Have a personal or library account? Click to login
The Intersectionality of Offensive Cybersecurity and Human Factors: A Position Paper Cover

The Intersectionality of Offensive Cybersecurity and Human Factors: A Position Paper

By: Calvin Nobles and  Ian Mcandrew  
Open Access
|Dec 2023

References

  1. Aldabbas, M., & Teufel, B. (2016). Human aspects of smart technologies’ security: the role of human failure. Journal of Electronic Science and Technology, 14(4), 311-318.
  2. Aldawood, H., & Skinner, G. (2018, December). Educating and raising awareness on cyber security social engineering: A literature review. In 2018 IEEE International Conference on Teaching, Assessment, and Learning for Engineering, 62-68. IEEE.
  3. American International Group (AIG). (n.d.). Human cyber risk: The first line of defence. Available at: https://www.aig.co.uk/content/dam/aig/emea/united-kingdom/documents/Insights/cyber-human-factor.pdf.
  4. Andersson, I., Bjursell, L., & Palm, I. (2023). Hack the Human: A qualitative research study exploring the human factor and social engineering awareness in cybersecurity and risk management among Swedish organizations.
  5. Barton, T. (2023, April 20). The human attack vector: Social engineering. Available at: https://www.nextdlp.com/resources/blog/human-attack-vector-social-engineering.
  6. Benson, V., McAlaney, J., & Frumkin, L.A. (2019). Emerging threats for the human element and countermeasures in the current cyber security landscape. In Cyber Law, Privacy, and Security: Concepts, methodologies, tools, and applications, 1264-1269. IGI Global.
  7. Boy, G.A. (2017). Human-centered design of complex systems: An experience-based approach. Design Science, 3.
  8. Bone, J. (2017). Cognitive Hack: The New Battleground in Cybersecurity... the Human Mind. CRC Press.
  9. Contreras, J.M. (2022, March 22). Why tech products should be designed alongside psychologists. Available at: https://thedecisionlab.com/insights/technology/why-tech-products-should-be-designed-alongside-psychologists.
  10. Coatesworth, B. (2023). The psychology of social engineering. Cyber Security: A Peer-Reviewed Journal, 6(3), 261-274.
  11. Coffey, J.W. (2017). Ameliorating sources of human error in cybersecurity: technological and human-centered approaches. In the 8th International Multi-Conference on Complexity, Informatics, and Cybernetics, Pensacola, 85-88.
  12. Cybenko, G., Giani, A., & Thompson, P. (2002). Cognitive hacking: A battle for the mind. Computer, 35(8), 50-56.
  13. Cybriant. (n.d.). Understanding cybersecurity attack vectors and protecting your data. Available at: https://cybriant.com/understanding-cybersecurity-attack-vectors.
  14. Evans, M., Maglaras, L.A., He, Y., & Janicke, H. (2016). Human behaviour as an aspect of cybersecurity assurance. Security and Communication Networks, 9(17), 4667-4679.
  15. Federal Bureau of Investigations (FBI). (2021). Federal Bureau of Investigation: Internet Crime Report 2021. Available at: https://www.ic3.gov/.
  16. Fritsch, L., Jaber, A., & Yazidi, A. (2022, May). An overview of artificial intelligence used in malware. In Symposium of the Norwegian AI Society, 41-51. Cham: Springer International Publishing.
  17. Guastello, S.J. (2023). Human factors engineering and ergonomics: A systems approach. CRC Press.
  18. Godin, A. (2017). Using COIN Doctrine to improve cyber security policies. Available at: https://www.sans.org/white-papers/37557/.
  19. Hiesgen, R., Nawrocki, M., Schmidt, T.C., & Wählisch, M. (2022). The race to the vulnerable: Measuring the log4j shell incident. arXiv preprint arXiv:2205.02544.
  20. Hollnagel, E. (2016). The nitty-gritty of human factors. Human factors and ergonomics in practice: Improving system performance and human well-being in the real world, 45-64.
