Are Human Beings Really the Problem in Cyber Security? Part 2

Authored by Liberty Specialty Markets Strategic Assets Underwriting Manager Matthew Hogg and Underwriter Graham Preston

In part two of this blog series on human cyber security errors, our Strategic Assets team comes to the defence of humans, who with the right training could become cyber security superheroes.

In defence of humans

During a recent client meeting it was striking to hear a comment that was in the same breath both unexpected and seemingly the most obvious thing ever. When it came to the topic of employee training, rather than listing increasingly heavy-handed measures, the speaker announced ‘rather than treating our employees like the weak link, we want them to be ‘cyber security superheroes’. Wow, what a change in tone from the usual!

In an intriguing book there is a chapter which focuses on self-fulfilling prophecies. It references a study carried out by Professor Robert Rosenthal who asked the pupils of a Californian school (1) to take part in what was dressed up as an IQ test.

His team then proceeded to cast the test results aside and flipped a coin to decide which students would be identified to their teachers as ‘high potential’. The students and teachers were not told this was how the selections were made. Sure enough, teachers gave the ‘high potential’ students more attention and praise, changing the self-image of these children. As you have probably guessed, the genuine scores of these children subsequently improved dramatically. More interestingly, the largest improvement was seen in children from backgrounds where teachers incorrectly held low expectations. This effect has been labelled the Pygmalion effect after the Greek myth.

There is an effect in the opposite direction known as the Golem effect (2), whereby people who are told negative things about themselves begin to believe them. Naturally there is a very limited study of this, given the ethical considerations on subjecting people to this kind of treatment.

It seems logical that the same would be true of employees and their performance, including with regards to matters of cyber security. If people are told that they are the ones likely to make an error, it potentially becomes something of a self-fulfilling prophecy. If they are told that they are able to stop these calamities, then we could expect to see improved performance.

Naturally there are limitations on the power of positive thinking alone and believing you have the ability to do something is no substitute for actually being able to do so. Anyone who has ever sung karaoke can attest to this! Relevant and considered training and being armed with the right tools is still just as important. But it would be interesting to know how much more effective employees would be if they were treated more like ‘cyber security superheroes’ than cyber security villains.

(1) Humankind, Rutger Bregman p256

(2) Humankind, Rutger Bregman p257

To speak to someone at Liberty Specialty Markets about Cyber insurance, CLICK HERE, leave a message and youTalk-insurance will pass your enquiry on.