No abstract

Human elements have been identified as a factor in over 95% of all security incidents. Current technical preventive, corrective, and defensive mechanisms address intelligent and practical approaches to increase the resilience of information technology (IT) systems. However, these approaches do not fully consider the behavioral, cognitive, and heterogeneous motivations that lead to human failure in the security causal chain. In this paper, we present the Awareness Continuum Management Model (ACM2), which is a role-based and topic-based theoretical approach for an information security awareness and training program that uses Boyd’s observe–orient–decide–act (OODA) loop as a framework. The proposed ACM2 is based on the situational engineering method and regards the human firewall as an integral, indispensable, and complementary part of the holistic approach to increase IT systems’ resilience. The proposed approach can be applied to different types of organizations and critical infrastructure and can be integrated into existing training programs.

In more than 95% of all successfully conducted cyberattacks, the human factor is exploited as a vulnerability point. The following principle applies. Whenever a hacker uses external attack vectors and thus does not directly use the Internet as a medium, employees become the target of the attack. As a result, the current technical and intelligent defense mechanisms can only contribute to a limited extent to the increase the resilience of IT systems, as these technological approaches do not fully account for the behavioral, cognitive, and heterogeneous motivations that lead to human error in the security causal chain of information security using social engineering (SE) methods. In this paper, we present a strategic and iterative analysis tool to detect SE threats through systemic monitoring, to train and successfully defend against them. For this purpose, we use the so-called Course of Actions to practically check the security-compliant behavior of employees and to initialize the feedback processes for reactivating the human firewall based on the knowledge gained. This approach is already being applied to various types of organizations and critical infrastructure and can be seamlessly integrated into existing training and auditing programs.

No abstract

No abstract