PaperlayerView exact revision on arXiv

Source-linked AI summary

Human Behaviour as an aspect of Cyber Security Assurance

Mark Evans, Leandros A. Maglaras, Ying He, Helge Janicke

arXiv:1601.03921v1cs.CRcs.CY

TL;DR

Despite continuing cyber security breaches, the article identifies a lack of consistent assurance quantification for human behaviour. It reviews research and proposes a framework drawing on human reliability assessment, statistical quality control, and human-vulnerability scoring. It concludes that further research is needed to develop repeatable quantification, while noting that the framework would require additional resources and time.

  • Problem

    Current cyber security assurance lacks a consistent way to quantify human-behaviour vulnerabilities and confirm that controls were applied as intended.

    Source: §3.1 · p. 5

  • Method

    The article reviews cyber security assurance research and considers human reliability assessment, statistical quality control, and human-vulnerability scoring for a proposed framework.

    Source: §6 · pp. 11–12, §8 · p. 19

  • Results

    The review identifies a need for further research and a framework based on defined, repeatable quantification of human-related tasks affecting cyber security posture.

    Source: §8 · p. 19

  • Takeaways & Limitations

    The authors argue that human reliability assessment can affect risk-assessment outputs and complement technical risk analysis.

    Source: §6 · p. 12

    HEART’s first-generation task-and-person focus may be too narrow, while applying the proposed framework requires greater resources and time.

    Source: §6 · p. 13, §7 · p. 18

Abstract

from arXiv · show

There continue to be numerous breaches publicised pertaining to cyber security despite security practices being applied within industry for many years. This article is intended to be the first in a number of articles as research into cyber security assurance processes. This article is compiled based on current research related to cyber security assurance and the impact of the human element on it. The objective of this work is to identify elements of cyber security that would benefit from further research and development based on the literature review findings. The results outlined in this article present a need for the cyber security field to look in to established industry areas to benefit from effective practices such as human reliability assessment, along with improved methods of validation such as statistical quality control in order to obtain true assurance. The article proposes the development of a framework that will be based upon defined and repeatable quantification, specifically relating to the range of human aspect tasks that provide, or are intended not to negatively affect cyber security posture.

1. Introduction

The article focuses on human behavior as a cyber security assurance concern amid continuing breaches and argues for research into more consistent assurance practices. It reviews the human element and proposes further research using assurance mechanisms from other fields.

1. Introduction

  • 50% of the worst breaches in the cited year were attributed to inadvertent human error, up from 31% the previous year.The authors identify people’s unintentional mistakes as a persistent element of information security risk.Source: §1 · p. 2

1.1. Motivation

  • The article’s motivation is to identify weaknesses in current cyber security practice and assess whether established approaches from other fields could improve it.It takes a holistic look at published research and survey results to identify areas for further research.Source: §1.1 · p. 2

1.2. Contributions

  • Its contributions include reviewing breach and assurance research, examining the human element, and proposing further research using non-standard assurance mechanisms.The article also highlights possible implications, including resourcing overhead.Source: §1.2 · p. 3

2. Publicised cyber security data breaches

The article reports frequent breaches across healthcare and other organisations, while noting that increased security-awareness training coincided with rising staff-related breaches.

2. Publicised cyber security data breaches

  • 7,255 NHS data breaches were recorded between 2011 and 2014, with a 101% increase from 2013 to 2014.The cited survey also found nearly 9 out of 10 large organisations had experienced some form of breach.Source: §2 · p. 3
  • The cited survey found breaches increased from 81% to 90% of large organisations, and nearly 9 in 10 surveyed large organisations reported some breach.The article presents these figures as evidence that breaches were widely experienced and expected to continue.Source: §2 · p. 3
  • 72% of large organisations delivered ongoing security-awareness training, compared with 68% the previous year, even as staff-related breaches rose.The article says this suggests that simply distributing standard awareness information is not effective assurance for human behaviour.Source: §2 · p. 4

3. Assurance Definition

The article distinguishes assurance from the security controls themselves and describes operational and extrinsic assurance. It argues that existing assurance methods and standards do not provide consistent, specific quantification of human-related cyber security risks.

3. Assurance Definition

  • Assurance is grounds for confidence that integrity, availability, confidentiality, and accountability have been adequately met; the article focuses on operational and extrinsic assurance.Operational assurance concerns maintaining security functionality in use, while extrinsic assurance is independent of the development environment.Source: §3 · p. 4

3.1. Assurance Methods

  • Current assurance frameworks are broad and flexible, but the article says they do not fully address cyber security-specific requirements.It notes a need for practical guidance and consistent quantification of human vulnerabilities, analogous to technical scoring with CVSS.Source: §3.1 · pp. 4–5
  • Security controls such as those represented by the McCumber Cube do not confirm that controls were applied correctly or as intended.Figure 1 presents a conceptual model of assurance requirements encompassing the McCumber Cube.Source: §3.1 · p. 5, Figure 1 · p. 6

3.2. Common standards

  • The article argues that broad standards based on confidentiality, integrity, and availability do not provide sufficiently specific cyber security assurance, including for human factors.It notes that 51 of 63 HSCIC Information Governance Toolkit requirements originated from the ISO 27000 series and calls for a more stringent cyber security assurance framework.Source: §3.2 · p. 7

4. Current cyber security human factor statistics

The reported statistics connect cyber security incidents to negligent and inadvertent insider activity, staff-related breaches, and broader access to sensitive data. The article also highlights limited employee monitoring and limited empirical evidence about human behaviour and training.