  21. Jahankhani, H., Al-Nemrat, A., & Hosseinian-Far, A. (2014). Cybercrime classification and characteristics. In Cyber crime and cyber terrorism investigator’s handbook, 149-164. Syngress.
  22. Janczewski, L.J., & Fu, L. (2010, October). Social engineering-based attacks: Model and New Zealand perspective. In Proceedings of the International Multiconference on ComputerScience and Information Technology, 847-853. IEEE.
  23. Jeong, J., Mihelcic, J., Oliver, G., & Rudolph, C. (2019, December). Towards an improved understanding of human factors in cybersecurity. In 2019 IEEE 5th International Conference on Collaboration and Internet Computing (CIC), 338-345. IEEE.
  24. Joinson, A., & van Steen, T. (2018). Human aspects of cyber security: Behaviour or culture change? Cyber Security: A Peer-Reviewed Journal, 1(4), 351-360.
  25. Jones, D. (2023, June 05). Cybercriminals target C-suite, family members with sophisticated attacks. Available at: https://www.cybersecuritydive.com/news/cybercriminals-target-c-suite/652052/.
  26. Kamoun, F., Iqbal, F., Esseghir, M.A., & Baker, T. (2020, October). AI and machine learning: A mixed blessing for cybersecurity. In 2020 International Symposium on Networks, Computers and Communications (ISNCC), 1-7. IEEE.
  27. Kim, K., Alfouzan, F.A., & Kim, H. (2021). Cyber-attack scoring model based on the offensive cybersecurity framework. Applied Sciences, 11(16), 7738.
  28. Maalem Lahcen, R.A., Caulkins, B., Mohapatra, R., & Kumar, M. (2020). Review and insight on the behavioral aspects of cybersecurity. Cybersecurity, 3(1), 1-18.
  29. Maathuis, C., & Chockalingam, S. (2022, June). Responsible digital security behaviour: Definition and assessment model. In European Conference on Cyber Warfare and Security, Vol. 21, No. 1.
  30. MIT and DarkTrace. (2021, April 8). Preparing for AI-enabled cyberattacks. MIT Technology Review Insights. Technologyreview.com. Available at: https://www.technologyreview.com/2021/04/08/1021696/preparing-for-ai-enabled-cyberattacks/.
  31. Mohammad, T., Hussin, N.A.M., & Husin, M.H. (2022). Online safety awareness and human factors: An application of the theory of human ecology, Technology in Society, 68, 101823.
  32. Montasari, R., Hosseinian-Far, A., & Hill, R. (2018). Policies, innovative self-adaptive techniques and understanding psychology of cybersecurity to counter adversarial attacks in network and cyber environments. Cyber criminology, 71-93.
  33. Mortazavi-Alavi, R. (2016). A risk-driven investment model for analysing human factors in information security (Doctoral dissertation, University of East London).
  34. Moustafa, A.A., Bello, A., & Maurushat, A. (2021). The role of user behaviour in improving cyber security management. Frontiers in Psychology, 12, 561011.
  35. Nobles, C. (2018). Botching human factors in cybersecurity in business organizations. HOLISTICA–Journal of Business and Public Administration, 9(3), 71-88.
  36. Nobles, C. (2019). Establishing human factors programs to mitigate blind spots in cybersecurity. MWAIS 2019 Proceedings, 22.
  37. Nobles, C., Robinson, N., & Cunningham, M.(2022, September). Straightfrom the human factors professionals’ mouths: The Need to Teach Human Factors in Cybersecurity. In Proceedings of the 23rd Annual Conference on Information Technology Education, 157-158.
  38. Nobles, C. (2022). Stress, burnout, and security fatigue in cybersecurity: A human factors problem. HOLISTICA–Journal of Business and Public Administration, 13(1), 49-72.
  39. Nobles, C. (2022a, March) The Dunning-Kruger Effect around human factors in cybersecurity, Top Cyber News Magazine. Avaialble at: https://www.linkedin.com/company/topcybernews/.
  40. Patient Safety Network (PSN). (2019, September 07). Human factors engineering. Available at: https://psnet.ahrq.gov/primer/human-factors-engineering#.
