Hi, folks. This is the Cyberways podcast, and we
translate our academic knowledge about information security into stuff that you
can use as a security professional. We think it's a unique mission. We think you'll
like it. I'm Tom Stafford. Craig Van Slyke. Tom and I are your hosts on
your journey to knowledge. CyberWays is brought to you by the Louisiana Tech
College of Business' Center For Information Assurance. The center offers
undergraduate and graduate certificate programs in cybersecurity and
sponsors academic research focused on behavioral aspects of cybersecurity
security and information privacy. Hello, everybody, and welcome back to
Cyberway. It's a production of the Louisiana Tech University Center For Information
Assurance supported by a Just Business grant from college of business
Dean Chris Martin. Today we have with us Karen Renaud
and Mark Dupuy. They are doing some fascinating
research on cybersecurity insights taken from world
religions. Recent article appeared in Computers and Security. Doctor
Renault is a Scottish computer scientist at University of Strathclyde in
Glasgow, works in all manner of human centered security and
privacy. Doctor Dupuis is an associate professor with the Computing
and Software Systems Division, University of Washington, Bothell, where he also serves
as the graduate program coordinator. He has his PhD information
science from the University of Washington with an emphasis in cybersecurity.
Welcome, Karen and Mark. Thank you so much. Thank
you. Let's start with the big question that I
think is gonna underlie a lot of what we talk about today.
What's wrong with the way we currently practice cybersecurity? Rita,
Janet, I'm not It's not working because there's no
the number of attacks are not abating at all. So
when when you keep doing the same thing and it's still not working, you have
to think about, well, what do we what could we do differently in order to
have more success? So at at a meta level, seems like
we're not very successful. And I think in an organizational
setting, I think one of the things that's not working is it's often kind of
a us versus them. And if you think about it in an organizational
setting, why are we doing that? It should be us,
the employees, and the leadership against them, the
people that are trying to cause harm to us as opposed to,
the infighting that often takes place. It's it's counterproductive. And
as Karen said, we're not we're not getting anywhere. We're not we're not,
making improvements, and that's the problem. The other thing is that we have
this paradigm in organizational cybersecurity, which is
formulate the policy, disseminate the policy, and
enforce the policy. And then when things go wrong, we just go
back to disseminate again, and then we enforce again.
And so it's almost as if it's it's like a vaccination. And if you just
make the vaccination take, everything's gonna be fine. But
this is we've been doing this for over 2 decades, and it's not very
successful. So we have to start asking ourselves, what could
we do differently? So one of the things that I was looking at
y'all's body of research. One of the the things that struck
me was that we seem to
focus way too much on, negative emotions.
You think that's one of the problems? Well, so Mark and I met at
Hicks some the very first time. And I said to him,
Mark, I want to do some research into the use of fear in cyber. And
Mark was on board. That was the first paper we did.
And we felt that a lot of the dissemination that is done in
cybersecurity is a hook into people's minds was
if you don't do this stuff, things are gonna be really bad. You're gonna get
punished, and the hackers are gonna get in and so on. And so fear is
being weaponized. And what Mark and I discovered was
that this is a very damaging thing to do to people because fear is
is an emotion that actually hurts you, and it lasts for much longer
than we realize. But, Mark, maybe you could tell them about the password
one that well, maybe I should we shouldn't go into that kind of depth
now. Sorry. Well yeah. You know, I I think I'll just just briefly I
think the thing I'll say is with with fear and other
negative emotions, when when people get scared, they don't make
the best decisions, but yet we're trying to use these negative emotions like fear to
try and get them to do what we want them to do. So it's it
seems kinda silly in in many respects that we're trying to get them to
be compliant with these policies by scaring them
when all of a sudden, and from a cognitive standpoint, they're gonna be less adept
at doing what we want them to do. So I I you know, it's just
it's very, counterproductive in many respects. And
as, you know, some of our research has shown too that not only are we
eliciting fear, but we're also increasing other negative emotions and
decreasing positive emotions. So what are the other implications for this?
Mhmm. Your concern is But we have this extensive criminal
justice lens through which we view cybersecurity, and those of
us who go to the to all the rude meetings see it all the time.
All the leading authors started with a perspective of
enforcement as as Karen so aptly put it. You know, promulgate
the policy, enforce the policy, punish the people that don't adhere to it.
It just doesn't feel like good organizational
behavior, from a managerial perspective to be trying to get
people to do the proper thing with
negative reinforcement as opposed to building a positive
culture, which which I I'm hoping is where we're we're headed at some point, but
we don't see much research on it, do we? No. And I
understand the fear. Right? Because I speak to CSOs a
lot, and they're worried. They're they're the ones whose head is
on the on the plateau when things go wrong. They're the ones who who have
to answer the stories for the board, you know, why did we get hacked?
So that fear is then being transmitted, and that's why they get
all heavy with the normal average person in the organization.
So the whole thing about the blaming and the fear culture is really
unhelpful across the board. So I would agree with you, Tom.
So your paper is about a religious view on
cyber security, and I see that as eminently positive. You know, religion is
a positive force in our life. It it speaks
to doing good and and being good, and I'm very interested in
how you bridge to that particular lens
as a way of considering cybersecurity behavior in a new perspective.
So I spent some time in Germany a few years ago, and I
picked up 2 books before I left to read while I was there. The one
was by Scott Atren, which is called talking to the enemy, and
the other one was, Jonathan Haight, The Righteous Minds.
Nothing to do with cyber. But both of these books really struck me
in terms of trying to understand why people do what they
do, and both of them spoke about our values.
And then I started wondering what were the values that we were
trying to get people to adopt in cybersecurity.
And then I picked up a book by Alain de Beauforton, which is called religion
for atheists. And then I realized, well, hang on. Why don't
we learn from the people who do espouse values? Because religions
all have values that their adherence espouse. So
what what could we take? And but Du Boisoten says, don't
throw the baby out with the bathwater. Let's look at religion and take the
good parts and learn from it because they're very successful,
and and and then don't take the stuff that's not so great. And so that's
kind of where this idea came from. And I I zoomed Mark
from, from Germany, and he said, yeah. I'm in.
So that's that's where the ideas came from. So what did you
hope to find in, in applying this new focus on on cybersecurity?
Well, I think a lot of it is, you know, like Karen said is, you
know, religions have those that have stood the test of time have stood the test
of time for for a reason. And and some of them have,
you know, a lot of them have stood the test of time, have adapted, evolved,
and changed, as times have changed, as our society has
changed. And, by doing that, they have,
met the needs of of the people they're serving, of of their believers.
And, and there's something that could be learned from that. And we
think about some of these religions have been around for 1000
of years And, you know, in cybersecurity, you
know, being around for, you know, 20, 30 years at the
most, really. And so what can we do as
such a new discipline? What can we take from religion
and and try and learn from it? Because, you know, as we said earlier, we're
not we're not successful. We're not we're not very successful in what we're doing, and
the problems are only getting worse. So let's let's be humble
enough. Right? Let's let's show some humility and let's try and learn from
these other areas like religion and and see what we
can take. And instead of just this compliance and and this
punishment of people that are trying just
to do their day to day jobs, most of them are not in there to
do cybersecurity. They're being tasked with it
in often an unfair way when they're there to
do pretty much anything but cybersecurity. But what what can we take
from other places, other, you know, other disciplines like religion
and and learn from it to help us to help us be more successful.
And, you know, as Karen said, you know, there there's there's a lot to be
learned from. So let's learn a little bit from religion.
I wanna dig into just what religion is. So it's one of those things where
we all know what it is, but we don't really know kind of what it's
made up of. Can you talk to us a little bit about what actually
religion does or what its components are? When I I started
writing this paper, I thought, well, the first thing to do is define. Right? Whenever
you have a new concept in a paper, you have to define it. And it
turned out that people are struggle to define religion.
So, having read a number of people who said, you know, nobody can
agree on it, So, okay, let's go and look at it from a different way.
And I found somebody called Durkheim, who's a very well known German academic,
who said that religion has 3 dimensions. It's
believing, belonging, and doing. And
then when I found some other papers that also tried to say, these are
the characteristics of religions, I found that they also fell into those three
dimensions. And that made it a lot easier to an to kind of
start interpreting how what we are doing and what
religions do. Can you tell us a little bit about the problem? Part is that,
you know, if you go to somebody who's an adherent of a particular religion, they
can tell you what they believe in. And they also
know what kinds of things they should do. So they may believe in in
if it's a Christian, they would believe that they have to be kind to other
people and forgive people when things people do bad things to them and that sort
of thing. So the believing and the doing is easy to understand. But the
belonging was the one that was really came across strongly in all the
the religious related literature because people get a
sense of belonging to their community. They meet weekly with their
community a lot of the time. And that sense that I am a
Christian or I am a Muslim or whatever, that was part of became
part of their identity. And so those three things were the
aspects of religion that people seem to, you know,
cohere to. There's also the nature of, I think,
the belonging aspect of of of your model to
me speaks to what I've always considered to be the important part
of cybersecurity, which is belonging to the team that secures
the company. Mhmm. And I I see that as a a very useful
metaphor taking religious perspective. Yeah. I I I
think, you know, the the belonging part
is in many respects, the one big area where we're
lacking maybe more than the others. Because I mean, we we all can believe,
oh, you need to do this. You need to be aware of this. You need
to watch out for that. Make sure you do this and and so on. But
building that sense of community that, hey, we're all in this together,
that, we know mistakes are gonna happen, that we we realize
this is tough to do, that we're not all, at at the
same level of understanding these different threats and so on. That,
I I I believe, is really where we're lacking and we're not doing a good
job of. And I think you look at successful religions, you look
at people that, want to go to church, and it's not always just
to sit there and and listen
to a sermon for an hour, but it's oftentimes those other
activities. It's gathering for to share a meal together. It's it's
it's just being with one another. It's it's that sense of belonging,
that community that you have that we just don't
see in in cybersecurity. It's
it's it's this very this top down approach. It's this punishment approach.
And, you know, I I think as we think about the
success of religions and and a sense of belonging, we
just we are so lacking with respect to that sense of belonging in
cybersecurity. Can I take a tangent here? As you were
were all talking about this, I was trying to
translate in my mind the idea of
belonging to something like a church or a religion
versus a sense of belonging at work. And so my
church and my religion, for a lot of people that are
religious, it's very intertwined with their personal lives.
So it is part of their life. I grew up in the Baptist
church, and it was you know, it could be 3 nights a
week going and doing something all day on Sunday.
So that was intimate part of who you were. And
I don't know if we get there with work. I know work is part of
our identity, but I I wonder if it's a problem of
intensity or the extent to which it's intertwined
in our real lives. You know, we tend to separate
work and personal lives, but religion is part of
the personal life. That's a really interesting point because it
is work and I guess we have our work tribe and we have our home
tribes. But I did another piece of research which is under
review right now with some other people in Germany. We asked
people, if they ever discussed cybersecurity with other
people, and they all said no. And then we asked them whether they
would like to discuss cyber with other people, and most of them said yes.
So it's the kind of thing that people don't talk to each other about at
all, where people in the same religion would talk about their religion. So
it's almost as though people don't feel that that's something they can do.
Whereas a if there's 2 Christians, 2 Muslims, any Buddhists,
they would talk about this religion of theirs. Right? So it's almost like it's a
solo sport right now instead of a team sport at work. That's
an apt point. I I've always felt that
many organizations were groups of people each traveling their
own way and the challenge of the manager is always to harness their activities
in concert with each other. When it comes to something so mission critical,
it's protecting the company's assets from external access.
