Ira Winkler - You CAN Stop Stupid

2 Chapter 8Figure 8.1: The relationship between antecedents, behavior, and consequences...

3 Chapter 9Figure 9.1: The ABCs of culture

4 Chapter 12Figure 12.1: The PDCA cycle of the ISO 9001:2015 clauses

5 Chapter 17Figure 17.1: A mind mapFigure 17.2: A mind map for User Clicked Malicious Link

6 Chapter 19Figure 19.1: Sample countermeasure matrix

7 Chapter 20Figure 20.1: The Kubler-Ross Change CurveFigure 20.2: The J-Curve of AdoptionFigure 20.3: The chasm in the J-CurveFigure 20.4: How good change management influences productivity and performa...

1 Cover Page

2 Table of Contents

3 Begin Reading

1 iii

2 xxvii

3 xxviii

4 xxix

5 xxx

6 xxxi

7 xxxii

8 1

9 3

10 4

11 5

12 6

13 7

14 8

15 9

16 10

17 11

18 12

19 13

20 14

21 15

22 16

23 17

24 18

25 19

26 20

27 21

28 22

29 23

30 24

31 25

32 26

33 27

34 28

35 29

36 30

37 31

38 32

39 33

40 34

41 35

42 36

43 37

44 39

45 40

46 41

47 42

48 43

49 44

50 45

51 46

52 47

53 48

54 49

55 50

56 51

57 52

58 53

59 54

60 55

61 56

62 57

63 58

64 59

65 60

66 61

67 62

68 63

69 64

70 65

71 66

72 67

73 68

74 69

75 70

76 71

77 72

78 73

79 74

80 75

81 76

82 77

83 78

84 79

85 80

86 81

87 82

88 83

89 84

90 85

91 86

92 87

93 88

94 89

95 90

96 91

97 92

98 93

99 94

100 95

101 96

102 97

103 98

104 99

105 100

106 101

107 103

108 104

109 105

110 106

111 107

112 108

113 109

114 110

115 111

116 112

117 113

118 114

119 115

120 116

121 117

122 118

123 119

124 120

125 121

126 122

127 123

128 124

129 125

130 126

131 127

132 128

133 129

134 130

135 131

136 132

137 133

138 134

139 135

140 136

141 137

142 138

143 139

144 141

145 142

146 143

147 144

148 145

149 146

150 147

151 148

152 149

153 150

154 151

155 152

156 153

157 154

158 155

159 156

160 157

161 158

162 159

163 160

164 161

165 162

166 163

167 164

168 165

169 167

170 168

171 169

172 170

173 171

174 172

175 173

176 174

177 175

178 176

179 177

180 178

181 179

182 180

183 181

184 182

185 183

186 184

187 185

188 186

189 187

190 188

191 189

192 190

193 191

194 192

195 193

196 194

197 195

198 197

199 198

200 199

201 200

202 201

203 202

204 203

205 204

206 205

207 206

208 207

209 208

210 209

211 210

212 211

213 212

214 213

215 214

216 215

217 216

218 217

219 218

220 219

221 220

222 221

223 222

224 223

225 225

226 226

227 227

228 228

229 229

230 230

231 231

232 232

233 233

234 234

235 235

236 236

237 237

238 238

239 239

240 240

241 241

242 242

243 243

244 244

245 245

246 246

247 247

248 248

249 249

250 250

251 251

252 253

253 254

254 255

255 256

256 257

257 258

258 259

259 260

260 261

261 262

262 263

263 264

264 265

265 266

266 267

267 268

268 269

269 270

270 271

271 272

272 273

273 274

274 275

275 276

276 277

277 278

278 279

279 280

280 281

281 282

282 283

283 284

284 285

285 286

286 287

287 289

288 290

289 291

290 292

291 293

292 294

293 295

294 296

295 297

296 298

297 299

298 300

299 301

300 302

301 303

302 304

303 305

304 306

305 307

306 308

307 309

308 310

309 311

310 312

311 313

312 314

313 315

314 316

315 317

316 318

317 319

318 320

319 321

320 322

321 323

322 325

323 326

324 327

325 328

326 329

327 330

328 331

329 332

330 333

331 334

332 335

333 iv

334 v

335 vii

336 ix

337 xi

338 xiii

339 xiv

340 336

Ira Winkler

Dr. Tracy Celaya Brown

We believe that the title of a book is perhaps its most critical characteristic. We acknowledge that the title, You Can Stop Stupid is controversial. We had considered other possible titles, such as Stopping Human Attacks, but such a title does not convey the essence of this book. Although we do intend to stop attacks that target your users, the same methodology will stop attacks by malicious insiders, as well as accidents.

The underlying problem is not that users are the targets of attacks or that they accidentally or maliciously create damage, but that users have the ability to make decisions or take actions that inevitably lead to damage.

That is the fundamental issue this book addresses, and it makes a critical distinction: The problem lies not necessarily in the user, but also in the environment surrounding the people performing operational functions.

Managers, security specialists, IT staff, and other professionals often complain that employees, customers, and users are stupid. But what is “stupid”? The definition of “stupid” is having or showing a great lack of intelligence or common sense.

First, let's examine the attribute of showing a great lack of intelligence. When your organization hires and reviews people, you generally assess whether they have the requisite intelligence to perform the required duties. If you did hire or retain an employee knowing that they lacked the necessary intelligence to do the job, who is actually stupid in this scenario: the employee or the employer?

Regarding a person who shows a great lack of common sense, there is a critical psychological principle regarding common sense: You cannot have common sense without common knowledge. Therefore, someone who is stupid for demonstrating a great lack of common sense is likely suffering from a lack of common knowledge. Who is responsible for ensuring that the person has such common knowledge? That responsibility belongs to the people who place or retain people in positions within the organization.

In general, don't accuse someone in your organization of being stupid. Instead, identify and adjust your own failings in bad employment or training practices, as well as the processes and technologies that enable the “stupidity.”