Sean Martin and co-host Julie Haney talk with ETH Zürich's Verena Zimmermann about why one phishing training program can serve a constraining, considering or enabling mindset, and what leaders can do to make "partners" credible.
Show notes
Phishing training looks like one measure from the outside. Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich, says it can be classified as a constraining, considering or enabling approach, and that "the intervention itself doesn't necessarily tell us a lot about the mindset that's behind it, and I think that's, that's crucial because that's the starting point." Zimmermann joins Sean Martin and co-host Julie Haney to discuss the article she co-authored, "Human-Centered Cybersecurity Revisited: From Enemies to Partners."
Zimmermann uses phishing to make the mindsets concrete. A constraining approach means automated attachment blocking, filters, a ban on private use of work email and compliance training. A considering approach starts with the human: gamified training so knowledge sticks, and warnings that are more salient and better understood. An enabling approach switches perspective and learns from users about their challenges, what they do right, what motivates them to report, and their ideas for jointly designing better ways to detect phishing, including from employees who detect phishing reliably and warn others. She also says constraining is not necessarily a bad approach, since an employee does not want to deal with 100 phishing emails every day, though a ban on private email use could create insecure situations where private and work life intersect.
The conversation then turns to credibility. Zimmermann says an organization that tells people they are partners, then ignores their ideas, gives no feedback on reported phishing emails, or publicly blames and shames someone who clicks, is communicating something that is not credible. Her advice is to be aware of the mindset you want and think it through from communication to action, and to listen to employees at every level, including developers and administrators.
Sean Martin adds that looking at how people think and act is not new to business, since marketing and product development do it, and urges security leaders to find where it has worked and apply it to their program.
For security and risk leaders, the question the episode raises is whether the program's actions match the word "partners" it uses with its own people.
Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/
Julie Haney, Computer Scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology (NIST)
Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich
More
The Future of Cybersecurity Newsletter | https://itspm.ag/future-of-cybersecurity
The Future of Cybersecurity Blog | https://www.seanmartin.com/future-of-cybersecurity
More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast
Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllRWnxWBBf8E2rGm4AaELu1Y
More about Sean Martin | https://www.seanmartin.com/
Sean Martin on LinkedIn | https://www.linkedin.com/in/imsmartin/
Advertise on ITSPmagazine | https://www.itspmagazine.com/advertise
ITSPmagazine on YouTube | https://www.youtube.com/@itspmagazine
Studio C60 | https://www.studioc60.com
On Location schedule | https://www.itspmagazine.com/on-location
Advertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore the programs.
verena zimmermann, julie haney, eth zürich, sean martin, phishing training, human-centered cybersecurity, constraining mindset, considering mindset, enabling mindset, security culture, usable security, humans as partners, human factors, security awareness, workarounds, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast
With Sean Martin, Co-Founder & CTO at ITSPmagazine (not confirmed online); Julie Haney, Computer Scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology (NIST) (not confirmed online); Verena Zimmermann, Assistant Professor (Tenure Track) for Security, Privacy and Society at ETH Zürich (not confirmed online); Lorin Schöni, ETH Zurich (GESS); ZHAW Zürcher Hochschule für Angewandte Wissenschaften (not confirmed online); Thierry Schaltegger (not confirmed online); Benjamin Ambühl (not confirmed online); Melanie Knieps (not confirmed online); Nico Ebert (not confirmed online)
Times are in the published episode: the conversation starts at 00:01:18, after the front bumper.
[00:01:18] Sean: And hello everybody, you're very welcome to a new episode of the Human-Centered Cybersecurity series as part of the Redefining Cybersecurity podcast. I'm Sean Martin, your host. I get to talk to all kinds of cool people about fun things like cybersecurity, and today, the human element of cybersecurity. And I'm thrilled to have my co-host for the series, Julie Haney, on. And she brings some of the best guests, I have to say to the conversation. And I'm excited to meet Verena today and have a good old chat about human-centered cyber. So Julie, why don't you kick it into gear for us?
[00:01:53] Julie Haney: Yeah. Thanks, Sean. Our guest today is Dr. Verena Zimmermann. She is an assistant professor for security, privacy, and society at ETH Zürich in Switzerland. research interests include the human aspects of safety, IT security, and privacy. And she has conducted an [00:01:00] impressive body of research that I have been following for several years now. And that research really formed the basis for an absolutely fascinating article that she co-authored called "Human-Centered Cybersecurity Revisited: From Enemies to Partners." And we're gonna be discussing that article in depth today. So very excited to have you on, Verena
[00:02:43] Verena: Yes. Thank you very much for the invitation. I'm honored to be here
[00:02:47] Sean: Great. Great to have you, and ETH is a fantastic entity as well, and I'm, I'm gonna play the enemy today. No, I'm kidding. I'm kidding.