So so do you think part of the problem is the negativity
around cybersecurity? So we don't talk about doing cybersecurity
well. It's when there's an incident, when something bad happens. And
who wants to talk about that? I wonder if it's all wrapped up in the
fear of the virus. And 3 people fall for a fish, but 3
1,000 didn't, who are we talking about? We're talking about those 3.
And and so, yes, it it's it's a kind of an a mindset that
we felt when we were looking at religion really ought to change
and this mutually supporting thing. Because when I've studied events
where there have been cyber, breaches, the first thing that happens is the
person who's responsible, who may be clicked on the fish or something, they're
immediately ostracized. They're immediately pushed into the corner and
how dare you do this and how could you have been so stupid. That's that's
not what a church would do. They would try to help the person do better.
Or not the church, but I mean people in the same religion. Or
or burn you at the stake. 1 or 2. Never. Not
anymore. Not anymore. Sorry. That was a long time ago. Karen makes a point though.
Craig and I both come from the Baptist heritage and then and the Baptist
creed of faith is everybody's going to hell unless they do their best to be
a good person. No. That's that's putting it too strongly. Everybody's inherently
a sinner and seeking forgiveness and doing good
works is the avenue away from, the outcome.
And I I see the parallel with what you what you just put voice to
your current. I think too is it's it's
almost difficult to wrap our mind around how would we do this with cybersecurity.
But, difficult but not impossible. Right? Because I I
think about places I worked previously where, you know, maybe
a smaller office environment where maybe there's 50
to 75 people working there where, you know, we would
have potlucks and and different things. We would have, decorate
our office for Halloween and these other activities and have fun things and and
build that sense of community. Well, you know, like like Karen said, you know, you
know, what if there is a a fishing simulation exercise and,
yeah, 3 people fall for it, but everyone else does it? Well, what if we
have a a pizza party or something, right, some kind of celebration,
for all those that didn't fall for? We don't even mention the fact that
there's a few that didn't. And and we just, you know, again, build that
sense of community. And we we talk about, how successful
we were, or or celebrate these things and and come
together. And and I think because it sounds so foreign, it seems
silly to think about that. But and that may not be the exact approach,
but I don't think it's impossible to think about how we can build this
sense of belonging in cybersecurity because the fact of the matter
is is this isn't a solo sport. We're not in this
individually. We're in this together, but we do act like and
it's treated like we're in this individually. At the end of
the day, you know, the organization will be impacted. We're
all impacted directly and indirectly at at some point in
time. So we need to kind of start getting creative with how
we're gonna create the sense of belonging and community
within organizations.
That that fits with what Karen said about mindset. That's one of
the things I'm hearing here is we need to really have a shift in mindset.
To to get at this, you interviewed a number of religious leaders
from a variety of different religious traditions.
So what did you find? When we analyzed, we didn't specifically ask him about belonging,
believing, and doing. We just asked him in a bunch of questions, which I think
we've included in the paper. And what happened when we
analyzed it was, well, unsurprisingly, belonging, believing, and doing
kind of filtered up, and we could group them into those 3 stupid
themes. And what came across with with the
one the final question was, you know, how could cybersecurity learn? And they all
said, oh, you know, you need not to be so harsh on people when they
make mistakes. Cyber is hard. And we saw a sense of forgiveness coming
across, a sense of grace for the imperfect
human. And that we kind of had expected that, but it was really
gratifying when we heard it from them.
But the interesting part was they said the one guy said,
well, you know, when did he did cybersecurity training when he was a
student at university? It it was just like a checkbox thing. He did
it online. He finished it. He answered the questions, and he was done for the
next year. But he said at his church, when they get
together, they talk about concepts. They talk about the difficulties they're having
when they have their community get together. So he said, why don't we do that?
That was exactly what I was hoping if somebody was going to tell me.
You know, he was he made he made that contrast for me.
