Artwork for podcast Cyber Ways Podcast
Are cybersecurity sanctions effective? A conversation with Dr. Mikko Siponen
Episode 2426th September 2024 • Cyber Ways Podcast • Tom Stafford
00:00:00 00:33:32

Share Episode

Shownotes

Most organizations use sanctions as a way of enforcing cybersecurity policies and encouraging sound security behaviors. But few organizations ever test whether these sanctions are effective. Often they aren't; in fact, when used improperly sanctions can backfire. In this episode of Cyber Ways, Tom and Craig talk about sanctions and their effectiveness with Dr. Mikko Siponen of the University of Alabama's Culverhouse College of Business. Dr. Siponen is among the world's leading scholars when it comes to understanding the effects of sanctions on cybersecurity behaviors. Listen and learn how your organization can use sanctions more effectively.

Guest bio:

Dr. Mikko Siponen is Professor of Business Cybersecurity and Management at the University of Alabama's Culverhouse College of Business. He holds advanced degrees in Software Engineering, Information Systems, and Philosophy. A leading scholar in Information Systems, he ranks among the top 30 worldwide based on publications in premier journals. Professor Siponen is the only Finnish IS professor invited to join The Finnish Academy of Science and Letters. His expertise spans cybersecurity management, IS development, and philosophical aspects of IS. He has extensive experience as a visiting professor, consultant, and research leader internationally, with a particular focus on cybersecurity management.

Key Topics Discussed:

Sanctions and Cybersecurity Policies:

  • Effectiveness of Sanctions:
  • Sanctions can work even without prior direct experience.
  • Firsthand sanction experiences may enhance effectiveness.
  • Can backfire if perceived as unjust, leading to resentment.
  • Employees' Awareness and Knowledge:
  • Typically lack detailed knowledge of cybersecurity policies.
  • Inadequate training contributes to confusion and non-compliance.
  • Policies often conflict with practical organizational needs (e.g., link clicking).

Training and Effectiveness:

  • Deficiencies in Training:
  • Often generic and check-the-box nature, hence ineffective.
  • Rarely measured for effectiveness by providers.
  • Recommendations for Improvement:
  • Demand effectiveness metrics from training providers.
  • Training should reduce cybersecurity risks significantly.

Practical Implications and Recommendations:

  • Sanctions as a Deterrent:
  • Active Sanctions:
  • Monitored closely but can backfire if perceived as unjust.
  • Passive Sanctions:
  • Applied only when necessary, safer from backlash.
  • Communication and Awareness:
  • Clear, effective communication of cybersecurity policies and sanctions is crucial.
  • Must bridge the gap between policy and practical enforcement.
  • Balancing Fairness and Consistency:
  • Consistency across departments is vital to ensure fairness.
  • Fair sanctions are essential to prevent demotivation and resentment.
  • Sanction Implementation Tips:
  • Consider firm culture and employee perspectives.
  • Pilot test sanctions; gather employee feedback.
  • Obtain management support and recognize the impact of unions.

Understanding Employee Behavior:

  • Psychological Impact:
  • Sanctions can have long-term negative effects on employee perception.
  • Need for research on the psychological impact, especially for rule-breakers.

Current Research:

  • Dr. Mikko Siponen working on:
  • Understanding and prevention of cybercrime through offender-victim communication.

Industry Trends:

  • Increasing sophistication of threat actors, potentially enhanced by AI.

Takeaways for Security Managers:

  • Sanctions need careful, context-sensitive application.
  • Ensure policies are known, understood, and perceived as fair and justified.
  • Training must be specific, engaging, and measured for effectiveness.

Cyber Ways is brought to you by the Center for Information Assurance, which is housed in the College of Business at Louisiana Tech University. The podcast is made possible through a "Just Business Grant," which is funded by the University's generous donors.

https://business.latech.edu/cyberways/


Transcripts

Speaker:

Hi, folks. This is the Cyberways podcast, and we

Speaker:

translate our academic knowledge about information security into stuff that you

Speaker:

can use as a security professional. We think it's a unique mission. We think you'll

Speaker:

like it. I'm Tom Stafford. Craig Van Slyke. Tom and I are your hosts on

Speaker:

your journey to knowledge. Cyberways is brought to you by the Louisiana

Speaker:

Tech College of Business's Center For Information Assurance. The center offers

Speaker:

undergraduate and graduate certificate programs in cybersecurity and

Speaker:

sponsors academic research focused on behavioral aspects of

Speaker:

cybersecurity and information privacy. Hello,

Speaker:

everybody, and welcome back in to cyber ways. This is a

Speaker:

production of the Louisiana Tech Center For Information Assurance in the College of

Speaker:

Business. It's a DHS NSA certified center of academic excellence in

Speaker:

cybersecurity, and we consider one of our jobs is to connect

Speaker:

you with the people that know what's happening in security research so you can

Speaker:

take advantage of the very best findings in the most timely manner.

