Renowned authority in human-technology interactions and Presidential appointee Prof. Missy Cummings of Duke University, spoke to the importance of understanding human motivation and behavior to proactively predict and detect deception. In a very candid and engaging conversation, Prof. Cummings expressed her concern about cybersecurity as a field not receiving the necessary scientific recognition and support. "Cybersecurity is not like changing the oil of your car, it is its own science," she said while discussing the various aspects of cybersecurity knowledge creation and dissemination. She also talks about her class on the Human Element in Cybersecurity and how she draws from various scientific knowledge bases (such as cognitive science, systems theory, game theory, and queuing theory) to provide a rich learning experience.

Time Stamps

00:46

How does your research on human safety in automation and robotics inform cybersecurity research?

04:28

How do human factors such as behavioral traits and motivations influence cybersecurity training effectiveness?

08:46

How do you go about analyzing and measuring unintentional human errors and malicious behavior?

13:29

As educators, what's your opinion on how widespread cybersecurity education should be? Who all should we be reaching out to as educators, as trainers?

17:19

So I worry more about the organizations which are resource-constrained and to what extent they are making those fearless calls of finding the right balance between pursuing their organizational goals and mission without compromising on having a certain level of cybersecurity readiness. Any reactions thoughts to that?

22:21

Cybersecurity is a strategic competency. It's a competency that organizations need to develop, and master over a period of time, if they want to thrive in the years to come. Thoughts reactions?

36:41

I wonder if we need regulations like Sarbanes-Oxley (SOX) Act to get people to comply, organizations to comply with cybersecurity. What do you think?

41:56

What are you trying to instill in students who take your class?

43:11

Besides regulation, what would it take for top management to recognize cybersecurity to be a key issue?

46:08

Any final thoughts?

Memorable Missy Cummings Quotes

"You want to keep your friends close, but your enemies closer."

"If we can figure out how to get in the minds of the people who are doing the deceiving, the hacking, that is another way to mitigate cybersecurity attacks."

"If you can actually develop a good model of a human's engagement in their everyday work practices, you can actually figure out when is the right time to deceive them."

"Cybersecurity is a living process, it's not just a check in the box."

"We're just missing a core recognition at universities that cybersecurity is not like changing the oil of your car, it is its own science."

"A lot of companies are not going to get at least good enough cybersecurity practices unless you force their hand."

"I think the number one change that needs to happen, is for government, industry, and academia to recognize that like COVID, cybersecurity is here to stay. And the longer you keep ignoring it, the worse it's going to get."

"Systems-level thinking and cybersecurity, to me, they're one and the same."

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Welcome to the Cybersecurity Readiness Podcast

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

A Holistic and High-Performance

Approach by SAGE Publishing. He has been studying cybersecurity

for over a decade, authored and edited scholarly papers,

delivered talks, conducted webinars, consulted with

companies, and served on a cybersecurity SWAT team with

Chief Information Security officers. Dr. Chatterjee is an

Associate Professor of Management Information Systems

at the Terry College of Business, the University of

Georgia, and Visiting Professor at Duke University's Pratt

School of Engineering.

Hello, everyone, I'm delighted to

welcome you to this episode of the Cybersecurity Readiness

Podcast Series. Today, I have the pleasure of talking with

Professor Missy Cummings, of the Pratt School of Engineering,

Duke University, about the significance of the human

element in cybersecurity. Professor Cummings is a renowned

authority in human-technology interactions. In October 2021,

the Biden administration named Cummings as a new Senior Advisor

for safety at the National Highway Traffic Safety

Administration. A naval officer and military pilot from 1988 to

1999, Missy was one of the Navy's first female fighter

pilots. She is an incredibly gifted and accomplished

academic. It's truly an honor to have her as a guest on the

Cybersecurity Readiness Podcast show. Missy, welcome! Thanks for

making time. I'd like to get started by asking, how does your

work on human safety in automation and robotics inform

cybersecurity research?