One one of the issues that I see from an organizational theory perspective
is the notion of agency. The organization
is formed as an informal and sometimes
actually formalized contract between the people who own the company, the
principals, and the people they hire to do the work for them, the agents, and
the agents are economically rational. They will they
will do things they shouldn't do if they feel like they can get away with
it and and it's to their benefit. Mhmm. The distinction in the religious
view is the principal agent component is not
there. There's no economic rationality. There's there's no
if you think about it, no pragmatic payoff for being good other than being good
for goodness' sake, which is
faith, which I find very I find that to be a very compelling aspect of
this religious view that you take of cybersecurity. People doing
good security for its own sake, rather than because it's
their job or because the boss will sanction them. But also maybe
learning to do what's right for the community. Right?
Rather than just doing what's what I'm scared not to do.
I've long felt that the, the criminal justice perspective on
cybersecurity, had issues
because it it treats people as problems when in fact your
solution is isn't it? Yes. So that
that leads into something that I thought was perhaps the
most interesting part of the paper, and that's the idea
of sacred values. Tom, you were kind of alluding to that.
You know, be good for goodness sake. It's because that's what you do
regardless of everything else. If it costs you money, if it costs
you your position, costs you your material wealth,
you still do we we talk about doing doing what's right
because it's right. That's a sacred value.
So what are sacred values and how do they
apply in this context? Mark.
This this is not a quiz, so Well, I mean, well, what
row. I was gonna real quickly, maybe touch
on the prior question if that's okay. And I
I think it's just some interesting insight from the
religious leaders with kind of that sense of
belonging where, you know, they they touched on
how we are all different, and we have a lot of differences
between us, but how we should focus also on what's common
between us. And it's kind of that sense of belonging, you know, bringing us together
as a community and how we are there to help each other,
help us as as people. And by doing that, we can
create that sense of trust, between us. You know? And I see
that not really being done very well in organizations. It's it's often like,
oh, this person doesn't know what they're doing, but they're gonna click on that phishing
email. They're gonna hurt us as an organization and and so
on. And so, you know, that was some interesting insight with respect to
belonging. And then you look at believing, an interesting comment
from one of the religious leaders was, you know, go where the people are rather
than just expecting the people to come. And, you know, again, I
I thought it was just some very interesting insight
of, you know, hey. You know, reach out. Don't just
wait for something bad to happen, but be proactive. You know, be
available to the to these people that, again, are not there
to do cybersecurity but are being tasked with it in an often and
unfair manner, but be available to them.
So, you know, that it's just some other things that I wanted to to
share. One of the things that somebody said was be humble.
The people who are asking other folks to do cybersecurity actions
should be humble and not act like they know everything. And that that
was interesting as well. I'm intrigued by the notion of
morality. I always have been. And morality is
deeply seated in the concept of religion. I I wonder if maybe
it it it transfers over to your research perspective
because my sense of organizations is companies
have no religion. They are the inherently amoral
entities. They do what is legal. And sometimes as I tell
my students, amorality is doing what is not
prescribed by law or what you think you might not be caught at.
And you know it's not right, but you don't think you're gonna get caught. Organizations
are not moral, centers,
if you will. And then that I think that has to change
because cybersecurity requires everybody caring for the good of the all as
opposed to everybody looking out for themselves. Don't you think? Yes. Can I just
get back to the sacred values that, Craig asked about? When
I when I read Scott Atron's book, he said that,
people, you know, you could challenge other values they
had. But when you went near their sacred values, they it was not
negotiable. Right? And so what I kept thinking was we
don't even try to incalculate the values into people in
cyber. We give them a list of do's and don'ts. We don't actually
try to make that part of them that becomes nonnegotiable.
And and you were talking about integrity. I've done a study into whistleblowers,
and they also said, we saw this and we had to
speak because it was our integrity that was a
question. So for them, that integrity was their kind of
sacred value. But we that it seems to be a completely alien
concept in cyber at the moment that we we try to find
the values that people should endorse and
embrace. Let me see if I can tie this back to what what
Tom was talking about. So morality
isn't a static, universal thing. I mean, we have
some things that we view as largely universal, but
you brought up a really important point in your paper that ties into all of
this. So the idea is if we can get
employees to tie into the security sacred values,
then they'll do anything to avoid violating those values.