Speaker:

Our our special guest today is doctor Mikko Sipinan. He is professor of

Speaker:

business, cyber security, and management at the University of Alabama's

Speaker:

Culverhouse College of Business. He holds advanced degrees,

Speaker:

several advanced degrees, in software engineering, information

Speaker:

systems, and my favorite of his group of degrees, philosophy.

Speaker:

He's a leading scholar in information systems, one of the thought leaders in our

Speaker:

behavioral information assurance workshop group. He

Speaker:

ranks amongst the top 30 worldwide for publication,

Speaker:

taking 2. He ranks among the top 40

Speaker:

worldwide based on his publications in premier journals.

Speaker:

Professor Siponen is the only Finnish IS professor who's been invited to join the

Speaker:

Finnish Academy of Science in Letters, and his expertise spans

Speaker:

cybersecurity management, IS development, and philosophical aspects of

Speaker:

information systems. He has extensive experience as a visiting professor, a

Speaker:

consultant, and a research leader internationally with his particular

Speaker:

focus on cybersecurity management. Mikko, welcome to our podcast.

Speaker:

Thank you. It's great to be here, and nice to discuss about sanctions and

Speaker:

how they work, and what kind of things you should avoid

Speaker:

if you are planning to use sanctions in your firm. So

Speaker:

what has had my attention for a number of years in the, the workshop group

Speaker:

that we all attend is, the role of sanctions and how they have

Speaker:

an effect on better cyber security. And, so

Speaker:

I I guess the question at the top of this, do sanctions work? How do

Speaker:

they work? Sanctions can work,

Speaker:

but if you don't use them carefully, they can also be worse than useless.

Speaker:

So that's why you have to be very careful when you're

Speaker:

using sanctions. And today, I will discuss

Speaker:

what we know and, you know, what kind of things you should avoid and so

Speaker:

on. So you you need to make sure that you understand what makes

Speaker:

sanctions effective and what to avoid. And,

Speaker:

luckily, many of of these questions about the effectiveness

Speaker:

of sanctions have already been answered in the in the scientific literature.

Speaker:

Actually, in cybersecurity management, sanctions have been studied over 30

Speaker:

years, especially in information systems, IS side of

Speaker:

cybersecurity security literature. Talk to us about the factors that

Speaker:

determine whether sanctions are effective or not. Yeah. There are

Speaker:

quite many. The most studied aspects are

Speaker:

what people call certainty of sanctions and the severity of

Speaker:

sanctions. So let's start with these 2 first. So the

Speaker:

certainty of sanctions means, basically, likelihood of getting

Speaker:

caught. So it means the likelihood that active

Speaker:

your activities will be detected and identified for the purpose of

Speaker:

sanction. And I will keep very soon, I will give you examples. Okay. The

Speaker:

other well known well studied aspect of sanction

Speaker:

is is the severity of punishment. It basically means

Speaker:

that if you get caught or somebody get caught, you

Speaker:

know, how harsh or big is the

Speaker:

penalty. And in the literature, these are

Speaker:

often presented in a way that the higher is the certainty

Speaker:

and severity, the less risky cyber

Speaker:

cybersecurity behavior will follow. And, of course,

Speaker:

on these two dimensions, there are few many which

Speaker:

I'll, explain later. People are talking about likelihood

Speaker:

of getting caught and and the severity of punishment. These

Speaker:

are refers to people or, in this case, users'

Speaker:

perception. For example, they they perception of

Speaker:

the likelihood of detection and and severity of punishment. So let's

Speaker:

illustrate this this with a very simple example first,

Speaker:

which is familiar to everybody, namely driving over the speed limit.

Speaker:

What the certainty of detection means, it means that

Speaker:

if you believe that there is a police radar, you know, when you drive,

Speaker:

on a highway, you are more likely to drive within the speed limit.

Speaker:

So more radar, more the more likelihood you believe there's a police radar,

Speaker:

the less you are likely you are driving over the speed limit. That's the

Speaker:

likelihood of getting caught, also known as certainty of

Speaker:

detection. The other thing is severity of the punishment.

