Search

Data shows that 12% of leaders are rated as ‘very effective’ at leadership. This research emphasizes the importance of understanding human behavior and its impact on leadership effectiveness, innovative work behavior (IWB), and the ability to respond to complex cyber threats, particularly in the realm of cybersecurity leadership. Emotional intelligence (EI), a key human factor, is highlighted as a crucial element that can stimulate cognitive absorption, leading to innovative work behavior and improved innovation efficiency (IE). This underscores the need for leaders to not only be technically proficient but also emotionally intelligent to effectively manage their teams and respond to cyber threats. The article also calls for a shift in leadership education to a more holistic and engaged exploration of key leadership attributes, moving beyond traditional methods that often limit understanding to a single culture or approach. This involves understanding the human factors that influence leadership styles and their effectiveness. Furthermore, the use of a literature review underscores the need for leaders to understand the human elements behind cyber threats. Overall the data suggests that leaders need a comprehensive understanding of leadership principles and an active engagement in its theories to foster innovative thinking within cybersecurity leadership.

This position paper delves into the complex interplay between proactive cyber defense mechanisms and inherent human susceptibilities. The researchers posit that as cyber systems advance in technical robustness, malicious entities progressively exploit human psychological tendencies and behavioral inconsistencies to circumvent security measures. These exploitations are not merely opportunistic but are strategic, leveraging a profound comprehension of human cognitive biases to undermine security infrastructures. The researchers argue for broadening the intellectual horizon in this domain, underscoring the imperative for a multidisciplinary methodology that amalgamates the empirical acumen of psychology, sociology, and computer science. The article asserts that the fortification of cyber defenses is contingent upon the comprehensive integration of human vulnerability assessments within cybersecurity frameworks. This position paper calls for an augmentation of scholarly research at the nexus of offensive cybersecurity and human factors, formulating defense mechanisms centered around the human element and promulgating inclusive cybersecurity policies that harmonize human and technological considerations.

Stress, burnout, and security fatigue continue as slight destroyers of strong cybersecurity and significant human factors concerns. The persistence of these human performance issues is concerning given the lack of mitigation and integration of human factors practitioners to mitigate these adverse risk circumstances. Security fatigue is not a new phenomenon but the evolving nature of cybersecurity results in various sub-categories of security fatigue; thus, making it a difficult problem to solve. Stress and burnout are major causes of short tenures in senior roles for security executives. Business decision-makers lack the expertise to explore the negative influences of stress, burnout, and security fatigue on cybersecurity. Technology-led cycles are organizations’ primary course of action to mitigate cybersecurity threats, resulting in complexity debt and making businesses more vulnerable to attacks. Human factors professionals can identify high-friction areas that degrade human performance and implement initiatives to reduce the risk. Human performance degradation in cybersecurity is a critical risk factor and requires immediate attention, given that cybercriminals continue to exploit human weaknesses to gain access to sensitive and critical infrastructure.

As organizations raced to leverage cloud computing to capitalize on its economic and flexible computing capacity, misconfiguration errors ascended to unprecedented levels. One security expert noted observing over 230 million misconfigurations daily. Cloud misconfiguration errors are problematic as malicious actors continually pursue missteps to gain unauthorized access. The complexity of cloud computing coupled with increased cloud usage and the lack of cloud expertise result in misconfiguration errors which are human errors. Leveraging the human factors analysis and classification system (HFACS) provides a framework for identifying and preventing causal pathways for misconfiguration errors. In cloud computing, practitioners can explore the linkages of the hierarchical levels and decision-making at each level that influences and enable the misconfigurations. Human errors in cybersecurity are rampant, and HFACS could provide comprehensive analyses to highlight how errors, mistakes, and violations propagate misconfiguration errors – a current blind spot in cloud computing.

Human factors remained unexplored and underappreciated in information security. The mounting cyber-attacks, data breaches, and ransomware attacks are a result of human-enabled errors, in fact, 95% of all cyber incidents are human-enabled. Research indicates that existing information security plans do not account for human factors in risk management or auditing. Corporate executives, managers, and cybersecurity professionals rely extensively on technology to avert cybersecurity incidents. Managers fallaciously believe that technology is the key to improving security defenses even though research indicates that new technologies create unintended consequences; nonetheless, technological induced errors are human-enabled. Managers’ current perspective on the human factors problem information security is too narrow in scope and more than a training problem. The management of complex cybersecurity operations accompanied by mounting human factor challenges exceeds the expertise of most information security professionals; yet, managers are reluctant to seek the expertise of human factors specialists, cognitive scientists, and behavioral analysts to implement effective strategies and objectives to reduce human-enabled error in information security.