CHCC IT chief: Cybersecurity is everyone's responsibility

Cybersecurity is a shared responsibility and not just the job of information technology professionals, according to Commonwealth Healthcare Corp. chief information officer Dr. Belen Busby, who offered three pieces of advice as artificial intelligence increasingly becomes part of the workplace.

Speaking before members of the Society for Human Resource Management-Northern Marianas Chapter at Aqua Resort Club in Achugao last Nov. 12, Busby urged employees and employers to trust but verify before acting on suspicious requests, never sacrifice security for convenience, and remember that cybersecurity is everyone's responsibility.

"Cyber security is a shared responsibility," Busby said during her presentation on artificial intelligence, cybersecurity, and employee behavior.

Her first recommendation was to verify the legitimacy of emails, phone calls, and videos, particularly those involving money or confidential information.

"Do not do the report or the request unless you verify that it's legitimate," she said.

Busby warned that AI has made it easier for cybercriminals to produce convincing emails, impersonate company executives, and even clone the voices of family members.

Unlike traditional phishing emails, which often contained spelling and grammatical errors, AI-generated messages can now appear professionally written and seemingly come from legitimate sources.

She advised employees to independently verify unusual requests, particularly those involving financial transactions or sensitive information, even when they supposedly come from supervisors.

Her second recommendation was equally straightforward.

"Convenience should never replace security," Busby said.

While AI can significantly improve productivity by helping employees prepare documents, summarize reports, and draft correspondence, she cautioned against uploading confidential information to unapproved platforms.

She said organizations should establish clear policies on AI use, approve appropriate tools, and ensure that AI-generated documents undergo human review.

"Your end document should always be reviewed by a human. Do not trust AI," she said.

Her third recommendation was that cybersecurity should become part of an organization's workplace culture rather than remain solely an IT concern.

"We all have a role in protecting our organization system and information. IT cannot do it alone. We need help," she said.

Busby also disagreed with the common perception that employees are the weakest link in cybersecurity, saying they should instead be considered an organization's first line of defense.

She explained that even sophisticated security systems could be compromised when employees unknowingly click malicious links, download suspicious attachments, or disclose sensitive information.

However, she cautioned employers against automatically blaming workers when cybersecurity incidents occur, saying organizations should instead examine whether adequate training, safeguards, and reporting procedures were in place.

Busby recommended regular employee training, multifactor authentication, clear reporting channels, and an environment where workers feel comfortable reporting mistakes without fear of punishment.

During the question-and-answer session, Busby also expressed support for the CNMI government adopting its own AI and cybersecurity policies.

"It should start with our government," she said, emphasizing the importance of establishing clear rules governing the use of emerging technologies.

Asked about the difficulty of monitoring employees who use free AI applications, Busby acknowledged that IT departments lack the personnel and resources to oversee every activity, making organizational policies and employee awareness even more important.

She also encouraged small businesses to take advantage of free cybersecurity training and resources offered by the federal Cybersecurity and Infrastructure Security Agency, or CISA, and expressed willingness to help organizations improve cybersecurity awareness.

Busby said AI should not discourage innovation but should be used responsibly, with employees remaining accountable for the information they handle and the work they produce.

"Because at the end of the day, we are not just protecting computers and information. We are protecting our employees, our customers, our organization, and the people that depend on us," she said.