Phishing Training Looks the Same Under Three Mindsets | Human-Centered Cybersecurity Series with Co-Host Julie Haney and Guest Verena Zimmermann | Redefining CyberSecurity with Sean Martin omslagsbild

Phishing Training Looks the Same Under Three Mindsets | Human-Centered Cybersecurity Series with Co-Host Julie Haney and Guest Verena Zimmermann | Redefining CyberSecurity with Sean Martin

Phishing Training Looks the Same Under Three Mindsets | Human-Centered Cybersecurity Series with Co-Host Julie Haney and Guest Verena Zimmermann | Redefining CyberSecurity with Sean Martin

Lyssna kostnadsfritt nu, utan abonnemang

Visa detaljer

Saisonale Sparangebote | 0,99 € pro Monat für die ersten 3 Monate

Danach 6,99 €/Monat. Bedingungen gelten. Monatlich kündbar.
Show notesPhishing training looks like one measure from the outside. Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich, says it can be classified as a constraining, considering or enabling approach, and that "the intervention itself doesn't necessarily tell us a lot about the mindset that's behind it, and I think that's, that's crucial because that's the starting point." Zimmermann joins Sean Martin and co-host Julie Haney to discuss the article she co-authored, "Human-Centered Cybersecurity Revisited: From Enemies to Partners."Zimmermann uses phishing to make the mindsets concrete. A constraining approach means automated attachment blocking, filters, a ban on private use of work email and compliance training. A considering approach starts with the human: gamified training so knowledge sticks, and warnings that are more salient and better understood. An enabling approach switches perspective and learns from users about their challenges, what they do right, what motivates them to report, and their ideas for jointly designing better ways to detect phishing, including from employees who detect phishing reliably and warn others. She also says constraining is not necessarily a bad approach, since an employee does not want to deal with 100 phishing emails every day, though a ban on private email use could create insecure situations where private and work life intersect.The conversation then turns to credibility. Zimmermann says an organization that tells people they are partners, then ignores their ideas, gives no feedback on reported phishing emails, or publicly blames and shames someone who clicks, is communicating something that is not credible. Her advice is to be aware of the mindset you want and think it through from communication to action, and to listen to employees at every level, including developers and administrators.Sean Martin adds that looking at how people think and act is not new to business, since marketing and product development do it, and urges security leaders to find where it has worked and apply it to their program.For security and risk leaders, the question the episode raises is whether the program's actions match the word "partners" it uses with its own people.HostSean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/Co-HostJulie Haney, Computer Scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology (NIST)Guest(s)Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH ZürichResourcesMoreThe Future of Cybersecurity Newsletter | https://itspm.ag/future-of-cybersecurityThe Future of Cybersecurity Blog | https://www.seanmartin.com/future-of-cybersecurityMore Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcastRedefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllRWnxWBBf8E2rGm4AaELu1YMore about Sean Martin | https://www.seanmartin.com/Sean Martin on LinkedIn | https://www.linkedin.com/in/imsmartin/Advertise on ITSPmagazine | https://www.itspmagazine.com/advertiseITSPmagazine on YouTube | https://www.youtube.com/@itspmagazineStudio C60 | https://www.studioc60.comOn Location schedule | https://www.itspmagazine.com/on-locationAdvertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore the programs.Keywordsverena zimmermann, julie haney, eth zürich, sean martin, phishing training, human-centered cybersecurity, constraining mindset, considering mindset, enabling mindset, security culture, usable security, humans as partners, human factors, security awareness, workarounds, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast
adbl_web_anon_alc_button_suppression_t1
Inga recensioner ännu