Socio-technical systems cybersecurity framework

Abstract

Purpose This paper aims to identify and appropriately respond to any socio-technical gaps within organisational information and cybersecurity practices. This culminates in the equal emphasis of both the social, technical and environmental factors affecting security practices. Design/methodology/approach The socio-technical systems theory was used to develop a conceptual process model for analysing organisational practices in terms of their social, technical and environmental influence. The conceptual process model was then applied to specifically analyse some selected information and cybersecurity frameworks. The outcome of this exercise culminated in the design of a socio-technical systems cybersecurity framework that can be applied to any new or existing information and cybersecurity solutions in the organisation. A framework parameter to help continuously monitor the mutual alignment of the social, technical and environmental dimensions of the socio-technical systems cybersecurity framework was also introduced. Findings The results indicate a positive application of the socio-technical systems theory to the information and cybersecurity domain. In particular, the application of the conceptual process model is able to successfully categorise the selected information and cybersecurity practices into either social, technical or environmental practices. However, the validation of the socio-technical systems cybersecurity framework requires time and continuous monitoring in a real-life environment. Practical implications This research is beneficial to chief security officers, risk managers, information technology managers, security professionals and academics. They will gain more knowledge and understanding about the need to highlight the equal importance of both the social, technical and environmental dimensions of information and cybersecurity. Further, the less emphasised dimension is posited to open an equal but mutual security vulnerability gap as the more emphasised dimension. Both dimensions must, therefore, equally and jointly be emphasised for optimal security performance in the organisation. Originality/value The application of socio-technical systems theory to the information and cybersecurity domain has not received much attention. In this regard, the research adds value to the information and cybersecurity studies where too much emphasis is placed on security software and hardware capabilities.

Extracting Key Factors of Cyber Hygiene Behaviour Among Software Engineers: A Systematic Literature Review

“…In studies [50] and [66], authors demonstrate that cybersecurity self-efficacy can influence individuals' intentions to strengthen their cyber hygiene practices. In cyber hygiene, self-efficacy is a part of the appraisal in which a significant predictor of security behaviour is linked to the individual's confidence in performing the security behaviour [83] and [68].…”

“…There are individual differences among men and women's cyber hygiene habits. The authors in [1] also explained that women had been found to create weaker passwords and updated software less often than males; it is also given that males had more knowledge about cyber hygiene than females [27], [50].…”

“…In [28], [49], and [51], it is reported that a culture of awareness and training is also essential and should not be overlooked. Cybersecurity awareness and cyber hygiene information are mandatory for all employees [45], [47], [50]. Cyber hygiene detection and security awareness are done in the same way and are done legally [53], [58], [63].…”

“…Social barrier refers to lack of dedication and attention from management, the lack of management awareness, and a lack of security awareness between employees [29]. Government guidelines on cyber hygiene behaviour and security awareness are not well defined [8], [44], [50], [53]. Organizational employees do not have time to start a security process [59], [61], [63].…”

Challenges of upgrading craft workforce into Construction 4.0: framework and agreements

“…Personal privacy and security are challenges of global data information sharing (Chatterjee, 2019). On the other hand, new ways of business operations bring embedded cybersecurity issues (Malatji et al, 2019).…”