Speaker:

It basically mean in the in the driving over the speed limit

Speaker:

example, that the higher is the the ticket fine, the less likely

Speaker:

you are you are expected drive within the speed limit. And now, I

Speaker:

mean, in that kind of cases, applying

Speaker:

sanction is quite easy and straightforward. But if

Speaker:

you apply these elements to

Speaker:

cybersecurity cases, it's a little bit

Speaker:

challenging. So let's take a phishing as an example. And let's illustrate

Speaker:

one idea only. The third time you have detect detection,

Speaker:

also known as the likelihood of getting caught. So if you're

Speaker:

a cybersecurity manager and, you know, you apply this principle,

Speaker:

You should ensure that the employees believe that if they click a phishing link or

Speaker:

share their password, the company will monitor such in

Speaker:

incidents and impose sanctions on them. So what is the problem

Speaker:

here? Well, the situation in in cybersecurity

Speaker:

and, of course, this depends case by case, but in the phishing

Speaker:

example, it's actually very different from the speeding example. Because in

Speaker:

the speeding example, people usually have

Speaker:

they know their car speed. Right? The only

Speaker:

contribution might be what is the actual speed limit on the road,

Speaker:

and then do their navigators often provide that information.

Speaker:

But if you think about the phishing victimization case, none of

Speaker:

this is true. Employees often lack the necessary

Speaker:

knowledge to separate phishing message from real one. And, you

Speaker:

know, if you impose sanctions in that case, the sanctions may backfire because

Speaker:

employees really believe how I should, you know, know these things.

Speaker:

That's why applying sanctions in cybersecurity cases is tricky.

Speaker:

And there are many other concerns. One is sanctions

Speaker:

experience. If you believe the original theory

Speaker:

developed in seventies by guy named Gibbs so he was

Speaker:

basically saying that you can use sanctions. The

Speaker:

sanctions require sanctions experience.

Speaker:

And there are 2 kind of sanction experience if you follow

Speaker:

the original idea. There are general and there are specific.

Speaker:

The specific means that employees have received

Speaker:

sanctions themselves. So they have own experience

Speaker:

of receiving sanctions. That's called specific experience.

Speaker:

The other experience is general experience. General

Speaker:

experience means that you have not received sanctions

Speaker:

yourself, but you have seen other received received sanctions. For example, you

Speaker:

may have never received a ticket for driving over the speed limit, but you

Speaker:

know it's actually happening. People are getting caught and people get

Speaker:

ticket. Okay. So so all of these conditions, if

Speaker:

you can think about the driving over the speed limit example, I

Speaker:

easily met. Be because people have either seen

Speaker:

that, you know, this actually happened. You know? People are driving over the speed limit.

Speaker:

They get caught, and they get a ticket, or they have their own

Speaker:

experience of that. Or, well, in many cases, both. But in

Speaker:

cybersecurity cases, that may not be the case.

Speaker:

For example, think about password reuse,

Speaker:

meaning you are using the same password in different accounts. Have anybody

Speaker:

ever received sanctions for password reuse when hardly anyone has

Speaker:

personal experience of receiving sanctions in, you know, many

Speaker:

cases like my example of password reuse,

Speaker:

then there's no really interference experience.

Speaker:

If we read the theory and we believe the theory, sanctions

Speaker:

would not work in that kind of cases. Because without this

Speaker:

this experience that you have own experience of receiving sanctions,

Speaker:

or you have seen that other people receive sanctions, the

Speaker:

sanctions should not work if we believe the theory.

Speaker:

There's a difference between sanctions, which somebody else is

Speaker:

imposing on you, and risk. So,

Speaker:

like, I I I've never heard of anybody being, you know, receiving a sanction

Speaker:

for reusing the password, but I've heard of people that got

Speaker:

hacked from reusing a password. So that that's a very different

Speaker:

thing. Right? Yeah. It's a different thing. And and and well, if

Speaker:

okay. If you believe the theory, here it means that

Speaker:

that you need to have sanction experience. Sanction experience does not mean that

Speaker:

somebody hacked, but somebody hacked and then

Speaker:

because of the hacking, the firm punished somebody.

Speaker:

Of course, the sanctions might be formal or might be informal. Informal

Speaker:

means that, you know, you get the warning or something. So that

Speaker:

basically the sanctions experience means. Okay? And if

Speaker:

you believe the theory, it means that you have seen that

Speaker:

employees in the firm has received sanctions

Speaker:

by the firm by not following cybersecurity

Speaker:

policies, or they have own experience, or they have seen that, you know, somebody

Speaker:

else actually received sanctions. And, again, the

Speaker:

theory is saying, if that not the case, sanctions should not work.

Speaker:

Now I'm saying, the theory is actually wrong

Speaker:

here. Because if if you look the evidence, as I

Speaker:

said, we have been studying sanctions 30 years.

