Botching Human Factors in Cybersecurity in Business Organizations

Abstract

Human factors remained unexplored and underappreciated in information security. The mounting cyber-attacks, data breaches, and ransomware attacks are a result of human-enabled errors, in fact, 95% of all cyber incidents are human-enabled. Research indicates that existing information security plans do not account for human factors in risk management or auditing. Corporate executives, managers, and cybersecurity professionals rely extensively on technology to avert cybersecurity incidents. Managers fallaciously believe that technology is the key to improving security defenses even though research indicates that new technologies create unintended consequences; nonetheless, technological induced errors are human-enabled. Managers' current perspective on the human factors problem information security is too narrow in scope and more than a training problem. The management of complex cybersecurity operations accompanied by mounting human factor challenges exceeds the expertise of most information security professionals; yet, managers are reluctant to seek the expertise of human factors specialists, cognitive scientists, and behavioral analysts to implement effective strategies and objectives to reduce human-enabled error in information security.

The Role of User Behaviour in Improving Cyber Security Management

“…Several reports have shown that humans are considered the greatest vulnerability to security (Schneier, 2004;Furnell and Clarke, 2012), which has been also confirmed by recent reports. One report estimated that 95% of cyber and network attacks are due to human errors (Nobles, 2018). In our context, humans are either computer system users or security analysts (King et al, 2018;Andrade and Yoo, 2019), though most research on this area focuses on errors done by computer system users.…”

“…Most of the research on cybersecurity has focused on improving computer network systems (Nobles, 2018), as many believe that information technology advances and software development is the main way to increase information security (Sadkhan, 2019;Benson and Mcalaney, 2020). Fewer studies have been conducted on enhancing cognitive capabilities and situational awareness of system analysts (D'Amico et al, 2005;Barford, 2010;Dutt et al, 2013;Knott et al, 2013;Tyworth et al, 2013;Mancuso et al, 2014;Gutzwiller et al, 2015;Aggarwal et al, 2018;Veksler et al, 2018).…”

Understanding the Talent Management Intricacies of Remote Cybersecurity Teams in Covid-19 Induced Telework Organizational Ecosystems

“…The emergence of COVID 19 has created new complexities around cybersecurity and information security risk management (Suciu, 2020). Given the impact of new cybersecurity risks, there forms a critical need to create a cybersecurity culture that includes effective teams and processes that can address the emerging treats (Sousane, 2018;Nobles, 2018). The traditional approach taken by many organizations in safeguarding their information assets has been primarily to rely on technical controls such as hardware and software (Zuhdi, 2018).…”

“…The traditional approach taken by many organizations in safeguarding their information assets has been primarily to rely on technical controls such as hardware and software (Zuhdi, 2018). However, in today's informationrisk work environments, technical controls alone are not sufficient to combat cybersecurity risks (Nobles, 2018). Organizational cybersecurity culture can be broadly described as a union of people (employees), processes, procedures, symbols, technology, training, awareness, commitment, and direct actions focused on sustaining cybersecurity within organizations (Zuhdi, 2018;Nobles, 2018).…”

“…As the marketplace continues to evolve, more organizations will be forced to turn to virtual teams to accomplish the task and operate efficiently (Quisenberry, 2018). The organizations that discover how to lead and utilize virtual cybersecurity teams accurately will ultimately create an extremely beneficial and potentially sustainable competitive advantage for themselves (Nobles, 2018).…”