  41. Pratt, M.K. (2023, July 04). Why cyberpsychology is such an important part of effective cybersecurity. Available at: https://www.csoonline.com/article/643967/whycyberpsychology-is-such-an-important-part-of-effective-cybersecurity.html.
  42. Rahman, T., Rohan, R., Pal, D., & Kanthamanon, P. (2021, June). Human factors in cybersecurity: A scoping review, In The 12th International Conference on Advances in Information Technology, 1-11.
  43. Robinson, N. (2023). Human factors security engineering: the future of cybersecurity teams. EDPACS, 1-17.
  44. Rogers, W.A., & McGlynn, S.A. (2018). Human factors and ergonomics: History, scope, and potential. In Human Factors and Ergonomics for the Gulf Cooperation Council, 1-20. CRC Press.
  45. Sharit, J. (2012). Human error and human reliability analysis. Handbook of human factors and ergonomics, 734-800.
  46. Smeets, M. (2018). The strategic promise of offensive cyber operations. Strategic Studies Quarterly, 12(3), 90-113.
  47. Stein, A. (2018, June 22). Few minutes with Alexander Stein. CISO Mag.com. Available at: https://www.cisomag.com/few-minutes-with-alexander-stein/.
  48. Taylor-Jackson, J., McAlaney, J., Foster, J.L., Bello, A., Maurushat, A., & Dale, J. (2020). Incorporating psychology into cyber security education: a pedagogical approach. In Financial Cryptography and Data Security: FC 2020 International Workshops, AsiaUSEC, CoDeFi, VOTING, and WTSC, Kota Kinabalu, Malaysia, February 14, 2020, Revised Selected Papers 24, 207-217. Springer International Publishing.
  49. Tetaly, M. & Kulkarni, P. (2022, October). Artificial intelligence in cyber security – A threat or a solution. In AIP Conference Proceedings 2519, p. 030036.
  50. Uren, T., Hogeveen, B., and Hanson, F. (2018, July 04). Defining offensive cyber capabilities. Australian Strategic Policy Institute. Available at: https://www.aspi.org.au/report/defining-offensive-cyber-capabilities.
  51. U.S. Office of the Chairman of the Joint Chiefs of Staff. Cyberspace Operations. Joint Publication (J.P.) 3-12. Washington, DC: CJCS, 8 June 2018.
  52. Verizon. (2023). Data breach investigations report. Available at: https://www.verizon.com/business/resources/reports/dbir/2023/master-guide/.
  53. Wang, Z., Sun, L., & Zhu, H. (2020). Defining Social Engineering in Cybersecurity. IEEE Access, 8, 85094-85115. Available at: https://doi.org/10.1109/access.2020.2992807.
  54. Wiederhold, B.K. (2014). The role of psychology in enhancing cybersecurity. Cyberpsychology, Behavior, and Social Networking, 17(3), 131-132.
  55. Wilson, S., Hamilton, & Stallbaum, S. (2020, May 26). The unaddressed gap in cybersecurity: Human performance. MIT Sloan Management Review. Available at: https://sloanreview.mit.edu/article/the-unaddressed-gap-in-cybersecurity-human-performance/.
  56. Wirkuttis, N. & Klein, H. (2017). Artificial intelligence in cybersecurity. Cyber, Intelligence, and Security, 1(1), 103-119.
  57. Yamin, M.M., Ullah, M., Ullah, H., & Katt, B. (2021). Weaponized AI for cyber attacks. Journal of Information Security and Applications, 57, 102722.
  58. Zurowski, S., Lord, G., & Baggili, I. (2022, August). A quantitative analysis of offensive cyber operations (OCO) automation tools. In Proceedings of the 17th International Conference on Availability, Reliability and Security, 1-11.
DOI: https://doi.org/10.2478/bsaft-2023-0022 | Journal eISSN: 3100-5098 | Journal ISSN: 3100-508X
Language: English
Page range: 215 - 233
Published on: Dec 11, 2023
In partnership with: Paradigm Publishing Services
Publication frequency: 2 issues per year

© 2023 Calvin Nobles, Ian Mcandrew, published by Nicolae Balcescu Land Forces Academy
This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.