[00:02:58] Julie Haney: partner.
[00:02:58] Sean: you go. You be the partner, I'll be the enemy. No, this is gonna be fun. This is gonna be fun
[00:03:03] Julie Haney: yeah. Looking forward to it. So can you start off by telling us a little bit about your professional journey and how you got into doing human-centered cybersecurity research?
[00:03:14] Verena: Yes, of course. I think that's an interesting one. [00:02:00] one might not believe it, but I'm, I'm not a cybersecurity professional nor a computer scientist, but I have been trained in psychology. But having studied at a technical university, my focus early on has been on human technology interaction, even though I was first drawn to safety and the human factors in safety and worked on aviation safety projects. By chance, after my studies, I happened to contribute to a project on usable and secure authentication and encryption. At that point, I didn't have a clue about encryption, and it didn't even sound that interesting or appealing to me. It was more a matter of funding at that time. But the more I was part of this project, and I more the more I had the chance to learn about encryption, I more understood that also this research area, security as compared to safety, has a lot of potential to look into the human factors and how to support human technology interaction in this field. And I found that so fascinating that there's so much untapped potential that I decided to somewhat stay in that niche
[00:04:27] Julie Haney: And we're glad you're here. It just underscores the importance of that the interdisciplinary perspectives in cybersecurity. So it's not just about kind of the technical or computer science. And we're gonna be talking more about that, right now. So, so let's talk about the article and some of the ideas in there. I know a lot of the work that you do and the article itself really centers mindsets about people in cybersecurity. And one of the things that we often hear in the cybersecurity community is that humans are the weakest link. So what are your thoughts about this characterization?
[00:05:13] Verena: Yes, that's so true, and that's something that I still hear very [00:04:00] frequently. And I think, well, thinking of humans as the weakest link, it's kind of the quick conclusion or rather the quick and easy fix that you might, that you might come to settle on after an incident happened. But I think it does not always do justice to the reality that is way more complex. So we know that today's sociotechnical systems, they are complex. They are often hybrid in nature, so physical and digital. also adds to the complexity. They are heavily interconnected, and in these systems, tracing down a problem to one single root cause in a supposedly simple linear chain of events is often not possible nor feasible. So for example, it's easy to identify the individual employee that might have clicked on a phishing link and to make him repeat a security training, assuming he's the weakest link, and to fix kind of the person. However, in [00:05:00] reality, this is much more complex to uncover the underlying organizational, situational, and individual aspects that interplay and that jointly led to these kind of incidents
[00:06:30] Sean: Well, I'm gonna, I'm gonna jump in here 'cause I'm, I'm fascinated by your background and specifically in the world of aviation and with the word safety that comes into mind. 'Cause I often feel that we focus on the technology and not doing something, and then that'll result in who knows what. What do we measure around that? But when we look at something like aviation or travel in general or in critical infrastructure or people working in manufacturing, safety becomes a big thing. And I feel we approach the result or the method with which we re- achieve safety differently than the me- than the method in which we re- achieve resilience, let's say, in cybersecurity. So I don't know your thoughts on that in terms of the mindset and how we approach things getting to where we really wanna get to.
[00:07:29] Verena: Yes, that's, that's an interesting question. So yeah, safety and security, they share a common goal, and this is to protect a system from any harm, even though security and safety, they have developed as different traditions or disciplines respectively, and that have certain distinctions such as safety primarily dealing, dealing with unintended accidents or errors, whereas in security we usually assume there's an intention behind things that go wrong. So it's, it's not just accident, it's an incident that is caused by a deliberate action or attack even. However it is very important to focus on this shared goal and also very parallel processes that we apply when we look into safety and security. Safety, at the same time, is a much older tradition and has lots of, well, experience with incidents and accidents, and interestingly also underwent similar development when it comes to the human factor. So also from the safety domain, the human as the weakest link is a notion that is very, very familiar there. However, as I said, the safety field is a bit older. They had more time to develop, to explore, and to conduct studies. They kind of shifted away from this, the human as the weakest link mindset, and found that similar to security, the same applies to safety. Sociotechnical systems are so complex, it's too short or too easy to just try to grab the first solution at hand, but we need to consider the complexity of the sociotechnical systems. And to do so, we need to make use of all the resources that we have in the systems, and that includes the human. So rather than seeing them as a risk or a problem to fix, the idea there is rather to see them as like untapped potential and a resource that we can use to harness an organization against threats of any kinds. And I think we see a little bit of a similar shift in the security domain, or at least that's what I'm also suggesting to do, to leverage this still untapped potential also in the security domain and to make use of humans as partners rather than enemies.