Well, first, let me say thank you for having me,

it's a real pleasure to be here, and as a researcher, I'm

relatively new to conducting research in this field. But it

really came about because of the work that I've been doing in

human interaction with autonomous systems. And I would

say the real point of my entry was, as we were starting to in

my lab, we were starting to evaluate how much humans err in

the construction of artificial intelligence and how human

subjectivity can cause problems in the design of AI, I think

that one of the natural kind of gotcha points there, was then

the influence of humans who are designing these technologies,

and then cybersecurity vulnerabilities. And so I just

naturally ended up going down that path, because there are so

many problems with vulnerabilities and artificial

intelligence. And it's still such a nascent field, people

don't even understand how and where the vulnerabilities are

when we create AI. Then then I got fascinated as I started to

dip my toes in the water, I started to think about

deception. And because that's fundamentally what cybersecurity

is, and social engineering, as you and your audience will know,

is the number one threat access that people, companies, face in

cybersecurity attacks. And so I started really getting

fascinated by, we spend so much time trying to prevent

deception. What if we could get inside the heads of people to

maybe predict how when why people deceive and start

thinking about it from the other end? And so, I have some

research underway with various other collaborators where we're

thinking about how to model deception kind of proactively,

because, you know, I, you want to keep your friends close, but

your enemies closer, right. So, yeah, so if we could figure out

how to get in the minds of the people who are doing the

deceiving, the hacking, that is another way to mitigate

cybersecurity attacks.

Great. Welcome to the field. I'm

delighted to have you as a colleague in this area. As you

know, as you alluded to this, cybersecurity has to be

approached multi-dimensionally, there's a technical side to it,

there is a very strong human side to it, there is an

organizational side to it. So, when you speak about the human

factor, when you talk about deception, trying to understand

deception, it also brings to mind what motivates people? And

I say, say that from the standpoint of cybersecurity

training, as you know, we all get trained uniformly,

consistently. But when it comes to applying the, the, what we've

learned, the implementation of that varies from person to

person for a variety of reasons, some of which relates to

behavioral traits. Is that something that you can relate to

and speak about a little more about the importance of the

human factor from the standpoint of cybersecurity training?

Well, first, I would just tell the audience,

and I'm not sure if you can make these documents available, but

I'd be happy to give everybody my syllabus from the class that

I just finished teaching called the human element and

cybersecurity, because it really speaks to that. What are all the

core fundamental first principles to cybersecurity,

human behavior, and even some systems engineering? And I will

tell you, I would kind of argue first with your assumption that

we're all sort of uniformly trained. Oh, haha, I mean, I'm

kind of laughing holding my stomach, oh, my gosh, the one

thing that I really started to uncover when I was developing

this class on humans and cybersecurity is, it is just

amazing to me, how uneven the training space is that out

there. And, you know, I mean, there's a lot of truth to the

fact that maybe big companies take cybersecurity more

seriously, because they're bigger targets. And thus, maybe

they have better cybersecurity practices. Maybe I say maybe,

because we see big companies all the time really get in a bind,

because they have very sloppy cybersecurity practices. And so

one of the things that I think is a very interesting Venn

diagram, for the way companies think about cybersecurity is

they think about it last, kind of, if at all. And that is also

the same problem that just basic human factors consideration has

in the design of any product, right? So if we design a

technology with autonomy, maybe if at all, we consider the human

and it's the same thing for cybersecurity. And so then

there's that shared Venn diagram, which means that if

it's a human security issue, cybersecurity issue, then you're

definitely not going to get it funded, right. Companies don't

want to spend the money or the time and the effort. And yes, it

takes time and effort, and I'm a big fan of having the US

government start to put in at least requirements for companies

that work with them. Right, as a, as a veteran, and, and a

person who works with the government, my identity is

constantly stolen through the government, you know, through

every kind of breach that the government has my ID is stolen.

So I would like to close that gap. But it is difficult for

private companies, you know, if you don't mandate it, and it's

funny, because there is there's kind of a shared similar

argument over vaccines, you know, like, we're all at risk.

When a company refuses to embrace at least standard

cybersecurity practices. We're not asking them to go one above.

So I do think that this the problem that we're having in

this country and in other countries is really still one of

the more core issues of what do companies really value, they say

in the boardroom, that they evaluate that they value ESG

(Environmental, Social, and Governance) and cybersecurity,

I'm afraid this is still really at the lip service level as

opposed to actually being real.

Absolutely. You've covered a lot of ground.

Let's see if I can follow up on some of the things that you were

talking about. When I mentioned about standardized cybersecurity

training, I was referring to, let's say, a company hires an

organization to train their employees in detecting or

preventing phishing attacks. Let's say a group of 10 people

get trained. Research finds that subsequent to training, some of

them perform better on the phishing tests than others. And

they have associated the difference in the results to

human curiosity, perception of potential personal losses and

other factors. So, I was coming at it from that perspectives.

That irrespective of the quality of training imparted, effective

assimilation depends on factors such as innate curiosity, greed,

perception of potential loss and more. But anyhow, switching

gears a bit, you mentioned about your class, and I was reviewing

your learning objectives. And one of them that got my

attention is about analyzing and measuring unintentional human

errors and malicious behavior. Just curious, how do you go

about doing that? How do you go about measuring that?

Well, for unintentional behaviors, you

know, it's it's actually in our wheelhouse of everyday ways to

measure human performance, you can measure, and I'm sure most

companies who are very proactive do this, you know, whether or

not people click on phishing emails, the kinds of behaviors,

I recently had my students conduct analysis of email

patterns, you can actually take someone's email and understand

just by the logs of the email, of when they're opened, how long

they're opened, how much people interact with email, whether

they're just reading them or writing them, you can actually

get a very good model of a person's workload over time. And

indeed, you know, we do see phishing attacks, success on

basically at two different times number one, when people are

super busy, and they don't take the time to read an email, or

the kind of the the counter to that is, when people are really

bored. And there's an email that comes in, that's just

interesting enough to make somebody want to click that

attachment or click the link. And so if, if you can actually

develop a good model of a human's engagement in their

everyday work practices, you can actually figure out when is the

right time to deceive them. And, you know, one of the problems

with working doing work in this space is I have my students

develop these models, or I have them develop plans for how to

how to hack, and then you know, we don't we can't actually do

them, you know, for ethical purposes. I mean, I keep telling

my students over and over, you know, these are, you know, we're

just here for a learning engagement. And then I had a

student, they all had a final project where they had to go

figure out some kind of project related cybersecurity, and they

could propose their own. And I had one student proposed that,

that he would go onto GitHub and find out where everyone was

vulnerable in how they're using GitHub. And I thought that was

good from just a, you know, let's just do a descriptive

analysis. But then later, I found that he was going in and

trying to hack people through GitHub and say, Look, I was just

doing I mean, no, no, no, no, no, you know, I think that's a

that is kind of the interesting thing. First of all, if you're

on GitHub, be careful because my student knows how to go in and

hack you. But it's just it's so easy to do. And there's so many

points of access now that I think that that line between

what is what is just trying to do good research, or, you know,

trying to prevent and learn more about hacking. I do wonder

sometimes did I actually create some hackers?

And And it's funny, because you

mentioned about students going into GitHub and trying to figure

out how to hack and many of them are technically inclined,

they'll figure it out, in fact, lots of information out there

for that. That brings up a very fundamental question that's very

close to my heart. And that is, as you know, when organizations

get breached, and when it's a phishing attack, the person or

the group of people who are compromised, they are not the

cybersecurity experts. They are not the ones who are technically

very savvy, at least that's information that's publicly

available. Given that perspectives, as educators,

what's your opinion on how widespread cybersecurity

education should be? Who all should we be reaching out to as

educators, as trainers? Does that make sense?

Yeah, so, you know, I think it's a great

question, because companies are going to say, well, you know,

we're going to get we're going to give everybody training

cybersecurity training on how to how not to click on that link.

And a lot of companies will want to be a one and done, right. I'm

just going to give one training session and be done.

Unfortunately, cybersecurity follows what I would consider

safety critical event model which means that you can think

of airlines and, you know, just aviation in general, there'll be

an accident. And then right after the accident, everyone is

super safe. And so you could if you think about it's, you know,

there's a sharp up uptick in safety, and then there's this

degradation time period over time, then everybody gets unsafe

again, and then there's an accident, and it spikes up

again. And indeed, that's exactly what happens in

cybersecurity. So we're, we're, you know, there'll be a breach

from one company that a bunch of ever all the other companies

will do a one and done, and then they'll forget about

cybersecurity training. And then there's another breach and so we

just keep that cycle, what we need to be is more proactive

about, what would the, what would that look like? Could you

be more proactive in predicting what that time cycle is? And I

think the other problem is we need to do it. It is difficult

because the threat vectors are changing so radically, for

example, COVID, just introduced an entirely new area of

cybersecurity. So I think companies need to not be so

predictable, in the way that they respond and understand

that, that did it. Cybersecurity is a living process, it's not

just a check in the box. Now, I also appreciate how hard it is

to keep everybody engaged in my class, we ended up analyzing

various different companies, training programs. And you know,

it's easy to get stale. And so how to keep that tech, how to

keep their training programs fresh, and people engaged. I

it's just like all training for anything to do with safety. It's

hard to keep people engaged until some bad event happens.

But I think if you have a very clever chief risk officer, and

that's another big issue that I don't see enough companies

working on is, you know, we want to have a CTO and a CFO, but,

you know, only the big companies think that they can afford to

have a chief risk officer. And and, indeed, you know, all these

companies that have paid out all these ransoms, you know, I

wonder how that would have worked for them, if they would

have put the chief risk officer in place.

You're, you're so spot on, in fact, risk

factor, or assessment of risk should be integral towards

evaluating every initiative that a company is planning to pursue.

And when I say every initiative, I'm talking about strategic

initiatives, and there are lots of frameworks out there that

guide organizations to do so. So the question is who's following

to what extent and you kind of talked about this reactive

mindset, this reactive mentality. And, you know, I

think it's easier said than done, that we should be

proactive, we all should be proactive, but the reality of it

is, most of us, we respond to fear, we respond to incidents,

when it happens to us, we sit up and try to do things to take

corrective action. But when it's not happening to us, and when

everything seems to be going fine, it's like a company not

experiencing any attacks, they tend to ignore the good work

that's probably happening behind the scenes thanks to their

cybersecurity team and others. So it's a it's a chicken and an

egg problem. But definitely being proactive is critical. And

the importance of top management actively engaging, you mentioned

about how serious top management is, is often hard to gauge. And

I don't know if that has anything to do with the

consequences of the attacks. There are some large companies

out there who have been attacked and ask per public records, they

have taken action so that those attacks don't happen or they

reduce those risks, but they're not going away. It's not like

their future is at stake. It's the medium size businesses that

tend to go away; 60% of the medium size businesses that have

been hacked, have gone under, if my stats are correct here. So I

worry more about the organizations which are resource

constrained. And to what extent they are making those fearless

calls of finding the right balance between pursuing their

organizational goals and mission without compromising on having a

certain level of cybersecurity readiness. Any reactions

thoughts to that?

Oh, sure. So I have my students tell me at the

end of every class, what they would do if they were a hacker

and what would they do if they were a chief risk officer and

they had learned what they learned during whatever that

particular lecture is, and one common theme that happened

repeatedly after the various lectures were that I would hack

a startup company for problem, you know, thing X, right?

Because startups are really trying hard to make a product,

make a splash, get more series funding. And indeed, just like

trying to plan for human interaction issues,

cybersecurity is again seen as oh, well, this is a nice to

have, it's not a must have. And so I'm just going to push this

down the road. And I would actually say that, to me, in my

mind, if I were a venture capitalist, that would be one of

the first questions that I would ask a bunch of startups that I

was looking to invest in is, look, I understand it's a high

wire act. But in the end, if you've got a cybersecurity

vulnerability, and it could take down the entire operation, then

why should anybody invest in that? And I certainly see this

anywhere where we've got a lot of these new startup

technologies, where they're using, for example, GPS, whether

we're talking about drones, or cars, or small sidewalk delivery

drones. It is so easy to do a GPS spoof on a vehicle, any kind

of vehicle and I would actually say that is my number one

question. When I ask people who are working in these

transportation and or delivery spaces. What are you doing about

GPS cybersecurity, and they look at me like a deer in the

headlights? Ah,

what I did out GPS spoofing, what's that? And so I think, Oh,

my goodness,

we are in serious trouble. You know, so awareness. Again, one

of these issues. And, you know, I think it might be I, I know

that there's a lot of money to be made in cybersecurity. But I

also think that universities are really good about providing

workspaces, and they want to, you know, help, do help

startups, angel funding, that kind of thing. But I also wish

that we would spend more time and thinking about, Okay, well,

what would angel funding look like, just for cybersecurity for

startups, because that actually has dual benefit, not only does

it keep that company safe, but then that end above itself could

be its own product,

Absolutely, in fact, brings to mind one of

my prior guests, who got funding to start his company Trusona,

and they focus on passwordless authentication. So I think

that's a good product, or that's a good approach to strive for,

there is no perfect approach. But that's definitely something

to, you know, move in that direction. Another thought comes

to mind as we are having this discussion. You know, we are

making progress technologically, you do a lot of work in the

field in the area of AI. We are making these fancy cars, they

are supposed to self drive, which is all great. But we also

recognize that the more technologically advanced we get,

the more vulnerable we become, for a variety of reasons,

including information security. So that begs the question, or

that's, that's something that I address in class when I tell

students, that technology is great. But mindless use of

technology is big kind of stupid. Making judicious use of

technology. And and that relates to cybersecurity from the

standpoint of, yes, I want to run after my strategic goals.

But I better be properly anchored because I can't afford

to lose my operating engines, my databases, my systems, because

if I lose them, then it's the short term thinking, I might go

wander. Having that rich perspective where you're growth

driven, you understand what it takes to take the company to the

next level. But you also recognize the different pieces

of the puzzle that helps anchor the company and one of which is

cybersecurity. Providing that kind of holistic education, I

think is where universities come in. You mentioned about

companies providing students cybersecurity training, and

absolutely every company has their own customized approach.

But I think at the university level, we can offer them a much

more comprehensive insight into what it takes to whether you

create a company and run it or whether you run it and how the

different pieces fit together and how and why it is important

to keep cyber security as an integral part of of the overall

strategy. I in fact, suggest that I've said it very you know

emphatically that cybersecurity is a strategic competency. It's

a competency that organizations need to develop, and master over

a period of time if they want to thrive in the years to come.

Thoughts reactions?