Speaker:

And if you look to scientific evidence, it points out that

Speaker:

sanctions do have some effect in cybersecurity

Speaker:

cases, even there would be no sanction experience.

Speaker:

So my conclusion here is that sanctions could be more

Speaker:

effective if you have a sanction experience,

Speaker:

meaning you have received sanctions or you have seen people have received

Speaker:

sanctions by the firm for violating cybersecurity policies.

Speaker:

But if if firms are actually giving sanctions,

Speaker:

that's tricky as you know, when you

Speaker:

impose sanctions, you actually start to punish people or give warnings, the

Speaker:

sanctions may backfire. People don't like sanctions and so

Speaker:

on, and they may turn against you.

Speaker:

That's an interesting stream in the literature that I've noticed. The the articles you and

Speaker:

your your coauthors have been writing is the the possibility

Speaker:

resentment arising from the organization enforcing its

Speaker:

security mandate. I want to go back to the, the

Speaker:

the driving too fast in traffic example, because I'm going to be traveling up through

Speaker:

your part of the woods in a couple of weeks. Straight past Tuscaloosa, I

Speaker:

generally travel about 10 miles over the speed limit with a radar detector.

Speaker:

The thing in my mind is I always slow down if everybody else slows down,

Speaker:

and I always slow down if I see blue lights flashing, meaning somebody's been caught

Speaker:

in a speed trap. That leads me to ask the employees knowing

Speaker:

about, the punishable acts, knowing about what might get sanctioned,

Speaker:

that's an aspect of this too, isn't it? Their awareness of a of a security

Speaker:

protocol that might be applied against them? Yeah. So the

Speaker:

employees' knowledge should have a big role here, and especially if

Speaker:

you read the theory. So the original theory assumes that that

Speaker:

that users know already what is illegal

Speaker:

or, in in our case, cybersecurity policies and what

Speaker:

is allowed and not allowed by the cybersecurity policies. But

Speaker:

often the users may not know the policies. We have

Speaker:

run number of studies on on these things, and, you know, most

Speaker:

employees do not remember the details in cybersecurity policies. So

Speaker:

that's, of course, challenge. And there's also another issue, other

Speaker:

another knowledge issue related to how to do the right thing in

Speaker:

terms of cybersecurity because cybersecurity

Speaker:

policies may instruct let's take a pass password example

Speaker:

again. Okay? Cybersecurity policies may say, hey. Use

Speaker:

long random unique password for each account. But

Speaker:

then, you know, policy does not actually tell you how to do it, how how

Speaker:

you manage this, you know, how you remap accountless long unique passwords. And

Speaker:

they may not be training on this. Of course, this

Speaker:

issue is not specific to use of sanctions, but that kind of challenge is

Speaker:

there is in terms of employees' knowledge that they don't know the cybersecurity

Speaker:

policies. And even they know, they don't necessarily

Speaker:

know how to do the right thing because the company doesn't give them enough

Speaker:

information. Training is not adequate and so on. Of course, as I mentioned, this

Speaker:

issue is not specific to, return steering. Maybe we can explore that a

Speaker:

little bit more. As you were talking about that, I

Speaker:

started thinking about if if you're driving along the highway and you don't notice

Speaker:

that the speed limit changes, you don't necessarily

Speaker:

react to seeing that officer on the side of the road because you think you're

Speaker:

going the speed limit. Well, then if you get a ticket

Speaker:

and it turns out the speed limit sign was behind the branch of a

Speaker:

tree, you're gonna experience a lot of resentment. And

Speaker:

I think maybe or let me ask, do you think that the same sort of

Speaker:

thing is in play with cybersecurity? So we've got these

Speaker:

policies, either we haven't received training on them or the

Speaker:

policies are really complicated. We violate the policies,

Speaker:

get caught, get punished. It seems like that would lead to

Speaker:

resentment, wouldn't it? Yeah. I mean, big

Speaker:

thing here is that a very different thing if you don't

Speaker:

know the the rules. And and as I mentioned,

Speaker:

for many firms, you just give the policies. There's some generic

Speaker:

training. It means that people may not really

Speaker:

understand, you know, why they have to follow these policies. And sometimes the policies are

Speaker:

not actually good ones. You know? They are. There might be conflict between what the

Speaker:

cybersecurity policies are saying and what the firms want you to

Speaker:

do. For common example is that security guys are saying don't

Speaker:

click any, links. And then, you know, administration is

Speaker:

actually saying, just do this training and click a link. So, you know, that's a

Speaker:

con Look at this document to see what I'm writing you about. They do that

Speaker:

all the time where we were. Yeah. So there's basic con conflict that, you

Speaker:

know, cybersecurity policy is in the conflict, but you should do in the

Speaker:

work. And that's actually past cybersecurity management, not about the the

Speaker:

return as theory as such. Whether using sanctions or not,

Speaker:

it's important that the policies make sense, employees understand the

Speaker:

cybersecurity policies. And they also know how to cope, as

Speaker:

I mentioned. You know? If you start to say, hey. For every account,

Speaker:

you have 30 account. Every account use unique long

Speaker:

password, but you don't tell how to actually manage this, then, you know, you are

Speaker:

not really helping employees. And then don't and then don't use a password manager because

Speaker:

that that's, risks. I know yeah. Well, and I

Speaker:

I don't know about where you are, but we have annual training.

