Skip to content

Session 06: Human Security

While this session is probably less technical than other cybersecurity sessions, it addresses the most important aspect: human security (how human behavior and thought processes can become vulnerabilities). It is often said that the vast majority of security incidents in the world are caused by human error, deception (whether perpetrated or suffered), or inappropriate behavior. Looking at recent ransomware attacks and reflecting on my own experience in IT systems management, I am acutely aware of this fact every day.

On this page, I will provide answers to the questions posed in the homework assignment.

Question 1 (Cyber resilence)

What, in your own words, is ‘cyber resilience’ and how is it different than ‘protection’ or ’security’?

Cyber resilience refers to an organization’s ability to not only “prevent” attacks in cyberspace but also to implement measures—such as minimizing damage, anticipating and responding to potential threats, and minimizing the impact on business operations—based on the assumption that attacks will occur to some extent.

a. What is one thing you can do to build cyber resilience?

One thing is I can do is to build cybersecurity culture.

b. What might get in the way of building cyber resilience?

Human-centric issues. It is said that about 30 percent of security incidents at companies worldwide are caused by human error. In fact, at the organization where I worked as a member of the IT department, we experienced two security incidents in the past—including the hijacking of a public relations social media account and the mass distribution of spam emails following the compromise of an email account—and both were caused by staff members who used those accounts carelessly entering their passwords on phishing sites and similar platforms. Whether it’s literacy, daily behavior, or awareness, there are various factors to consider, but there’s no doubt that employees are a major key to building cyber resilience.

c. Why is cyber resilience an effective response to human-centric vulnerabilities?

The essence of cyber resilience is to build a cybersecurity culture in organinzation. That is to build the beliefs, values and attitudes that drive cybersecure behaviors in an organization. Based on the beliefs, values, and attitudes that promote cybersecurity-conscious behavior, it is crucial—above all else—for employees to transform their daily work and actions in order to prevent vulnerabilities caused by their own actions.

2. Question 2 (Cyber Culture for Resilence)

A cybersecurity culture is defined as the “values, attitudes and beliefs that drive cyber-resilient behaviors”. The culture is created by managerial mechanisms like governance mechanisms, reward systems, consequences, leadership, priorities, performance evaluation, and more.

a. What are 2-3 behaviors you would like to see the people do to help the organization be cyber secure?

For example, employees should avoid continuing to use weak passwords, refrain from carelessly clicking on website links sent via email, and be mindful of security risks in their daily work, among other things.

b. What are the values, attitudes and beliefs that would drive these behaviors?

Individual Level issues would drive these behaviors. That is.... employee’s self-efficacy, cybersecurity policy awareness and general cyber threat awareness.

c. What are the mechanisms you can employ to create the values, attitudes and beliefs?

Cybersecurity Training, Rewards and Punishments, communication plan (if the threads, incidents occurs/may occurs) would help to create those beliefs. Also, Cultural leardership by someone in higher level would also important....

3. Question 3(AI and Cyber Resilence)

What do you consider the top 2 human-centric security concerns or vulnerabilities from the use of GenAI tools (ChatGPT, Claude, etc)?

I choose “Social Engineering at Scale” and “content Manipulation creates misinformation”

a. For each concern, explain why this is a concern? Provide a short example to illustrate the risk you see. Be as specific as possible.

  • “Social Engineering at Scale”: Recently, very personalized phishing site could be made with GenAI. For example, Websites that pretend to be messages “a celebrity might say” in order to trick users into entering their social media account information and passwords. There are also investment scam ads generated by generative AI using videos and voices of celebrities.
  • “content Manipulation creates misinformation”: AI can create fake article titles and suggest it as if they have already published. For example, it should be double-check whether suggested articles are really exists in the world when we ask to GenAI to survey specific topic’s literature reviews.

b. What behavior(s) would minimize the risk of a negative impact for this concern?

AI Governance could be minimize the risk of those negative impact of AI. Those are “Assigns Responsibility”, “Ensures Ethical Use” and “Mitigates Risks”. Especially, to reduce the risk of “Social Engineering” and “Content Manipulation creates misinformation”, Ensure Ethical Use is more important behaviors. Those includes: Promotes fairness, transparancy, and responsible AI deployment in line with oranizational values.

c. What is a mechanism you can use to drive the values, attitudes, and beliefs that would encourage the behavior(s) you seek?

The following 5 components of Good Governance of AI for Organization, learned from the class, is useful.

  • Executive Oversight
  • Governance Policies
  • Controls for Risk, Use, and Impact
  • Design, Develop and Deployment Guidelines
  • Monitoring and Management Processes

Especially, Governance Policies and Design of Guidelines are (I think) more importants because while staff members may understand the risks associated with generative AI to some extent, they feel they cannot take any action without clear guidelines on what to do.