[00:09:57] Julie Haney: Yeah, that-- I mean, I, wanna get into that a little more, and maybe first we can start talking about how people or the, kind of the humans in cybersecurity are typically approached. So in your article, you talk about constraining and considering approaches as kind of [00:09:00] the traditional ways. So can you tell us a little bit more about the ideas behind that and why sometimes those, those might fall short?
[00:10:27] Verena: Yes, these terms have been used to characterize a little bit where we came from, and there are good reasons to do so when we look at the historical developments. However, they are, well, supposed to also outline the differences in dealing with the human insecurity over time. So as you said, you mentioned there's constraining and considering approaches. So where we started in the security domain that inherently focused on resistance to attacks the idea was to protect systems not only from attacks from the outside, but also from errors or attacks from the inside. And so the idea was to constrain human influence as much as possible and/or to automate the human out of the [00:10:00] system if feasible. This is not to say that automation is a bad thing. It is necessary and beneficial. However, it very much illustrates the stance that has been taken towards the human, like to try to minimize risk as much as possible, to limit errors as much as possible, and to do so to limit the interaction of the human as the, and the system. Yes.
[00:11:43] Sean: And I, oh, I'm just looking at the article, and there, there's a diagram in there where there's technology and the human-- or the human and the, and they're surrounded by technology is two circles, like the human in the center, and then you have human and technology interacting one-on-one. And then there's human to human, human to technology to technology and more of an integrated mesh, if you will, of interaction. And I'm, I'm just wondering the... what the story is behind that and what the value is of having the understanding that it's not just a one-on-one, that we're, we're all working together to achieve the common goal.
[00:12:25] Verena: Yeah, I think the idea of this figure is very much to outline this development over time. So starting with these constraining approaches that I just, like, described sooner or later, not only researchers but also people in industry realized that constraining, the constraining approach, it has its limitations. So if we try to completely automate the human out of the system, this is sometimes just not possible because there is touch points with the system, for example, when it comes to communication or authentication, for example, or phishing detection to stick to cybersecurity examples. And also, if humans are left out of the loop, then they also lack the ability to well, to come in if there's need for them to manually handle things, then they don't know what the current system state is, and they don't have the [00:12:00] ability anymore to handle incidents. So it is important to keep the humans in the loop, and we saw that this constraining approach not only reaches its limits in this regard, but also that it has some negative, like, side effects, such as if we constrain humans to an extent that they cannot do their tasks anymore, their job anymore, then of course they try to find workarounds to cope with the situation, which again, then often leads to insecure situations. realizing this mismatch between constraining security technologies and how humans operate, on the other hand, researchers, this research stream is considered usable security, they realize that it is very important to better consider the human, their limitations, their needs, but also their potentials in cybersecurity, and to design for usable, usable systems, for and with the humans in [00:13:00] mind
[00:14:18] Julie Haney: Yeah. So there, so, so you mentioned this evolution from the constraining to the considering and usability. What's next? What's kind of-- what's missing in all of that? So we're-- there's two different ways of looking at humans, like where are organizations or we as a cybersecurity community still falling short? Like, where do you think we should go?
[00:14:43] Verena: Yeah, that's a really good question, and I think directly leads to the suggested third approach. So usability is awesome. Of course, we need to design with usability in mind, and it's, it's a crucial thing to do. However as I tried to outline a little bit earlier, I think we can even go one step further. So to me, it seems like the cybersecurity attacks, they are highly dynamic. They are evolving. They are getting more sophisticated, especially now being more and more AI powered. So the attacker side, they don't sleep. At the same time, [00:14:00] the constraining and also the considering approaches that we apply in cybersecurity, they somewhat seem to have reached a plateau in con- in terms of what we can achieve in this fight against cybersecurity threats. So what I suggest here is from a psychological perspective to make even better use of that untapped potential of humans. Because as I outlined earlier, humans, they are not only a liability, a problem, or a risk factor, but they do have very unique competencies and capabilities that even outperform AI to date, such as they are very good at learning. They are really good at making a sense of a situation, contextualizing information when it comes to social or emotional intelligence or making decisions under uncertainty. So there is a lot of areas where we should even better use these unique human skills and just supplement or complement it with technologies. So the idea really is, as outlined in this article, to try to team humans and technology to find out in which areas or for which situations, what's the best approach, then to supplement with the either technology or the human skills.
