CybEE: the Human Firewall Problem in Higher Education

Università Cattolica del Sacro Cuore (UCSC), a university and part of the Catholic ecosystem, experiments constantly with a high level of cyber risk exposure in a complex, multicultural, and heterogeneous environment. The “Human Firewall” concept (HF) has been around for some time now in the cybersecurity space. The term is used to describe people who follow best practices to prevent or report data breaches and suspicious activities. Its value is self-evident, since some studies report that up to 74% of data breaches involve the human element, and other statistics scale the role of the human element up to 95%. We set ourselves the objective to build an effective, consistent, and sustainable barrier to cyberattacks by means of security-aware and security-trained employees. The challenge was to dramatically improve the performance of the “Human Firewall,” thus extending the reach of cybersecurity professionals and improving the UCSC security posture. We used different "weapons:" conventional training, web series, gamification, certification paths, simulations, information radiators, "data-powered" targeted actions, and "high emotional engagement events" in what we called the "AwAKE approach."