Speaker:

Yeah. And it's, what, Tom, 4 hours, 5

Speaker:

hours of just all kinds of training. It's a chunk of time. Yeah.

Speaker:

And the security training is buried in the middle of that,

Speaker:

and you're kind of tuned out. You know, all you wanna do is get through

Speaker:

the training. That's why I wonder if that's a reason that people

Speaker:

react poorly when they are sanctioned because they feel like

Speaker:

the training isn't very effective. It goes back to your awareness.

Speaker:

So what what about, can I can I can I quickly comment that? Sure.

Speaker:

Sure. So this is a almost like universal

Speaker:

problem. So not specific to, sanctions, of

Speaker:

course. It also have implications for sanctions because if you don't know the policies, you

Speaker:

don't know how to how how to react. But often, you know

Speaker:

and and the people who are listening to this, if if they are cybersecurity managers,

Speaker:

you know, or you are responsible for the cybersecurity, you should ask,

Speaker:

have you ever asked from the provider who is actually giving you the

Speaker:

training how effective the training is? Mhmm. So for example, if you take a vaccine,

Speaker:

you, you know, you ask, like, how effective? Is is this giving me 80% of

Speaker:

protection or 70% of protection and so on? You know, if you have a

Speaker:

cybersecurity training, you should ask the provider, give me

Speaker:

test results. How effective the training is?

Speaker:

Right. So, you know, is it actually no. If if I have an let's say,

Speaker:

anti phishing training, how effective this training

Speaker:

is against the you know, how how much is lower the

Speaker:

rate of victimization? And most providers, they have never

Speaker:

even tested. You know, while you're selling or buying

Speaker:

products with you don't know how effective they are. And if they aren't effect effective

Speaker:

are you actually wasting employees' time? Do you think that's just checking a

Speaker:

box? Yeah. You know? That that's a lot of because lot of cybersecurity

Speaker:

management, that's that's a really different topic. Lot of cybersecurity management

Speaker:

is people call it best practice, but it basically does that, you know, tick

Speaker:

box compliance that you can say to auditors that, hey. We have we have been

Speaker:

to you know, we have covered this. Right. You don't really you don't really care

Speaker:

or you don't know how to, you know, what is actually quality here. You just

Speaker:

say, hey, we did this. Next item, we did this. Right.

Speaker:

Right. Well, you said something earlier that I wanted to come back

Speaker:

and revisit, which is that employees typically don't know the full

Speaker:

totality of the information security policy of the organization, and

Speaker:

that implies that the, the information security officers need to be able to

Speaker:

communicate not only the restrictions and the prohibitions,

Speaker:

but also the sanctions associated with violating them in a more

Speaker:

in an effective and reasonable way. How can the security managers

Speaker:

get that word out in a way that will take that will be effective with

Speaker:

the other employees? In communicating sanctions, there are

Speaker:

a couple of things. First, you need to understand the firm culture

Speaker:

and the nature of the firm business. So if sanctions are not

Speaker:

self evident and depending on the firm culture and

Speaker:

existing cybersecurity education efforts, you

Speaker:

must explain why the sanctions are necessary if you want to use them

Speaker:

effectively. Also, you should think about putting

Speaker:

yourself in employee shoes. You know, say, hey. How about these sanctions?

Speaker:

Would you accept these sanctions if you would be the employee?

Speaker:

If you want to introduce sanctions, you should pilot test ideas with

Speaker:

you people. Discuss the concept and get feedback on

Speaker:

how they think about this. And, of course, you need management support.

