Chapter 2 — Human factors and cyber policy: research frontier
Lesson map
Lesson 02 published. Map, example, EX008.
flowchart TD
N0["Learning outcomes"]
N1["2.1 From weakest link to partners"]
N2["2.2 Rational rejection and budgets"]
N3["2.3 Policy frameworks"]
N4["2.4 The gap"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX008"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 From weakest link to partners"]
N2["2.2 Rational rejection and budgets"]
N3["2.3 Policy frameworks"]
N4["2.4 The gap"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX008"]
[Learning outcomes]
|
v
[2.1 From weakest link to partners]
|
v
[2.2 Rational rejection and budgets]
|
v
[2.3 Policy frameworks]
|
v
[2.4 The gap]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX008]
Learning outcomes
You will (1) map the research frontier on awareness and behaviour; (2) identify gaps that matter for policy; (3) position a contribution against prior work.
2.1 From weakest link to partners
Mireille traces how the field changed. Adams and Sasse (1999) showed that users who broke password rules were often coping with unworkable demands, not acting carelessly. Sasse, Brostoff and Weirich (2001) argued that calling users the weakest link hides design failures, and that usable security should be the goal. Whitten and Tygar (1999) showed that even motivated users could not use encryption software correctly. Together these works moved the frontier from blaming people to designing systems and policies that fit how people actually work.
2.2 Rational rejection and budgets
Herley (2009) argued that users often rationally reject security advice because its costs exceed its benefits for them. Beautement, Sasse and Wonham (2008) described a compliance budget: people have limited capacity for security effort, and each new demand competes with work. Bada, Sasse and Nurse (2019) reviewed why awareness campaigns often fail to change behaviour, citing fear messages, information overload and lack of practical support. Mireille notes that these ideas predict her intervention should succeed only if reporting is cheap and feedback is useful to staff.
2.3 Policy frameworks
Mireille reviews policy guidance. NIST SP 800-50 Rev. 1 (Hansche et al., 2024) frames awareness and training as a learning programme with roles, needs assessment and evaluation. ISO/IEC 27001:2022 requires organisations to ensure staff awareness and competence. The ENISA cybersecurity culture guidelines (2019) draw on behavioural science and recommend measuring culture, not just completion. She notes that frameworks require evaluation but rarely say what outcome to evaluate, which leaves organisations defaulting to completion counts and click rates because they are easy to measure. This gap is one reason she chose reporting as her main outcome.
2.4 The gap
Mireille states the gap: few studies compare reporting-focused programmes with click-focused ones in a public-sector organisation, at fixed lure difficulty, with pre-registered outcomes and an independent replication. Her contribution is a staggered field study with those features and a reusable measurement protocol. Prof. Aalto pushes her to state what the contribution is not: it does not measure whether breaches fall, which would need far more time and data. Positioning a claim precisely against prior work protects it from both overstatement and dismissal.
Worked example
Mireille traces the move from weakest-link thinking to usable security, reviews budget and rejection arguments, maps policy guidance and states a precise gap.
Synthetic case. The positioning is synthetic; all cited works are real.
Errors and limits
Literature maps reflect the reader's choices. Policy guidance changes between revisions.
Exercises
- EX008 — Adams and Sasse finding. What did Adams and Sasse (1999) find about rule-breaking users? Rubric: 3 = they were coping with unworkable demands, not careless;; 2 = coping;; 1 = careless;; 0 = none.
- EX009 — Johnny study. What did Whitten and Tygar (1999) show? Rubric: 3 = motivated users could not use encryption software correctly;; 2 = usability;; 1 = vague;; 0 = none.
- EX010 — Rational rejection. Why might users rationally reject advice, per Herley (2009)? Rubric: 3 = its costs exceed its benefits to them;; 2 = cost-benefit;; 1 = ignorance;; 0 = none.
- EX011 — Compliance budget idea. What is the compliance budget? Rubric: 3 = limited capacity for security effort competing with work;; 2 = limited capacity;; 1 = vague;; 0 = none.
- EX012 — Framework silence. What do frameworks often leave unspecified? Rubric: 3 = what outcome to evaluate;; 2 = outcome;; 1 = vague;; 0 = none.
- EX013 — Not claimed. What does Mireille's contribution not measure? Rubric: 3 = whether breaches fall;; 2 = breaches;; 1 = vague;; 0 = none.
- EX014 — Contribution parts. Name two features of her planned contribution. Rubric: 3 = public sector, fixed lure difficulty, pre-registration, replication, staggered design;; 2 = two;; 1 = vague;; 0 = none.
Synthesis
The frontier has moved from blaming users to designing for them; a precise contribution fills a measurable gap without overstating it.
Continue studying — chapter 02 of 08
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →