1  Cover

      2  Title Page

      3  Introduction What Is Stupid? Do You Create Stupidity? How Smart Organizations Become Smart Not All Industries Are as Smart Deserve More Reader Support for This Book

      4  I: Stopping Stupid Is Your Job 1 Failure: The Most Common Option History Is Not on the Users’ Side Today's Common Approach We Propose a Strategy, Not Tactics 2 Users Are Part of the System Understanding Users' Role in the System Users Aren't Perfect “Users” Refers to Anyone in Any Function Malice Is an Option What You Should Expect from Users 3 What Is User-Initiated Loss? Processes Culture Physical Losses Crime User Error Inadequate Training Technology Implementation UIL Is Pervasive

      5  II: Foundational Concepts 4 Risk Management Death by 1,000 Cuts The Risk Equation Risk Optimization Risk and User-Initiated Loss 5 The Problems with Awareness Efforts Awareness Programs Can Be Extremely Valuable Check-the-Box Mentality Training vs. Awareness The Compliance Budget Shoulds vs. Musts When It's Okay to Blame the User Awareness Programs Do Not Always Translate into Practice Structural Failings of Awareness Programs Further Considerations 6 Protection, Detection, and Reaction Conceptual Overview Protection Detection Reaction Putting It All Together 7 Lessons from Safety Science The Limitations of Old-School Safety Science Most UIL Prevention Programs Are Old-School The New School of Safety Science Putting Safety Science to Use Safety Culture The Need to Not Remove All Errors When to Blame Users We Need to Learn from Safety Science 8 Applied Behavioral Science The ABCs of Behavioral Science Engineering Behavior vs. Influencing Behavior 9 Security Culture and Behavior ABCs of Culture Types of Cultures Subcultures What Is Your Culture? Improving Culture Behavioral Change Strategies Is Culture Your Ally? 10 User Metrics The Importance of Metrics The Hidden Cost of Awareness Types of Awareness Metrics Day 0 Metrics Deserve