Speaker:

And in any reason and this is really depending on

Speaker:

the country or state or even, you know, the the what kind of,

Speaker:

firm. Is it public firm or is it, like, private firm? But, you know, some

Speaker:

cases, some countries, some states, there might be strong work

Speaker:

union. And if there's a work strong union, they may actually challenge you

Speaker:

unless you are well prepared. A lot of cases in my, consulting

Speaker:

work where, you know, lot of things we introduce and then the work union came

Speaker:

and, you know, are you actually you know, what you are doing for our creative

Speaker:

employees. You have to know your firm culture well, what kind

Speaker:

of culture it is, put you on employees' shoes, pilot test

Speaker:

ideas, get management support, and so

Speaker:

on. So for our listeners who are generally managers responsible

Speaker:

for determining how to, manage security violations, how do

Speaker:

they determine the right level of sanction? In our protection motivation work that we're

Speaker:

all familiar with tends to suggest that if you have too heavy a

Speaker:

hammer, people are gonna shy away out of, perceptual screening,

Speaker:

essentially. The old fear appeals argument, don't scare them too much. How does the

Speaker:

CISA determine the right level of sanctions so they're,

Speaker:

maximally effective? 1st, I think you should under as I mentioned,

Speaker:

you should understand the firm's culture, and that's very

Speaker:

different. And here, actually, I think many

Speaker:

many scientists make a mistake. You know? If you if you let let's assume you

Speaker:

you have very liberal university and philosophy department. That's an extreme example.

Speaker:

Most employees think that sanctions would be absurd unless you you really explain

Speaker:

them carefully, and perhaps you are never able to do that. In contrast, if you

Speaker:

go to military organizations, almost everybody almost know,

Speaker:

hey. There will be sanctions. You know? It's it's a normal thing. In Northern

Speaker:

Europe or France, employees expect more autonomy, so sanctions must be

Speaker:

justified more than other countries. In turn, if you go,

Speaker:

like, US in the Middle East, sanctions are more commonly used. So, you know, you

Speaker:

need to know your firm culture. In cultures where

Speaker:

sanctions are not in firms culture with sanctions are not commonly used, then you really

Speaker:

need to justify the sanctions and especially if there are harder sanctions.

Speaker:

But as I mentioned, this is really depends on the firm's culture, so it's

Speaker:

it's very firm specific issue. But you can also compare the

Speaker:

cybersecurity sanctions with other sanctions. What kind of sanctions

Speaker:

the firm is giving other type of violations?

Speaker:

And, again, same commerce apply. Put yourself into employee shoes.

Speaker:

Pilot testing to idea ideas with few people. And, of course, you need to get

Speaker:

management support, as I mentioned, also.

Speaker:

Sounds like sanctions could backfire if they're not engineered

Speaker:

properly. How how could a a a manager avoid

Speaker:

sanctioning in a way that would have the an unintended effect?

Speaker:

Backfire basically means that you increase sanctions for

Speaker:

improving cybersecurity behavior. Perhaps cybersecurity behavior increases,

Speaker:

but then you have negative effects, kind of side

Speaker:

effects. People don't like sanctions as a result of which

Speaker:

they work work motivation may decrease. They may

Speaker:

start to hate cybersecurity, or they may start to hate

Speaker:

IT or even leave the firm. In in in case of

Speaker:

cybersecurity, one concern is also privacy.

Speaker:

It can depends on the culture and even people, what they think about privacy. Some

Speaker:

for some people, private is very important. For some people, it's not.

Speaker:

The privacy is important in cybersecurity cases because often

Speaker:

when you actively use sanctions, you have to monitor.

Speaker:

Right? And that's may involve violating employees'

Speaker:

privacy. And because of privacy concerns, people may start to

Speaker:

hate cybersecurity, hate to IT because they think that they

Speaker:

are the one and the same thing and so on. And we have studied that.

Speaker:

We have one study where short term, that was field field

Speaker:

experiments in Europe. So short term, the cybersecurity behavior

Speaker:

increased. Longer term, the sanctions were not

Speaker:

effective in cybersecurity behavior, but there was backfire effect

Speaker:

that people didn't trust the company and lot of negative

Speaker:

views regarding the company and so on. So in order to

Speaker:

avoid the backfire effect, you must

Speaker:

understand that the employees get the

Speaker:

importance of cyber stick policies and the reasons behind

Speaker:

regulating some actions by sanctions. This is depending on

Speaker:

the firm's nature. If you are military organization, this is easy. If you are in

Speaker:

a university, very hard, depending on the firm

Speaker:

culture. But the idea is that you if you use sanctions actively,

Speaker:

you need to justify them if they are not already self evident for employees. And

Speaker:

many organizations, they are not self evident for employees. And, you know, they

Speaker:

need to understand why the activities sanctioned

Speaker:

by sanctions are important to to cover and and so on. If they don't

Speaker:

understand that, if they're not accurate that they think that it's a you know, you

Speaker:

are just violating their privacy or you are just, making their work

Speaker:

more harder, then you most likely will get get the

Speaker:

backfire effect. I'm hearing a pretty

Speaker:

consistent subtext of fairness. So a lot of the things

Speaker:

that you're mentioning that can cause the sanctions to backfire would

Speaker:

be when the employees don't feel like it's fair. Yeah. You know, you're

Speaker:

violating my privacy. You know,

Speaker:

I didn't understand. You didn't communicate. They're too harsh.

