Show notes
Phishing training looks like one measure from the outside. Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich, says it can be classified as a constraining, considering or enabling approach, and that "the intervention itself doesn't necessarily tell us a lot about the mindset that's behind it, and I think that's, that's crucial because that's the starting point." Zimmermann joins Sean Martin and co-host Julie Haney to discuss the article she co-authored, "Human-Centered Cybersecurity Revisited: From Enemies to Partners."
Zimmermann uses phishing to make the mindsets concrete. A constraining approach means automated attachment blocking, filters, a ban on private use of work email and compliance training. A considering approach starts with the human: gamified training so knowledge sticks, and warnings that are more salient and better understood. An enabling approach switches perspective and learns from users about their challenges, what they do right, what motivates them to report, and their ideas for jointly designing better ways to detect phishing, including from employees who detect phishing reliably and warn others. She also says constraining is not necessarily a bad approach, since an employee does not want to deal with 100 phishing emails every day, though a ban on private email use could create insecure situations where private and work life intersect.
The conversation then turns to credibility. Zimmermann says an organization that tells people they are partners, then ignores their ideas, gives no feedback on reported phishing emails, or publicly blames and shames someone who clicks, is communicating something that is not credible. Her advice is to be aware of the mindset you want and think it through from communication to action, and to listen to employees at every level, including developers and administrators.
Sean Martin adds that looking at how people think and act is not new to business, since marketing and product development do it, and urges security leaders to find where it has worked and apply it to their program.
For security and risk leaders, the question the episode raises is whether the program's actions match the word "partners" it uses with its own people.
Host
Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/
Co-Host
Julie Haney, Computer Scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology (NIST)
Guest(s)
Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich
Resources
More
The Future of Cybersecurity Newsletter | https://itspm.ag/future-of-cybersecurity
The Future of Cybersecurity Blog | https://www.seanmartin.com/future-of-cybersecurity
More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast
Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllRWnxWBBf8E2rGm4AaELu1Y
More about Sean Martin | https://www.seanmartin.com/
Sean Martin on LinkedIn | https://www.linkedin.com/in/imsmartin/
Advertise on ITSPmagazine | https://www.itspmagazine.com/advertise
ITSPmagazine on YouTube | https://www.youtube.com/@itspmagazine
Studio C60 | https://www.studioc60.com
On Location schedule | https://www.itspmagazine.com/on-location
Advertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore the programs.
Keywords
verena zimmermann, julie haney, eth zürich, sean martin, phishing training, human-centered cybersecurity, constraining mindset, considering mindset, enabling mindset, security culture, usable security, humans as partners, human factors, security awareness, workarounds, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast
