Addressing Human Factors in Cybersecurity Leadership

• Published in: Journal of cybersecurity and privacy Vol. 2; no. 3; pp. 573 - 586
• Main Author: Triplett, William J.
• Format: Journal Article
• Language: English
• Published: Washington MDPI AG 22.07.2022
• Subjects: Accountability; Burnout; Communication; Corporate culture; Cybersecurity; Employees; human behavior; Human error; human factors; Human performance; Information systems; information technology; Leadership; Managers; Passwords; security risks; Work environment
• ISSN: 2624-800X; 2624-800X
• DOI: 10.3390/jcp2030029

This article identifies human factors in workplaces that contribute to the challenges faced by cybersecurity leadership within organizations and discusses strategic communication, human–computer interaction, organizational factors, social environments, and security awareness training. Cybersecurity does not simply focus on information technology systems; it also considers how humans use information systems and susceptible actions leading to vulnerabilities. As cyber leaders begin to identify human behavior and processes and collaborate with individuals of the same mindset, an organization’s strategy can improve substantially. Cybersecurity has been an expanding focal point from the viewpoint of human factors. Human inaccuracy can be unintentional due to an inaccurate strategic implementation or accurate unsatisfactory plan implementation. A systematic literature review was conducted to realize unintentional human factors in cybersecurity leadership. The results indicate that humans were the weakest link during the transmission of secure data. Furthermore, specific complacent and unintentional behaviors were observed, enabled by the ignorance of leaders and employees. Therefore, the enforcement of cybersecurity focuses on education, awareness, and communication. A research agenda is outlined, highlighting a further need for interdisciplinary research. This study adopts an original approach by viewing security from a human perspective and assessing how people can reduce cybersecurity incidents.