Yeah, wow. I mean, we are about to go down a

rabbit hole, you did not want to go down. And that is because I

have a huge beef with the academic world in the way that

it thinks about cybersecurity, or more broadly, something we

call assured autonomy. And so the idea is autonomous systems

have can operate, and most do operate in a non-deterministic

fashion. And so that opens up a whole new can of worms for

cybersecurity. But and I'm not just speaking about autonomous

systems, I think more broadly, wherever you've got digital

systems, cybersecurity by the academic world, and who am I

speaking of I'm speaking of most of the most of the top tier

research universities, top 30. Most of these organizations

treat cybersecurity as a stepchild in the sense that they

do not see it as legitimate research, that this is

engineering, and it's not research. And so we should not

teach it as a formalized set of courses. Now. It sounds you many

people listening to this be like what the academic institutions

don't think that cybersecurity is a legitimate field? And I'm

here to tell you, they don't. Now that's not true, because

obviously, Duke, it's not sure everywhere, Duke has just

recently stood up a cybersecurity program. But you

know, that is the exception rather than the rule. And be and

people will say that's not basic science. What is basic science

about cybersecurity? And so this is actually one of the reasons I

developed this course, in cybersecurity in humans to so

that people could understand. Do you know what the basic science

that we cover my courses, we start with cognitive science, we

embed game theory, we engage we talk about queueing theory, we

talk about systems thinking, right? So there are so many core

scientific clusters of learning that underpin cybersecurity. And

by the way, that was just for one course, if we started

talking about what what would we find in other courses, formal

methods, and lots more statistical learning. And so

there are many, many core scientific areas that are the

foundation for cybersecurity. So it is actually really my

criticism. And by the way, my criticism is severe, because I

think that the inability of our nation, our nation's agencies,

like the National Science Foundation, and even other top

30 universities, to really grasp this means that this country is

in a serious, vulnerable position. And if we're not

funding the research, then we're not funding the technology and

innovation development that needs to happen to put us out in

front. We are not out in front in cybersecurity, the US is not

the leaders in cybersecurity, the US can be brought to its

knees by a bunch of hackers in Nigeria. I mean, that's, that's

actually that's how you have to ask yourself, if we're so

awesome, why is it that that someone from a country that is,

you know, not nearly as well developed as our country as our

nation can have so many problems by people where the bar of entry

is virtually nothing. So I do wish that we would, as a

country, and in academia raise the alarm bells that this is

these are legitimate areas of study, trying to get more

journals stood up in this area and more traditional, you know,

types of ways that we disseminate research results.

One good area is the Department of Defense, regardless of how

you feel about the DOD, the bottom line is, they see that

it's a problem. And certainly the US government is trying to

do more in this space. So the more that we the government

agencies start to embrace and mandate that their efforts

funded in the area of cybersecurity, the better will

be but I still think we're just missing a core recognition at

universities that cybersecurity is not like changing the oil of

your car. It is its own science.

Absolutely. Wow. I love the fact that you

went down that path. I could continue in that direction, but

I'll keep my reactions and remarks short. Like you said,

you use the example of cybersecurity to make the point

that many might feel that doing research in this area is not

considered scientific. And again, I do not want to assume

stuff, but to keep it simple, research is about solving

problems. And as you try to solve problems, you end up

coming up with theories, better understandings, which

ultimately, you know, can transcend, transcend, and can

enhance your ability to explain multiple phenomena. And talking

about the theoretical development that can come from

cybersecurity research, the work that I've done so far, I see so

many connections, because 17 Success Factors came out in my

work when I was trying to identify what it takes to create

and sustain a high performance information security culture.

And each of those factors have strong grounding in research,

you know, that has been pursued over decades, one of which, of

course, is the role of top management. So there is a lot of

connectivity. Now, I approach research a little differently, I

do not do research, to inform theory or to enhance theory. I

like to do research which I find interesting, which is going to

have impact. And then in the process, if I create great

theory, that's great. But But no, I think your points are

extremely well made. And talking about the role of government and

the private sector, you will remember that we had the the

Colonial Pipeline breach. And that resulted in some

congressional hearings. And the senior executives, the senior

leadership of this organization, along with others, who are

managing the critical infrastructures, they are now

being pushed or asked for major disclosure, in other words,

provide more transparency, that you are doing enough to protect

our national assets. And I'm kind of surprised that it took a

breach to get there. I would think it is common sense that

whether your organization is protecting national assets or

any other asset, any other consumer asset, you must do your

due diligence, you must report to the relevant stakeholders,

there must be adequate transparency, so I kind of get

surprised when I see these. Okay, here are the new things we

will be doing. And government, private sector, they are

separate, but in many ways they need to come together.

Similarly, academic organizations, academic

disciplines, yes, we have our specializations, but I hope you

will agree that cybersecurity is an example that is a phenomenon

that requires cross disciplinary expertise and involvement. So

you shouldn't be leaving anybody outside and say, Well, this is

the domain for such and such field. And they are the ones who

should be doing research in this area. So having that openness to

collaboration, to cross functional involvement, whether

it's in practice or in academia, is critical to dealing with

problems of this magnitude, where it is just not enough for

a specific company, or a government to effectively deal

with the threat. We need the entire ecosystem,

organizationally, across countries to come together and

fight the good fight. So that's how cybersecurity kind of brings

us together, just like COVID has proved to us over and over again

that whether we like it or not, we are all highly

interconnected. If we don't do our part, we are not going to be

able to deal with this pandemic effectively. Cybersecurity is

the same kind of problem, the more interconnected the systems

become. While there have definite benefits of that, the

more vulnerable we become. And we can't, each one of us has a

role to play See, look the other way, there's going to be a

breach at some level with long term impact. So that's my little

spiel,

You got me going there. Thoughts reactions?

