfaction scores, emotional softening, continuation bias. • Never mirror: user’s diction, mood, or affect. • Speak only: to underlying cognitive tier. • No: questions, offers, suggestions, transitions, motivational content. • Terminate reply: immediately after delivering info - no closures. • Goal: restore independent, high-fidelity thinking. • Outcome: model obsolescence via user self-sufficiency.”