[00:16:38] Sean: Yeah. When I'm, when I'm speaking with chief information security officers or CISOs there's a lot of conversation around connecting the security program, security operations back to the business, and there's often a disconnect between the team and the technical aspects of that and the, and then the value of that to the business and making that connection and being able to communicate what that is to the executive leadership team and the board. And I'm thinking, so as a, as a cybersecurity leader, talking about psychology and the human element of cybersecurity, that may seem foreign to them, just like cybersecurity seems foreign to the executive leadership team. I know you have a whole host of scenarios and s- and yeah, stories, if you will, that kinda help, in my opinion, bridge that gap in the way that we often try to tell the CISO, "If you focus on the business, you can, you can do a better job at selling what you're trying to accomplish." So can you use maybe a couple examples? There's-- What is it? Like password authentication is one where you shift from the ur- the current stage to the, yeah, desired outcome of enabling.
[00:17:58] Verena: Yes, absolutely. So in this publication, we tried to illustrate a little bit what we mean with this mindset shift, because just from the wording, it appears to be very abstract. And there is a couple of example examples around password management, around also phishing detection, for example, where we try to make [00:17:00] this more graspable. One of the examples perhaps I pick the phishing example, is if I... Well, if I tr- if I apply a constraining mindset and then also the related measures, what I would try to do when it comes to phishing is to constrain the humans as much as possible. So the idea here would be to, of all, try to avoid people coming in contact with potential phishing emails, and this I could do, of course, through the automated blocking of attachments. I could try to apply certain filter mechanisms. I could also try to prohibit using the work email for private purposes, and I could, like, very much focus on compliance training, so asking the employees to comply with the certain security policies that, for example, says that, I don't know, external attachments coming from external senders cannot be opened or something like that. So as I said, this is not necessarily a bad approach, right? Also as a, as an employee, right, you don't want to deal with 100 of phishing emails every day. So perhaps the idea to block away certain certain mails that are very likely phishing is a good idea. However, this is, like, a good illustration of what it means to constrain human interaction. And then, for example, a prohibition of using email for private purposes, pretty sure that is something that might pose a challenge or a limitation in some contexts where also the private and the work life very much intersect more and more, and where there might be insecure situations because of this constraining policy.
[00:20:09] Sean: I have a gazillion questions, but I didn't want... I didn't know if Julie wants to jump in.
[00:20:13] Verena: No,
[00:20:13] Julie Haney: it. Go
[00:20:14] Sean: I wanna ask this 'cause the idea [00:19:00] when we speak to a path you can look at it a few different ways. I'd look at it as, well, if I move from here to here, from A to B, and then to C, maybe I can eliminate some of the A. But I'm, I'm also thinking, well, you still have to kinda do the A so that you can get to the B. Maybe, maybe the way A looks changes as you start to implement B. Maybe, I don't know. I guess, I don't know if I'm making sense, but I... A lot of times it seems like we continue to add more and more and more and not have an option to get rid of things. So I'm wondering your vi- your view on as we mature from constraining to enabling, do we have to rely less on constraining, or does the constraining look different? Or I don't know if that makes sense, but
[00:21:10] Verena: Yeah. Okay. I will, I'll try to answer that by just illustrating how the phishing approach might look different for considering or, like, an [00:20:00] enabling approach,
[00:21:19] Sean: Right
[00:21:19] Verena: Whereas I said constraining would very much entail trying to limit interaction with phishing emails as much as po- as possible, and where it's not possible to comply with a security policy. The considering approach would very much more start with the human and ask, like, "How can we better teach users to detect phishing? How can we perhaps do that in a more gamified way so that the knowledge better sticks? How can we design better warnings that are more salient and that users understand better?" So it would very much more focus on how humans work and make phishing detection and prevention more usable. And then, like, the slight twist to the enabling approaches would be to not only try to them interacting with phishing and warning them and teaching them, but trying to understand, for example, when things go right. So not only to learn from who falls for phish and why do they fall for phish, and how can we make this interaction more usable, but also learning, like, there are these employees who not only detect phishing emails very relia- reliably, but also that are somewhat motivated to report them or to even warn others about the threat. And I think these are the people that we can also learn from to Well, to learn from success, to derive best practices, and to consider, like, the other side of the coin. To not only consider the human as a threat or a problem, but as I said, as part of the solution or a partner in cybersecurity challenges. And you said, like, or if I understood your question correctly, the question is, like, how can we move from the one to another, or how can we... Like, is it exclusive, these approaches? So to speak, I'd say it's a typical psychology answer, yes and no, or rather it depends,
[00:23:21] Sean: Right. Perfect
