As CISO, I could of course say that hackers keep me awake at night. Ransomware. Vulnerabilities. Zero-days. AI. Or an attacker somewhere on the other side of the world, sitting behind three monitors doing incredibly complicated things. But honestly? My biggest concern walks through our doors every morning… People.
And before anyone takes that personally: I am no exeption. We all know we shouldn’t just click on links, and that an unexpected request to log in somewhere probably deserves a second look. And yet, what we know and what we do don’t always align.
My own little hacker lives at home
This summer, I read Liever moe dan lui by Erik Scherder. It prompted me to take a rather firm approach to screen time for my 13-year-old son.
I set a screen-time limit.
He found a workaround.
I changed the settings.
He found another workaround.
This little tech battle went back and forth until I finally changed the router settings. Now, at 9:30 p.m., his internet simply switches off. The result? Fewer bedtime battles, more peace and a happier teenager. And a happier mother, for that matter.
For now, at least. Because you can put all kinds of technical measures in place, but never underestimate the motivation and ingenuity of someone who really wants something. And that doesn’t just apply to teenagers.
Knowing isn’t the same as doing
That became very clear last week during the workshop Why Smart People Click on Phishing Links. Social psychologist and cybersecurity expert Maarten Timmerman took us through the human side of information security. Motivation and resistance. Learned behaviour. And the difference between our intentions and what we actually do.
Take clicking. We click all day long, and most of the time it gives us exactly what we want: information, access, speed, convenience. So we’re pretty well trained to click. Until that one click suddenly turns out not to be such a good idea.
We can all intend to work securely. But does our behaviour always match that intention?
That’s why, for me, a more secure VU is about more than technology and rules. We want colleagues to be aware of the risks and equipped to act securely. But ultimately, we want to go further: towards a culture in which working securely is simply part of how we do things at VU.
Listen. Learn. And now: speak up.
That ties in perfectly with the theme of our Cyber Security Awareness Month: Speak up. Listen. Learn. Last week, we listened and learned. Now we want to know what you think. From 26 to 30 October, the Wall of Vote will be in the central hall of the Main Building. Because cybersecurity dilemmas are rarely black and white:
“I’d rather be tracked digitally than become the victim of a cyberattack.”
Or:
“Convenience can come at the expense of information security.”
Agree? Disagree? Or are you thinking: yes, but…? Perfect. That’s exactly the conversation we want to have. At the Wall of Vote, you can cast your vote, see what others think and talk to students, colleagues and VU cybersecurity experts. And don’t worry: there are no right or wrong answers. So, as CISO, I won’t be standing next to you with a red pen. Because building a culture in which we work securely doesn’t mean everyone has to think the same way. It means speaking up, listening to each other and learning from one another.
So come and vote. Speak up. Listen. Learn.
📍 Wall of Vote, 26–30 October, central hall of the Main Building
More information about the Wall of Vote programme: VU Information Security
And that security patch for humans?
I’ll keep looking for it.