Speaker:

But but I wonder if unevenness and

Speaker:

sanctions is a problem. I know at universities and and a

Speaker:

lot of other organizations, different departments or different functional

Speaker:

areas have different subcultures.

Speaker:

And so if you're talking to somebody in another department,

Speaker:

then, you know, I they get to leave early on Fridays, and, you know, nobody

Speaker:

cares when you come in. And your boss says, you better be in at

Speaker:

your desk at 8, and you better not be out that door before 5.

Speaker:

That seems like it could cause a lot of problems. Is that an issue with

Speaker:

the security sanctions as well? Well, that's an excellent question. I I

Speaker:

don't think that nobody knows the answer to that. Alright. Future

Speaker:

research. Yeah. Okay. So I think what I'm taking

Speaker:

from this is if, if the security

Speaker:

provisions they're required to follow aren't common sense, if they don't already know

Speaker:

it, It needs to be carefully explained in a in an explicit

Speaker:

manner by the manager Absolutely. In order to justify its application. So

Speaker:

it's almost as though explaining the the security policy

Speaker:

achieves a lot of what has to happen. It's that 1%,

Speaker:

those with a certain sense of psychopathy who are gonna break the rules anyway that

Speaker:

need to understand they're gonna get punished if they don't comply. You know,

Speaker:

if you think about the employees' compliance with cybersecurity policies,

Speaker:

lot of cases where almost every organization should do

Speaker:

better, and that's not necessary sanctions. Specific issue is that,

Speaker:

you know, you should make effort that the employees understand the policies and

Speaker:

why, you know, the policies are like they are. I don't know

Speaker:

that there's research into this in in the context of cybersecurity,

Speaker:

but I think there's there are some psychologists that

Speaker:

would say that the sanctions actually might

Speaker:

have a an increasing effect on violations

Speaker:

by those who are suffer from psychopathy, because that's

Speaker:

part of the thrill. You know, if you don't get caught, there's not

Speaker:

a chance of getting caught, then you don't get that thrill out of it. And

Speaker:

so I I just wonder, that might be an interesting avenue of

Speaker:

research as well. But I don't think I've read anything in

Speaker:

cybersecurity that's talked about that. No. I don't my

Speaker:

understanding is that nobody has studied this in in the cybersecurity context.

Speaker:

So I have I cannot really I

Speaker:

think the closest we get to that are the the very interesting findings in in

Speaker:

in Mikko's prior work, particularly about people wanting to

Speaker:

I don't wanna say get even with the boss for the boss being stringent, but

Speaker:

the the the whole ledger keeping, scale

Speaker:

balancing part of, deciding to act out just because you think

Speaker:

they're being too stringent. Yeah. That

Speaker:

might be. But What do you have coming in the

Speaker:

pipeline? What new ideas will are you working on to get into the literature

Speaker:

on on how to manage cybersecurity?

Speaker:

You mean sanctions or cybersecurity in general? Just

Speaker:

interested in what you're working on and how our reader our listeners might be

Speaker:

keeping their eye out for it if they're interested. Nowadays, I'm

Speaker:

also doing a lot of work on cybercrime, actually.

Speaker:

So I do understand cybercrime,

Speaker:

especially to how cybercrime happens and how to

Speaker:

how we can use communication between the offender and victim to actually

Speaker:

understand and prevent and prevent cybercrime. So that's

Speaker:

that's one thing I'm doing. It's not really on cybersecurity

Speaker:

manage management, of course, it has implications for cybersecurity management.

Speaker:

What what parallels do you see between that work

Speaker:

and and what you've done, around the sanctions within an organization?

Speaker:

Are you seeing any any commonalities across those 2 or too

Speaker:

early to tell? The cybercrime cases that we are

Speaker:

actually looking, These are cases where people

Speaker:

very careful and clever ways, victimized,

Speaker:

people and, you know, now sanctions. Well, if you don't

Speaker:

understand that you are being victimized, so how the sanctions could

Speaker:

really apply effectively. So that kind of case is I don't think the sanctions

Speaker:

help here. It's more about again, you know, we

Speaker:

need tools for ordinary people, and

Speaker:

and employees to to understand actually more cyber

Speaker:

crimes and, you know, what kind of how people may try to

Speaker:

use you in order to, get your money or or or some information

Speaker:

from the firm. So it's more about the risks and how to protect yourself?