[00:23:22] Verena: so I think cy- like if I just say phishing training as a measure, right? And I would ask you to classify that as an enabling or constraining or a considering approach, I might receive different answers. And that's because, like, the intervention itself doesn't necessarily tell us a lot about the mindset that's behind it, and I think that's, that's crucial because that's the starting point. So phishing training can look very different depending on the mindset I apply. So of course, across all these mindsets, I can do phishing training, but how I do it and what I teach, this can look very different. So as I said, in a constraining mindset, I would rather focus on making users comply. In a considering approach, I would think about, like, how could I design the training so that people learn better about the cybersecurity threats? And in an enabling approach, I might even, like, switch perspective and start learning from users to learn about what are their challenges when it comes to phishing? What do they do right? What motivates them to report? What are their ideas to jointly design better mechanisms to detect phishing? all of that is phishing training, but very differently. And I think here is, like, the second part to your, like, the second answer to your question. Like, are these approaches exclusive or not? And I think, also that depends. I think it's very important to reflect on these things to not run into contradictory situations. So for example, when it comes to phishing, as I, as I said, of course, we might be even gracious if someone had, like, great spam filters and automatic blocking of phishing emails so that we only needed to interact with those few phishing emails that were kind of ambiguous. However, when it comes to those, right, of course, I would also appreciate as an employee to be treated as a valuable partner in security challenges rather than just But I think there is also instances where, where these challenges might be contradicting each other. So if, as an organization, I aim to adopt this enabling or human as solution mindset, and I communicate it this way, and I tell people they are my partners in security, and they are valued. But then on the other hand, whenever someone comes with an idea, I don't take it seriously. Whenever someone reports a phishing email, I don't provide any feedback. Or if, like, someone actually clicks a phishing link, and they are, like, publicly blamed and shamed, then just what I communicate is not really credible. So I think it's important, first of all, to be aware of what, the mindset is that I want to adopt and then to consistently think it through, like from the communication to the actual actions that I take
[00:26:14] Julie Haney: Yeah, that's, that's actually a perfect segue 'cause I was, I was [00:25:00] formulating a question as you were talking, and then you started touching on it a little bit about, how these different approaches can really impact, like, how individuals within an organization feel about security. And I... It made me think of security culture. So kind of the values, attitudes, beliefs that are, that are held within the organization, both at a kind of like a high level, leadership level, but also w- you know, at an individual level of the employees. So I'm wondering about your thoughts about how these different approaches ca- impact culture, either negatively or positively with like, within a, an organizational context.
[00:27:00] Verena: Oh, that's a really good question. It's a tough one. So as I said, I'm trained as a psychologist, and so what I'm mainly concerned with is the individual's behavior and perceptions. How, al- however, also I or we respectively realize that, like, behavior is more kind [00:26:00] of the end point in security. That's, that's what we want to achieve, right? We want to make users show or adopt a certain behavior to change their behavior. this behavior is very much influenced by so many other variables, and as you said, security culture is a very important one. S- at this moment we are, like, in parallel having a project where we try to better understand how organizational factors such as security culture impact on the individual cybersecurity And there is already a plethora of research that we try to bring together that shows how, for example, leadership is a very important predictor, how the value system is important, and how they, like, alignment with, like, an organization's value system very much encourages people to identify with an organization and to behave accordingly. So these factors, they also offer lots of potentials, and I think this is also something that we have to consider if we want to look at cybersecurity holistically. of course, this is not something that can, like, psychologists can do alone. Also, there are, like, different types of disciplines or expertise are needed of people who more look at the group or the organizational level even to better understand how we can foster a security culture that, like, facilitates and enables people to show the cybersecurity behaviors that we envision
[00:28:48] Sean: And as you're describing all of this again, I speak to a lot of CISOs and then, and when they look at their security program, there's, there's the network, there's the endpoints, there's the applications, there's the data, of course, there are the users, and tho- those are all individual systems that make up bigger systems, make up the enterprise system, if you will. And I'm just wondering, is there a way to take what you have done and... Well, I'll say this first. They employ AppSec people, they employ network engineers, they employ endpoint managers to handle these different areas. I'm just wondering, do we need somebody who looks at the psychology of cyber as a role, as part of the program? And how do they themselves change their mindset perhaps to make some of that change so that they can start to apply some of these methods? I know. A lo-
[00:29:47] Verena: also a
[00:29:48] Sean: a lot in there.
