In episode 141 of Cybersecurity Where You Are, Tony Sager is joined by <a rel="noreferrer noopener" target="_blank" href="https://www.linkedin.com/in/phyllis-lee-21b58a1a4">Phyllis Lee</a>, VP of SBP Content Development at the Center for Internet Security®(CIS®); and <a rel="noreferrer noopener" target="_blank" href="https://www.linkedin.com/in/julie-haney-037449119">Julie Haney</a>, Computer Scientist & Human-Centered Cybersecurity Researcher at the National Institute of Standards and Technology (NIST). Together, they use a human-centered understanding of security to discuss password policies, including their benefits, drawbacks, and efficacy. Here are some highlights from our episode:<ul><li>01:03. Introductions to Phyllis and Julie</li><li>03:34. How "human-centered cybersecurity" goes beyond just usability</li><li>05:35. The use of NIST and other authoritative sources to dispel confusion in cybersecurity</li><li>09:09. How password policies positively and negatively impact human behavior</li><li>15:06. Three anecdotes that showcase the importance of context when enacting security policy</li><li>21:49. The process of using NIST SP 800-63 to recommend password security best practices</li><li>27:11. Our changing understanding of "the human element"</li><li>29:23. The need to do cybersecurity awareness training "right" and measure its effectiveness</li><li>31:30. Recognition of the absence of natural systems thinking in cybersecurity</li><li>33:14. Psychological safety, feedback, and trust as foundations of security culture</li><li>39:03. Human touchpoints as a starting point to help usability and security work together</li></ul>Resources<ul><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/white-papers/cis-password-policy-guide?utm_source=wistia&utm_campaign=benchmarks&utm_medium=audio&utm_term=theme_csm&utm_content=2025-benchmarks-podcast_141-wistia-content_dl">CIS Password Policy Guide</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://pages.nist.gov/800-63-3/">NIST SP 800-63 Digital Identity Guidelines</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/podcast/episode-98-transparency-as-a-tool-to-combat-insider-threats?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_141-wistia-podcast_sub">Episode 98: Transparency as a Tool to Combat Insider Threats</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/podcast/episode-110-how-security-culture-and-corporate-culture-mesh?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_141-wistia-podcast_sub">Episode 110: How Security Culture and Corporate Culture Mesh</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/blog/why-employee-cybersecurity-awareness-training-is-important?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_141-wistia-blog_post">Why Employee Cybersecurity Awareness Training Is Important</a></li></ul>If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing&nbsp;<a rel="noreferrer noopener" target="_blank" href="mailto:podcast@cisecurity.org">podcast@cisecurity.org</a>.

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

Episode 141: A Human-Centered Take on Password Policies

Cybersecurity Where You Are (video)

AI Chapters

AI Insights

Reviews