But then you brought up a really important point and I'm literally gonna read it.
While cybersecurity professionals could easily commit to these values, talking
about the cybersecurity sacred values, we
do not know the extent to which individual employees will be able to commit
to these relatively broad categories and or convert them
into action, nor do we know whether they are effective
candidates to serve as the higher values foundation
grounding our vision. Yeah. I think that's the rub.
That the sacred values for the employees getting some and
Tom, you kind of talked about this idea of alignment in in
management. I think that's gonna be the neat trick, and if we can
figure out how to do that, a lot of other things may fall into place.
So what do you all think about that idea? I think that's a big part
of the challenge is it's creating that culture that is
going to work from, you know, from
the bottom to the top and vice versa. And that's that's
a really big challenge. It goes to these sacred values
that were espoused by the religious leaders, you know, working
together to support others. And it's not easy. Everyone is
there trying to, for the most part, do their job, make make
their money, go home, and and, you know, deal with their lives outside
of work. And when things are complicated
and, you know, you probably see eye rolls and you see other things
I have a couple kids, so I see that plenty. But then, you know, you
you're tasking them with other things that complicate matters. It can be
difficult to get that buy in. But if you
are successful and if you can do that, you can really see
some amazing things happen. And and it is possible. You know, you
see things that have been done. You look
at at Demian and what was done with Toyota in the 19
fifties. This humongous shift. These humongous shifts in
culture can happen, and they do happen, and they are effective.
Why can't this happen with cybersecurity in organizational settings?
It can. You know? We just need to figure it out. And I think this
is a starting place for some discussions of what this might look
like. You know, how this can be effectuated? You know, we still have some
work to do to figure that out and to try it out, but it it
is possible. It is. You're in my wheelhouse now
when you bring up Deming because Deming was issued by all the major
US automakers as being irrelevant. So he went to Toyota
out of desperation to sell his idea, and he he
landed in a culture which espouses
collectivism, which means the good of all as opposed to the good of the one,
whereas the companies who turned him down are strictly into economic
outcomes for the 1, maximized personal outcome, which is really, I think,
the the issue in the a moral approach to business. I I I don't
know. I'm I'm on a soapbox now, so I'll stop. But I I wanted to,
to ask you whether you think that the notion in the title of your
paper, shame, has an irrelevance or if that's just
something that we try to avoid by doing good. And if I
could just interject, that's that's another paper that's in this kind of
overall we need to do security differently theme. And
assuming that Mark and Karen are willing, we're going to have
them back to talk about that paper because it was just too much for one
episode. So I just want wanted to to kind of give the backstory
here. And that's one that we followed the fear one with because it felt as
if people were being shamed when they did make a mistake,
and that was my sense. And then when Mark gathered
all our bunch of data, it actually happened to loads of people where
they where they done something silly, clicked on a message or whatever.
And there was then the organization would people would yell at
them, and they would they would get, you know, ostracized
by their by their because now everyone had to go for the training
again, and everyone couldn't work that day while the folks, IT folks,
had to sort the computers out and everything. And the what the people
went through was awful. You know? And and what we
discovered was, interestingly, there's a difference between shame and guilt.
Guilt says, you did this silly thing. Here's what you can do to
make up for it. Shame says, you are the stupid
person. It's an attack on you as a as a human. So then
what you get is a self defense response. And what we also
discovered is that what you do when you shame people is create an insider
threat. It's very, very counterproductive.
The organization does not end up ahead like maybe they think they're gonna
end up ahead. So it's it's very counterproductive. So
we're we're gonna leave that as foreshadowing for our later
episode. We're starting to run up against our time
limit, so could you
give us kind of the 3 or 4 messages
that you want our practitioner listeners, our
cybersecurity professionals, to take away from what you found in
your work. I'm gonna punt that to Mark. I've I've spoken a
lot. Sorry. One thing I will say, and
maybe this isn't a direct answer to your question, but maybe one thing I'll say
just as a follow-up to the same question is is one thing we sought
out to do here was to learn
from world religions what we could apply to
cybersecurity and make cybersecurity better. One thing that
we did not seek to do was to porch portray
that world religions were without any issues
or faults of their own, that there weren't any problems or challenges. And I mentioned
that because, obviously, plenty of religions
use shame. They use fear. They use other things that we do
not think should be used in cybersecurity. So I did I did want to
mention that that we're trying to say, you know, what does make world religion
successful? How can we take that and apply that to cybersecurity?
