1st Edition
Human Factors and Cybersecurity The Psychology of Online Safety and Security
1 Chapter 1: The Foundations of Cybersecurity. 11
1.1 Misplacing information is not something new! 11
1.2 The Development of modern Information Security. 12
1.3 What is this thing you humans call ‘Information Security?’ 13
1.3.2 Is the CIA model still relevant?. 15
1.4 The Origins of Cybersecurity. 16
1.4.1 Defining Cybersecurity. 16
1.6 Consolidating Cyber and Information Security. 21
2 The Insider Threat: Understanding the Risks Within. 24
2.2 What is an Insider Threat?. 25
2.3 The Accidental or Unintentional Insider Threat 26
2.4 Taxonomical approaches to The Malicious Insider Threat 27
2.5 Psychological Precursors for Malicious Insider Threat 31
2.6 Mitigating the Insider Threat 41
3 3. A Human-Centred Approach. 45
3.2 Why Work on Human Factors in Cybersecurity?. 46
3.3 Introducing the Human Factors Approach. 47
3.4 Cybersecurity as a Complex System.. 48
3.5 Applying the Human Factors Approach. 49
3.6 Previous work on Human Factors and Cybersecurity. 52
4 The Role of Context and Individual Differences. 59
4.3.2 Limits on Attentional Capacity. 61
4.4.2 Risk Perception and Risk Taking. 67
5.3 Understanding the types of Human Error. 76
5.4 The Role of Prior Intent in Errors; Did we really mean to do that?! 77
5.5 Non-Intentional Voluntary Actions. 78
5.6 The Types of Errors that can emerge. 79
5.7 Active versus Latent errors. 81
5.8.1 Endsley’s Three Tier Model for SA. 82
5.8.2 Application to Cybersecurity. 84
5.9 Enhancing SA for Cybersecurity Awareness. 85
6 Cognitive Pitfalls and Cybersecurity. 90
6.2 Type 1: Heuristic or Inductive Processing. 91
6.3 Type 2: Systematic, Deductive Processing. 92
6.4.2 Availability Heuristic. 95
6.4.3 Anchoring and Adjustment 96
6.6 How do we deal with Cognitive Biases?. 103
7 Decision Making Under Pressure. 106
7.2 The Theory of Planned Behaviour (TPB, Ajzen, 1985; 1991) 107
7.2.1 Theory of Planned Behaviour and Cybersecurity. 108
7.3 Protection Motivation Theory (PMT) 109
7.3.3 PMT and Cybersecurity. 110
7.4 Technology Theat Avoidance Theory (TTAT) 112
7.4.1 TTAT and Cybersecurity. 113
7.5 General Deterrence Theory. 113
7.5.1 GDT and Cybersecurity Awareness. 114
7.6 Neutralisation Theory. 115
7.6.1 Neutralisation theory and Cybersecurity. 117
7.7 Which theory is best?. 118
8 Assessing Cybersecurity Awareness. 123
8.2.1 The Security Behaviour Intentions Scale (SeBIS) 126
8.2.2 Summary of self-report methods. 130
8.3.1 Interviews and focus groups. 132
8.4 Other methods – simulations and games. 134
9 Personality and Workplace Cybersecurity. 138
9.2.1 Openness to Experience. 139
9.3 Personality and Counterproductive work behaviours. 142
9.4 Dark Triad and Cybersecurity. 143
9.5 The Dark Triad and Counterproductive Work Behaviours. 145
9.6 How Relevant are Personality factors in Cybersecurity?. 145
9.6.1 Additional Considerations. 146
10 Cultural Influences on Cybersecurity Practices. 148
10.3 National Culture and Trust 152
10.4 National Culture and Risk Perception. 153
10.5 Culture and Information Security Awareness. 157
10.6 Organisational Culture. 159
10.7 Defining Cybersecurity Culture. 161
11 Counterproductive Work Behaviour and Cybersecurity. 167
11.2 Counterproductive Work Behaviours. 167
11.3 Cyber-Counterproductive Work Behaviours (C-CWB). 168
11.4 Predictors for Counterproductive Work Behaviours. 170
11.4.5 Moral Disengagement 175
11.5 Work Locus of Control 178
11.6 Strategies for Dealing with Counterproductive Work Behaviours. 179
12 The Dark Side of Technology in the Workplace: Implications for Cybersecurity. 181
12.2.1 Technostress and Cybersecurity Fatigue. 184
12.2.2 Mitigating Technostress and Cybersecurity Fatigue. 186
12.3.1 Multitasking and Cybersecurity. 188
12.4.1 Interruptions and Cybersecurity. 190
12.6 The Social Media Paradox and the Fear of Missing Out (FoMO) 192
12.7.1 Cyberloafing – Surely it does not impact Cybersecurity. 194
12.7.2 Mitigation strategies for Cyberloafing. 195
13 The Psychology of Cybercrime. 198
13.3 The Psychological Foundations of Cybercrime. 198
13.4 Cognitive Biases and Heuristics in Cybercrime. 199
13.5 Influence and Persuasion. 200
13.5.3 Conformity and Social Proof. 203
13.5.5 Commitment and consistency. 205
13.8 Mitigation Strategies. 209
14.3.1 Gamification Mechanics. 215
14.3.2 Gamification and Cybersecurity. 215
14.3.3 Barriers to implementation of Gamification. 216
14.5 On the Effectiveness of Nudges. 219
14.6 Social and Peer Led learning. 220
14.7 Cybersecurity Awareness Campaigns. 222
14.8 Cybersecurity Judgement and Decision Making. 224
Biography
Lee Hadlington is an Associate Professor in Cyberpsychology at Nottingham Trent University. His research focuses directly on aspects of risk and resilience in Cyberspace, with a particular emphasis on susceptibility to cybercrime, fake news and misinformation, cybersecurity, and information security.
Chloe Ryding is a Senior Lecturer in Psychology at Nottingham Trent University. Her research focuses on on-line behaviour and well-being, with interests in social media use, misinformation and fake news, and cybersecurity.
