Moving from a ‘human-as-problem” to a ‘human-as-solution” cybersecurity mindset

an article by Verena Zimmermann (TU Darmstadt, Germany) and Karen Renaud (Abertay University, Dundee, UK; University of South Africa, Pretoria) published in International Journal of Human-Computer Studies Volume 131 (November 2019)

Highlights

• In the cybersecurity area humans are considered to be a problem to be controlled by both government and industry.
• Consequently, efforts are made to exclude, train, control and constrain them, reducing them to rule followers.
• We suggest that this robs organisations of their human agents’ ability to make a contribution to cyber security and their potential role as solution.
• Benefitting from similar paradigm shifts in other fields, we propose a new mindset titled ‘‘Cybersecurity, Differently”.
• We propose a set of principles for achieving this shift, and demonstrate how these could be applied.

Abstract

Cybersecurity has gained prominence, with a number of widely publicised security incidents, hacking attacks and data breaches reaching the news over the last few years. The escalation in the numbers of cyber incidents shows no sign of abating, and it seems appropriate to take a look at the way cybersecurity is conceptualised and to consider whether there is a need for a mindset change.

To consider this question, we applied a “problematisation” approach to assess current conceptualisations of the cybersecurity problem by government, industry and hackers. Our analysis revealed that individual human actors, in a variety of roles, are generally considered to be “a problem”. We also discovered that deployed solutions primarily focus on preventing adverse events by building resistance: i.e. implementing new security layers and policies that control humans and constrain their problematic behaviours. In essence, this treats all humans in the system as if they might well be malicious actors, and the solutions are designed to prevent their ill-advised behaviours.

Given the continuing incidences of data breaches and successful hacks, it seems wise to rethink the status quo approach, which we refer to as “Cybersecurity, Currently”. In particular, we suggest that there is a need to reconsider the core assumptions and characterisations of the well-intentioned human’s role in the cybersecurity socio-technical system. Treating everyone as a problem does not seem to work, given the current cyber security landscape.

Benefiting from research in other fields, we propose a new mindset i.e. “Cybersecurity, Differently”. This approach rests on recognition of the fact that the problem is actually the high complexity, interconnectedness and emergent qualities of socio-technical systems. The “differently” mindset acknowledges the well-intentioned human’s ability to be an important contributor to organisational cybersecurity, as well as their potential to be “part of the solution” rather than “the problem”. In essence, this new approach initially treats all humans in the system as if they are well-intentioned. The focus is on enhancing factors that contribute to positive outcomes and resilience. We conclude by proposing a set of key principles and, with the help of a prototypical fictional organisation, consider how this mindset could enhance and improve cybersecurity across the socio-technical system.

Graphical abstract

Full text (PDF 19pp)

---