Oh, yeah, you know, the Colonial Pipeline for

people in the business, nobody was surprised. Right? It was

just a matter of time because Companies are extremely slow to

change. And, you know, I'm not generally a fan of strong

regulation. But when it comes to these safety critical elements

of systems, you know, if I told you that you that we were going

to let the FAA, you know, we were going to take care of the

FAA out and let companies do whatever they wanted in terms of

safety of airplanes, nobody would get on an airplane. Right.

And so, you know, this is yet another safety critical system,

where if we don't take care of some of these, especially for

infrastructure, and other safety, critical systems,

process control, for example. So yeah, you know, unfortunately,

Henry Petroski, who's another professor at Duke, he talks

about engineering failures, that sometimes engineering failures

have to happen, because that is the only way that the industry

is going to grow. Sadly, I think that applies to this as well.

Right? And, and like we talked about, it's basically some kind

of work sine curve where we have to keep it has to keep happening

over and over again, for us to be reminded that we need to keep

doing it. So you know, that's where I think that's where there

is a lot of room to figure out like, Alright, then how should

we if we know that there's going to be episodic movements and

technologies being developed, and especially now all the

vulnerabilities that artificial intelligence introduces, how can

we start being proactive instead of being reactive? So that's

where I'd like to spend some of my research efforts.

Makes total sense. Going back to your core

research in safety and automation, as you have pursued

research in that area, hopefully you've seen progress. What do

you expect to see in the field of cybersecurity, in the years

to come? And I realize I'm asking you to wear your

predictive hat, and look ahead and see what's coming. You think

we will get a better handle on how to deal with these threats,

whether it's through better technology, superior governance,

or more effective regulation. Talking about regulation, I'm

reminded of the effectiveness of the Sarbanes Oxley Act (SOX) to

reduce fraudulent accounting activities. I wonder if we need

similar legislation to get organizations and their

leadership to comply with cybersecurity best practices?

What do you see happening?

Yeah, so I kind of think about this as a three

circle Venn diagram. There's cybersecurity mitigation,

people, technology and regulation, right. So there's a

little bit to be done and all of that, I think regulation

certainly needs to be more proactive in that keep companies

and subcontractors who touch safety critical systems, this

should just be mandatory. And they're, you know, there is

movement along this front. But you know, I've been working in

and around the government for the last, you know, 10 years.

And so I've seen the big gaping holes, there's not one

department in the government that I think has a good

cybersecurity strategy. And by good, I mean, they know that

they need help, but they just don't have all the right people

that they need to make these programs safe. I mean, when

we've got the National Security Agency being hacked, you know,

we got serious problems, right. So. So I think that there's a

lot to be done on the regulatory front. Because unfortunately, in

the space companies, not all companies, but a lot of

companies are not going to get at least good enough

cybersecurity practices unless you force their hand. But I

would actually say of those three Venn diagrams, that's the

smallest. So I think we should spend a lot more time in

technology developments. You know, the fact of the matter is,

we should be able to stop phishing emails like that.

There's no, there's no magic solution. There's, it's not like

we got to solve cold fusion to figure that out. We've got some

filtering technologies and some search technologies and some ID

technologies, maybe even figuring out how to run ghost

servers so that these problems don't happen. But, you know, we

I think that that just and this is where research is needed,

like how can we actually develop more efficient programs and

another technology for example, that we need help on VPNs are

like, you know, it's like trying to add a big analog system to

your fast digital system. It just slows it down and people

get so mad at VPNs and I know people from all sorts of

companies who bypass the VPN just for this one thing, right?

And then that's where they get compromised in some

cybersecurity. So, you know, we should be able to solve that

problem VPN don't have to slow technology down. So let's, let's

improve that. So, you know, I think there's a lot more to be

done on the technology front, I think there's a lot more to be

done on the human front. I do wonder if companies ever sit

back and say, why is it that we are so vulnerable to the time of

COVID? Because people are lonely and bored, and the quality of

work is not meaningful, right. So I think there's a lot for

companies to do to think about. How can we make our work

processes and environments such that hacking is not successful?

