Embedding a Human-Centric Approach Into a Global Cyber Security Program

The presentation discusses the importance of adopting a human-centric mindset in cybersecurity practices and the need to consider the entire ecosystem in protecting, designing, developing, and securing systems.

• The cybersecurity practice is based on four pillars or asset domains: industrial, product, people, and technical excellence.
• Threat intelligence and attacker profiling are crucial in improving knowledge, understanding, and efficiency in cybersecurity.
• Incident response should focus on root cause analysis to prevent recurring problems.
• Red teams should emulate attacker profiles to improve defense mechanisms.
• Adopting a human-centric mindset is essential in all aspects of the cybersecurity life cycle.
• The increasing complexity of modern networks requires careful consideration of design and understanding of dependencies.
• Supply chain attacks are a significant threat to large organizations.

The speaker highlights the challenge of dealing with the increasing number of vulnerabilities in software development and the pressure put on developers throughout the software development life cycle. The responsibility for dealing with vulnerabilities is often shifted to those who have deployed the software, creating a full ecosystem where organizations must prioritize and work on patching and protecting themselves. This challenge starts in the software development life cycle and requires a human-centric mindset to address.

Humans are the weakest link in cyber security – or so the famous saying goes! This talk will challenge this age old expression to focus on the human elements of the protection pillars; people, process, and technology.Organisations have an overwhelming focus on technology in cyber security defences including offensive red-team operations to highlight weaknesses. Yet the numbers of successful attacks are still increasing; both in frequency and impact. It is time that as an industry we start to think differently about our approach; considering the human-centric notions as part of our technological advances, throughout our entire ecosystem and security lifecycle. The aviation sector is a pioneer of this technique; so how is this thinking being adopted in the cyber security program of Airbus?