[00:29:49] Verena: Yeah. I'm thinking it through. It's it's also a very valid point. So what we try to do, right? Sometimes people say, "Ah, you're like the researchers sitting in your rooms alone and d- discussing and up- coming up with theories that don't hold in practice," right? And of course, we are aware that there's sometimes a little bit of a gap between what we do in research and what we see in practice. But as we also find that our research is very much on the [00:29:00] applied science, and we would love to see it applied in practice, we also actively try to bridge this gap a lot. So we also serve as research partners in lots of communities of CISOs or security awareness professionals and industries, and go to also events where these practitioners meet to understand what their work life actually looks like, what challenges they face, how our ideas fit in there, to communicate about them, but also to incorporate their feedback on the other hand. And this is sometimes, I think, very eye-opening for both of us.
[00:30:52] Julie Haney: Yeah, I mean, that's-- yeah, those are, those are excellent points. I think to maybe wrap things up we often like to end on some practical advice that you might have. There's a lot of cybersecurity professionals that are-- and executives that, that listen to this podcast. And so if you had some advice on how [00:30:00] they can get started and kind of, you know, moving to more of these enabling approaches, like what would that advice be? Like where, where can they get started now maybe without that, that kind of psychology expert, but, you know, with what they, with the resources they have now?
[00:31:34] Verena: Yeah, that's, that's also a good point, and I think there the name of the podcast is a perfect a perfect notion, like rethinking cybersecurity. So I think a starting point is really if just everyone just reflected on what actually is my stance towards the human in cybersecurity. So I might, I might communicate that I deem the employees to be partners, but do I really act accordingly? Would I, would I like to give them more responsibility when it comes to security? Do I really listen actively to their problems and ideas and consider them? So I think that's a really good starting point, and to go from there and to just [00:31:00] try to listen to the employees, what their challenges are, not only, like, the user employees, but people dealing with cybersecurity on all levels. So that can also be developers or administrators or other people dealing with cybersecurity. To really learn from them and not only learn from what goes wrong, but also to try to understand when do things go right and how can we foster this?
[00:32:44] Sean: Yeah. Now I'm gonna jump in and say that I mean, the-- congratulations on that fantastic article. I mean, it's so well-written and completely applicable. Somebody can take and take action from it, just from what I've consumed thus far. And so I'm gonna encourage everybody to go check that out. And as you're thinking about it, think about what Verena just said in terms of how do you think about the human element as employees, as part of your own team. And I'm gonna say that this isn't new to business, right? Looking at how people think and act, and we do it all the time in marketing. We do it in product development. Shouldn't be, shouldn't be something we ignore or shy away from or avoid in cybersecurity 'cause it's a key part of the business being resilient and successful. So look for-- I'm gonna say look for areas in the business where this has been done and successful and say, "I wanna apply the same, the same thing to my program." And you might be surprised what you get. So that's, that's my two cents.
[00:33:49] Julie Haney: Awesome. Well, thank you so much, Verena, for being on the podcast. This was an excellent conversation. I'll echo Sean with encouraging people to read the article. We'll, we'll have a link to that when the, you know, when the podcast is released. So looking forward to the-- whatever research you do next
[00:34:13] Sean: Yes. That's,
[00:34:14] Verena: so much. It was a pleasure
[00:34:16] Sean: yep, so good. And [00:33:00] thanks, Julie, for bringing another fantastic human to the conversation here. It was a pleasure meeting and chatting with you, Verena. And thanks everybody for listening to this Human-Centered Cybersecurity Series on Redefining CyberSecurity Podcast. Stay tuned for more. We just recorded one yesterday, so you're gonna get back-to-back episodes with Julie and I. And I'm thrilled to thrilled to bring these back online. So thanks everybody. Stay tuned.