Government and private sector leaders are shifting towards a risk-based approach to cybersecurity, recognizing that addressing all cyber risks equally is impossible in today’s digital environment. However, there is still a need to better understand and address the role of people, culture, and behavior in cybersecurity assessments and post-incident analyses.
According to Verizon’s 2023 Data Breach Investigations Report, 74% of all breaches involve the human element, a decrease from 82% in 2022. While it is commonly acknowledged that people play a significant part in cyber incidents and breaches, the typical remedies of “more training,” “more compliance,” or “more communication” may not be sufficient. A more effective response is needed.
It is important to recognize that the challenges posed by cybersecurity are not entirely new. Throughout history, technological innovations have faced resistance from existing cultures and practices. To successfully introduce new technology, bridges must be built between existing social and workplace practices and technology.
Five propositions about people and cybersecurity are presented:
1. People play a large role in cybersecurity incidents and breaches. It is necessary to develop a positive information cybersecurity culture that takes into account governance, leadership behavior, individual behavior, and team culture.
2. The risk posed by human behavior in cybersecurity remains high. Instead of solely focusing on individual behaviors, it is crucial to understand the leadership and organizational context that leads people to engage in risky behaviors.
3. Current approaches to mitigating the cybersecurity risk of human behavior are not effective. Changing the cybersecurity narrative and improving the overall coherence of cybersecurity messaging can help reduce risk.
4. The problem of human behavior in cybersecurity is multi-sided. Effective cybersecurity requires strong relationships with other organizational functions such as IT, HR, Finance, and Communications.
5. There is a need for a comprehensive model of human behavior in cybersecurity that shifts from seeing people as “the problem” to seeing them as “the solution.” This model should consider the ongoing pressures of organizational change and the characteristics of human behavior.
Reducing cybersecurity risk involves understanding the complexities of human behavior and integrating people’s experiences of work, local micro-stories, underlying motives, decision biases, and the consequences of bringing people and technology together in the workplace. People will always be at the heart of reducing cybersecurity risk.