- Risk Management Information Security Measures Commensurate With Risky Behavior
Security safeguards could be applied selectively based on users' demonstrated tendency toward risky computer behavior—people whose systems were frequently infected or who clicked simulated phishing...
- Social Engineering Website Backup Company's Misleading "Invoices" Suggest a Scam
WebsiteBackup Company sent unsolicited letters resembling invoices to businesses, confusing recipients into thinking they owed payment for services they never ordered. The letters lacked the legally...
- Leadership Know Your Firm's Economic Moat to Keep Security Relevant
Effective security decisions require understanding your company's economic moat—the competitive advantages that protect it from rivals. Framing risks in terms of threats to these moats (brand equity,...
- Authentication What to Do About Password-Sharing?
Password sharing is a reality driven by convenience and social norms—Netflix even encourages it with multiple profiles per account. Rather than pretending credential sharing doesn't exist, products...
- Training Tying Shoelaces and Information Security
Most people tie shoelaces with the weaker knot because the stronger version is harder for children to learn. Similarly, security "best practices" we've followed for years may not be optimal—tribal...
- Risk Management Why Are Executives More Prone to Accept Risks?
Research links high status and power to greater trust in others and overconfidence in one's own knowledge. Executives may accept security risks while being overly trusting and without spending...