Chapter 19 — Human factors and cyber policy: scope and theory

Lesson map

Lesson 19 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["19.1 Scope"]
  N2["19.2 Behaviour theories"]
  N3["19.3 Applying theory"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["19.1 Scope"]
  N2["19.2 Behaviour theories"]
  N3["19.3 Applying theory"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX055"]

[Learning outcomes]
    |
    v
[19.1 Scope]
    |
    v
[19.2 Behaviour theories]
    |
    v
[19.3 Applying theory]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) define the scope of human factors in cyber security; (2) explain key theories of security behaviour; (3) apply theory to Ashcombe.

19.1 Scope

Human factors in cyber security studies how people interact with security: users, defenders, managers and attackers. It covers usability, decision-making, culture, policy, training and social engineering. Nadia learns that the field moved from blaming users to designing for them, a shift captured in the titles of Adams and Sasse (1999), Users are not the enemy, and Sasse, Brostoff and Weirich (2001), Transforming the weakest link. The scope also includes policy, because rules and laws shape what organisations ask of people. Nadia reads both papers in full.

19.2 Behaviour theories

Several theories help explain security behaviour. The theory of planned behaviour by Ajzen (1991) says intentions depend on attitudes, social norms and perceived control. The compliance budget (Beautement, Sasse and Wonham, 2008) says people weigh security effort against their main tasks. Herley (2009) argued that rejecting some advice is rational when its costs exceed its benefits. Nadia compares these theories and notes that they agree on one point: behaviour depends on how easy and worthwhile the secure action feels, not just on knowledge. She summarises each in a table.

19.3 Applying theory

Nadia applies these theories to Ashcombe's reporting problem. Planned behaviour suggests checking whether staff believe colleagues report and whether reporting feels easy. The compliance budget suggests checking whether reporting competes with serving members. Herley's view suggests checking whether staff see any benefit from reporting. She turns each into a survey item. Theory thus guides what to measure, rather than leaving the study to whatever questions occur to her, and it helps explain results once data arrive. Each item is linked to one theory in her plan.

Worked example

Nadia defines the field, compares three theories and turns them into survey items for Ashcombe.

Synthetic case. The application is synthetic; Ajzen (1991), Beautement et al. (2008) and Herley (2009) are real.

Errors and limits

Theories overlap. Survey items may not capture constructs fully.

Exercises

• EX055 — Field shift. What shift does the field show?
  Show marking criteria

  Rubric: 3 = from blaming users to designing for them;; 2 = design;; 1 = vague;; 0 = none.
• EX056 — Planned behaviour parts. What three factors shape intentions in Ajzen's theory?
  Show marking criteria

  Rubric: 3 = attitudes, norms and perceived control;; 2 = three;; 1 = vague;; 0 = none.
• EX057 — Common point. On what do the theories agree?
  Show marking criteria

  Rubric: 3 = behaviour depends on how easy and worthwhile secure action feels;; 2 = ease;; 1 = knowledge;; 0 = none.

Synthesis

Theory defines what to look for in security behaviour and guides measurement.

Continue studying — chapter 19 of 40

← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →