The Weakest Link: How to Diagnose, Detect, and Defend Users from Phishing
An expert in cybersecurity lays out an evidence-based approach for assessing user cyber risk and achieving organizational cyber resilience.
Phishing is the single biggest threat to cybersecurity, persuading even experienced users to click on hyperlinks and attachments in emails that conceal malware. Phishing has been responsible for every major cyber breach, from the infamous Sony hack in 2014 to the 2017 hack of the Democratic National Committee and the more recent Colonial Pipleline breach. The cybersecurity community’s response has been intensive user training (often followed by user blaming), which has proven completely ineffective: the hacks keep coming. In The Weakest Link, cybersecurity expert Arun Vishwanath offers a new, evidence-based approach for detecting and defending against phishing—an approach that doesn’t rely on continual training and retraining but provides a way to diagnose user vulnerability.
Vishwanath explains how organizations can build a culture of cyber safety. He presents a Cyber Risk Survey (CRS) to help managers understand which users are at risk and why. Underlying CRS is the Suspicion, Cognition, Automaticity Model (SCAM), which specifies the user thoughts and actions that lead to either deception by or detection of phishing come-ons. He describes in detail how to implement these frameworks, discussing relevant insights from cognitive and behavioral science, and then presents case studies of organizations that have successfully deployed the CRS to achieve cyber resilience. These range from a growing wealth management company with twenty regional offices to a small Pennsylvania nonprofit with forty-five employees.
The Weakest Link will revolutionize the way managers approach cyber security, replacing the current one-size-fits-all methodology with a strategy that targets specific user vulnerabilities.
What people are saying - Write a review
We haven't found any reviews in the usual places.
HOW SOCIAL ENGINEERING EVOLVED
WHAT MAKES SOCIAL ENGINEERING POSSIBLE
HOW CISOS ARE DEALING WITH SOCIAL ENGINEERING
WHY DO PEOPLE FALL FOR SOCIAL ENGINEERING?
THE KEY SYMPTOM
PERFORMING AN ACCURATE DIAGNOSIS
CONDUCTING A USER CYBER RISK ASSESSMENT
FROM CYBER RISK TO CYBER HYGIENE
A TALE OF FIVE IMPLEMENTATIONS
REVERSING THE SOCIAL ENGINEERS ADVANTAGES
Other editions - View all
achieve actions advantage allows appear applied approach asked assess attacks authentication awareness beliefs breach called chapter checking cognitive communication companies completely computing conducted connections create cues cyber hygiene cyber risk cybersecurity deception departments detection developed devices discussed effective employees experience explain factors Finally focused followed framework habits hack hackers heuristics human identify implemented improve individual instance involves knowledge lack lead levels limited look managers measure messaging operating organizations overall password pen test percent phishing email practices presented problem programs protect provides questions reasons requires resilience responses scale SCAM score sharing social engineering social media solutions spear phishing staff survey suspicion Take technical thought tion track triggered trust understand users various victim vulnerable