And so, you know, with that in mind, I think some of the things
that some of the major takeaways with respect
to these higher values and thinking about, you know, the idea of
for me, one of the big ones is a sense of belonging and
and building that community, caring for others, wanting
others to be successful, to succeed. And
that can only be accomplished if, you know, instead
of just punishing and looking at other people and saying, hey. You did this
wrong. Instead being like, hey. You know,
this this types of things happen. We know it's challenging. Let's figure out
how we can make this make everyone more successful. Let's you know, what
are we doing on our end that, we could do better?
You know? So it's not just the employee, but what is the organizational
what is the organization doing that, is making it more
difficult? You know, what could what can the organization be doing better? And
and, you know, just working together to support others, to share this knowledge,
to care for each other in in a real meaningful way. And so I
I think that that sense of belonging for me is is a really big
one that I think religions,
maybe in an often ideally idealized,
can do very successfully. With cyber, we seem to be stuck in a bit
of a a rut where we this is the way we do cybersecurity,
and things like generational AI has come have
come along, and we have to be able to adapt. But
because of the fear based approach, people are almost frozen in the way they're
doing stuff and that they're too scared to adapt. So it's really
about taking the good parts. I agree with Mark there absolutely.
The the religion does belonging pretty well. Let's try and figure that out.
Also, the the sacred values were the thing we've put in as our
as our this needs to be done because we didn't actually arrive at those.
We didn't have the bandwidth to do that with this study, but that's definitely
something we want to work on next. So when we
were talking about it, Shane earlier, Craig mentioned that it seems a
likely topic of your next paper, even though it's it's partially
covered here. Tell us about what the next step is in your research because this
is fascinating. We need an alternative to, pardon the metaphor, the
hellfire and brimstone of a criminal justice perspective in current cybersecurity
practice. So Mark and I are looking at this whole issue of
sacred values with a another friend, at one of the London
universities, and we're really hoping to arrive at a set of values
that we could offer to the cybersecurity community to
say, these are the things that we think that people could possibly
espouse in order to help them. For for secure cyber
security to become something that they don't even question that they just do, and
you wouldn't have to have the compliance stick to beat them with. We
also did a paper on regret, which is can be negative, but
it turned out it can also be a positive thing. So if you make a
mistake once, you can learn from it. I want to
be understood. Organizational theory, Leon Festinger. Everybody
knows him for cognitive dissonance, but attribution theory Uh-huh. Was his
big thing, organizationally. And then the notion is
people hate to fail, and they're more motivated by figuring out what
they did wrong and keeping that from happening again than they are
figuring out what went right. Because they expect to do well, but they don't expect
to fail and they wanna avoid failure. But I was actually what
triggered this, Craig, was we managed to put the name of a song in the
title. So the title is
from Edith Piaf. Nice. I've been wanting to
do that for years. So we've we've been talking
with doctor Karen LeNo and Mark Dupuy, today about their
fascinating perspective on cybersecurity and doing our part to
spread the faith of doing good in the workplace. This
is cyber ways, a production of Louisiana Tech University College
of Business supported by Dean Chris Martin's just business grant.
You can download it wherever podcasts are found, and we dearly love if you tell
your friends about us. See you next time. And it is important to say that
the Cyberways podcast is funded through the just business grant program
of Louisiana Tech College of Business, and, we're
grateful for that. So join us next time on the Cyberways podcast, which is
available on all major podcast platforms. We want you to
subscribe or follow or whatever button your favorite
podcast app has. Thank you very much.