Leveraging human factors in cybersecurity: an integrated methodological approach

Abstract

Computer and Information Security (CIS) is usually approached adopting a technology-centric viewpoint, where the human components of sociotechnical systems are generally considered as their weakest part, with little consideration for the end users’ cognitive characteristics, needs and motivations. This paper presents a holistic/Human Factors (HF) approach, where the individual, organisational and technological factors are investigated in pilot healthcare organisations to show how HF vulnerabilities may impact on cybersecurity risks. An overview of current challenges in relation to cybersecurity is first provided, followed by the presentation of an integrated top–down and bottom–up methodology using qualitative and quantitative research methods to assess the level of maturity of the pilot organisations with respect to their capability to face and tackle cyber threats and attacks. This approach adopts a user-centred perspective, involving both the organisations’ management and employees, The results show that a better cyber-security culture does not always correspond with more rule compliant behaviour. In addition, conflicts among cybersecurity rules and procedures may trigger human vulnerabilities. In conclusion, the integration of traditional technical solutions with guidelines to enhance CIS systems by leveraging HF in cybersecurity may lead to the adoption of non-technical countermeasures (such as user awareness) for a comprehensive and holistic way to manage cyber security in organisations.

Information Security Behavior in Health Information Systems: A Review of Research Trends and Antecedent Factors

“…Individual or personal factors investigate the individual reasoning and decision-making behind security behavior [ 95 ]. This study identified 31 distinct individual factors ( Table 8 ) from the selected studies that empirically influence information security behavior.…”

An Assessment of Employee Knowledge, Awareness, Attitude towards Organizational Cybersecurity in Cameroon

“…Protection and defense of analogue and digital electronic devices, their communications channels, their processing and control logic and algorithms stands better to improve in Cameroon when organizations begin to proactively adopt a user-centered perspective. According to Pollini et al (2021), better cyber-security culture does not always correspond with more rule compliant behavior; conflicts among cybersecurity rules and procedures may even trigger human vulnerabilities.…”

“…2021). Cybersecurity threat is becoming more frequent and the threat according to Pollini, Callari, and Tedeschi (2021) include: online fraud, distributed denial of service, drive by download, and social engineering attacks. The changing nature of cybersecurity is exploiting instances of human error or negligence along with system vulnerabilities.…”

A review on cybersecurity in railways

“…There is a need of such kind of research so that railway workforce will be aware of cyber hygiene to be followed. This can be done by transferring cybersecurity workforce knowledge to railways from other available literature such as, NIST guide to the National Initiative for Cybersecurity Education (NICE) cybersecurity workforce framework, 140,141 cybersecurity workforce development and training for critical infrastructure and nation, [142][143][144] human-centric cybersecurity research, 145 human factors in cybersecurity [146][147][148] and soon. Some of the researchers have provided a set of recommendations and literature to enhance cybersecurity workforce culture within railway organizations.…”