#RSAC: Make Technology Deployment for Homer, not Spock

Speaking at RSA Conference in San Francisco on the subject of “Leading Change: Building a Security Culture of Protect, Detect and Respond,” Lance Spitzner, director of SANS Security Awareness said that we often talk about security culture and the capabilities of the human, but fail to “humanize security.”

Spitzner said that the term “you cannot just patch stupid” frustrates him, as the human is a part of cybersecurity. While advancements have been made to improve the security of technology, he noted,  we have not done the same for the “human operating system.” He said: “We’ve gotten so good at technology and securing technology that we’re driving bad guys to target the human.”

Citing Sir Isaac Newton’s theory of an object stays at rest until a force is applied, Spitzner said that in the case of the human factor “we need to apply force to human.”

When it comes to education, Spitzner introduced two types of people, who he referred to as subject one (Homer Simpson) and subject two (Mr Spock). He said that the industry focuses too much on “subject two” (Mr Spock) - people that are logical and data driven - "and we build initiatives based on the concept of subject two, because this is how we think.”

Subject one, however, is not analytical or data driven, and Spitzner said that logically it makes sense not to engage them in too technical an education as to do so is “time and calorie intensive.” Therefore we need to concentrate on designing usable concepts for subject one.

Spitzne ..

Support the originator by clicking the read the rest link below.