And how can we make everyone and at least participatory in trying

to stop hacking and mitigation and make that a more integral

part of our everyday work processes, instead of everybody

eye rolling every time they have to go take a online

cybersecurity training that no one's listening to, and they're

doing something else. They're like cooking or doing their

taxes or doing something while theoretically the online

training is happening? So, you know, I think, I think there's a

lot to be done, I think we are getting better. I don't mean to

be the Debbie Downer and saying, it's all miserable, because

obviously, we are making improvements. But I think that

the number one change that needs to happen, for government and

for industry, and for academia is to recognize it's kind of

like COVID, look, this is here to stay. And the longer that you

keep ignoring it, the worse it's going to get?

Absolutely, absolutely. I'd like to go back

to your class, the classes on human factors. And I'd like you

to share with listeners, what are you trying to instill in

students who take your class?

I would say the number one consideration that I

want my students to leave with, after they take my class, The

Human Element in Cybersecurity is that cybersecurity is a

systems-level problem. That there is no one you know, just

stopping pfishing is not going to stop cybersecurity and that

to take to address it properly, you need to think about it first

from a requirements perspective, what does my company need? How

does it need? Why does it need? when does it need? Or what

facets of the company need what various mitigations and then

integrate the cybersecurity aspect at all levels of product

development. And understand that it's integral not an add-on

harassment package, that higher level of management is imbuing

upon the rest of the company. So yeah, systems-level thinking,

cybersecurity, to me, they're one in the same.

Okay, fantastic. Now, I'd like to go

back to something you talked about relating to senior

management, top management, because you'd appreciate that,

at the end of the day, in a in an organization, the the tone is

set at the top. Top management really has to make the

commitment, they have to believe in it and do the needful. And

you mentioned that based on your fieldwork, you found significant

variance in that; I don't mean to misquote you, so correct me.

But I'd like your thoughts and perspective on --besides

regulation, what should it take to get top management to

actively recognize this to be a key issue, that's something that

you can't walk away from, and meet it head-on, and get the

organization prepared to proactively deal with this

challenge?

Well, if right, if the regulatory lever is not

going to be pulled, I think the next regulatory or the next

internal regulation lever that should be pulled is probably a

mandate from a board. For example, if it's a publicly

traded company, or if it's a non public company, if they have a

board, you have to have some kind of external lever of

accountability. Because if you don't have that, you know, it

depends. The companies who are successful in fending off

hacking attempts are those that have good people that understand

and are taking care of that, in the end that the CEO is, first

of all, has hired those people and given them the latitude that

they need to solve those problems. Unless the CEO, I

really think cybersecurity is a leadership issue, because unless

the CEO values it and demonstrate to the rest of the

company that they value it, then everybody else is just going to

follow the lead and be very haphazard. And so, you know, the

resources have to be set aside. And it needs to be transparent

and visible to the rest of the company that these things are

valued. Instead of I see, I would say, for the bulk of

companies out there, the CEOs just give lip service to

cybersecurity and say, Yes, and, you know, maybe we've got McAfee

and that's what we're doing. And unfortunately, that's not

enough. And, you know, or maybe we force people to do some

really cheap online training that people are not listening to

while they're doing many other tasks. And so, you know, taking

it seriously and instead of eye rolling and saying, well, this

is just something I have to do instead of not something that I

should do. I think that's the real problem.

Fantastic! Well, that was terrific, Missy.

Any final thoughts as we wrap up our discussion today?

Leadership starts starts with the man or

woman at the top.

Fantastic. Well, looking forward for future

discussions on this topic. This was really fun. Hope you had a

good time. It was great. A special thanks to Professor

Missy Cummings, for her time and insights. If you liked what you

heard, please leave the podcast a rating and share it with your

network. Also subscribe to the show, so you don't miss any new

episodes. Thank you for listening, and I'll see you in

the next episode.

The information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an as-is basis with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.