Speaker:

Yeah. I think we're also seeing the threat actors becoming

Speaker:

vastly more sophisticated than they used to be. That may be that may be an

Speaker:

AI thing. I don't know. The the people I talk to over here where we

Speaker:

are, because we we have a a classified work workspace over by the air force

Speaker:

base, and they're the opinion that the, the national actors that are

Speaker:

trying to breach their network are using AI to do it, and only AI can

Speaker:

counter that. That's a lot of the phishing attempts I'm seeing

Speaker:

lately are vastly better than they used to be. So it's a risky environment

Speaker:

increasingly so, I think. You can use generic phishing

Speaker:

where, you know, you've sent the same message to, you know, million of

Speaker:

people and hope some of these will will be your victims,

Speaker:

and then you might be more specific or targeted

Speaker:

attacks where you actually find a lot of information

Speaker:

on the target, and then you make your attack and, you know, of

Speaker:

of course, these these targeted cases are much more successful in

Speaker:

phishing or other type of social engineering. So

Speaker:

so, Mikko, as we close out, we typically ask what your 4 or 5

Speaker:

practical recommendations would be for the security managers who'll be listening to this.

Speaker:

What are the things they can add to their list of to dos to keep

Speaker:

the company safe as they, practice the craft?

Speaker:

So first, you need to actually decide

Speaker:

how you're using active or passive use of sanctions. And and now I

Speaker:

realized I don't actually what we have discussed is basically

Speaker:

so far, is active use of sanctions. Active use of sanctions means

Speaker:

that, you know, you you monitor cases and you give sanctions to

Speaker:

employees. But there's also also passive use of sanctions.

Speaker:

So passive use of sanctions, some might prefer to these as a

Speaker:

theory of covering your ass by sanctions. So basic idea is that

Speaker:

you introduce sanctions, mainly to protect yourself or the

Speaker:

firm from the plane. With this passive approach of

Speaker:

using sanctions, you actually only use sanctions when

Speaker:

something bad happens. So you introduce sanctions,

Speaker:

but you actually will use them only if something very bad happens.

Speaker:

I call it back you know, passive use of sanctions. So So something pandemic

Speaker:

you can say, hey. We have sanctions in place. Now we can play in this

Speaker:

guy or whatever. Now if you use active use of

Speaker:

sanctions, that means that they require a justification,

Speaker:

and they may backfire. They use justification because you actively monitor

Speaker:

and keep sanctions. And, especially, to hire other sanctions,

Speaker:

the more most carefully they have to be justified. And if

Speaker:

you don't actively use sanctions, they will lose some of their effectiveness as

Speaker:

a preventive tool. You know, same I idea as in the,

Speaker:

climbing over the speed example if, you know, you are

Speaker:

removing all the police radars, people will increase climbing over the

Speaker:

speed limit. And now the use of sanctions,

Speaker:

especially I mean, active use of sanctions. If employees don't find them

Speaker:

justifiable, they tend to backfire, and you should

Speaker:

already think about that kind of scenarios.

Speaker:

And in this case, if your sanctions do not backfire, you don't justify

Speaker:

these, well, sanctions may become worse than

Speaker:

useless because the, because the side effects, such as

Speaker:

employees dislike in cybersecurity are worse than they prevent

Speaker:

the effect. These are the 4, 5 key points.

Speaker:

This has been Cyberways. It's a production of the Louisiana

Speaker:

Tech College of Business Center For Information Assurance, courtesy

Speaker:

of the Just Business grant from Dean Chris Martin.

Speaker:

This podcast is available wherever you consume podcasts,

Speaker:

and we'd be grateful if you tell your friends about it. And if you find

Speaker:

it useful to you, let us know. Let our guests know.

Speaker:

I'm I'm sure doctor Sipponen is available to talk to you if you

Speaker:

need more advice, because as he says, he does a lot of consulting in this

Speaker:

area. We hope you found this to be interesting, and we hope you

Speaker:

find the, the information to be useful in keeping your company more secure.

Speaker:

Until next time. Thank you. Thank you. Appreciate it.

Speaker:

And it is important to say that the Cyberways podcast is funded through the just

Speaker:

business grant program of Louisiana Tech College of

Speaker:

Business, and, we're grateful for that. So join us next time on

Speaker:

the Cyberways podcast, which is available on all major

Speaker:

podcast platforms. We want you to subscribe or follow or

Speaker:

whatever button your favorite podcast app has. Thank you very

Speaker:

much.

Follow

Links

Chapters

Video

More from YouTube