4. Current cyber security human factor statistics

  • 51% considered the negligent insider the chief threat, while only 28% of organisations conducted employee monitoring.The article notes that the report’s “Looking Forward” section did not mention human security testing.Source: §4 · p. 8
  • Three-quarters of large organisations and nearly one-third of small organisations suffered staff-related breaches; the previous-year figures were 58% and 22%, respectively.The survey also found staff-related breaches at 72% of companies where the security policy was poorly understood; healthcare respondents reported unintentional exposure 83% more often than overall respondents.Source: §4 · p. 8
  • 92% of organisations allowed calendar and email access via mobile devices, 52% allowed health-record access, and 15% of large organisations reported a smartphone or tablet breach.The reported breach rate was up from 7% the previous year.Source: §4 · p. 8
  • Communications and collaboration applications were described as most vulnerable to insider attack, with perceived increases linked to awareness and training, mobile data, and data-protection strategy.The article also reports that few studies have addressed IT governance and calls for further research on human behaviour.Source: §4 · pp. 8–9
  • Inadvertent human error caused half of the single worst security breaches in 2015, while the article says empirical evidence for education and training claims remains limited.The cited survey also identified lack of staff awareness and weaknesses in vetting as contributing factors; the article notes further research is needed on behaviour and social influence.Source: §4 · p. 9

5. Human Behaviour

The review describes human security behavior as inconsistent and sometimes rewarded when risky actions save time or appear helpful. It cautions that fear appeals alone do not provide adequate assurance and need compliance feedback.

5. Human Behaviour

  • People may take known security risks because they believe bad outcomes happen to others, while risky actions can be rewarded as helpful or time-saving.The review also notes that users’ self-image as security-savvy may not match their training and actual behavior.Source: §5 · pp. 9–10
  • A one-size-fits-all approach to cyber security awareness and training does not offer adequate assurance because end users’ behavior is inconsistent.The review connects this concern to users’ perceptions, relationships, and social influence.Source: §5 · pp. 9–10
  • Fear appeals can be misunderstood, forgotten, or ignored, so the review treats them as alerts rather than sufficient assurance.It says assurance requires feedback to the sender, such as confirmation, assessment, report, test, or audit.Source: §5 · p. 10

6. Measurement and Assessment

The section argues that cyber security can quantify technical vulnerabilities but lacks a mainstream method for assessing and measuring human behavior. It considers metrics, statistical quality control, and human reliability assessment, including HEART, as approaches relevant to that gap.

6. Measurement and Assessment

  • Cyber security has no mainstream equivalent to CVSS for quantifying human behavior, despite insider-related incidents being comparable to those involving external actors.The section presents metrics as a way to communicate current state repeatably and establish what is tolerable or acceptable.Source: §6 · pp. 10–11
  • Service organisations have lagged manufacturing in SQC use because service quality is difficult to measure, and delayed or indirect feedback can limit management information.The review says consistent human-behavior quantification and accepted values are lacking in cyber security.Source: §6 · p. 11
  • Human reliability assessment uses qualitative and quantitative methods to assess the human contribution to risk and is used in high-reliability industries.Examples given are petro-chemical, nuclear, and aviation industries.Source: §6 · p. 11
  • HEART is a validated first-generation technique intended to quantify human behavior proactively and identify risks associated with human error.The review presents it as a potentially applicable approach for cyber-security tasks affecting posture.Source: §6 · p. 12
  • HEART matches a task to one of eight generic categories, identifies applicable error-producing conditions, and calculates an overall human error probability.The listed conditions range from little or no independent output checking to operator inexperience.Source: §6 · p. 12
  • Figure 2 presents the key elements of the HEART quantification process.The section identifies “Determine the Assessed Proportion” as part of that process.Source: Figure 2 · p. 13, §6 · p. 13
  • Applying HEART to cyber security may be too narrow because it focuses on the task and person, while later HRA generations consider environment and emotion.The assessment also needs to consider the aggregated effect of people performing multiple tasks.Source: §6 · p. 13

7. The Proposed Framework

The article argues that cyber security assurance gives insufficient attention to human behaviour and proposes a framework for assessing human-related vulnerabilities. It draws on human reliability assessment, statistical quality control, and a repeatable assurance cycle, while acknowledging added resource demands.

The Proposed Framework

  • Current assurance often centers on technical controls, while formal assessment, quantification, and reporting of human-factor risks remain underdeveloped.The article notes that ISO/IEC 27002:2013 addresses technical vulnerabilities but has no equivalent category for human-factor vulnerabilities.Source: §7 · p. 13
  • The email analogy contrasts a broadcast instruction with one requiring recipients to acknowledge, understand, and confirm completion.The article says independent testing and communicated results would still be needed to assure that data were moved as instructed.Source: §7 · pp. 14–15
  • Human reliability assessment methods such as HEART and statistical quality control are established in other industries but are not mainstream cyber-security practices.The article proposes adapting HEART to assess human-error potential involving concurrent access to multiple data stores and applications.Source: §7 · pp. 16–17
  • The assurance cycle communicates an instruction, implements a change, checks it, and confirms results against the original instruction.The article describes a return flow of information as necessary for assurance.Source: §7 · p. 17, Figure 4 · p. 17
  • The proposed framework combines human reliability assessment, statistical quality control, and human-focused vulnerability scoring for cyber-security-affecting tasks ranging from routine data processing to security updates.The article calls for defined, repeatable quantification across these tasks.Source: §7 · p. 17
  • The proposed assessment tests the comparable accuracy of security-professional, non-security-personnel, and employee self-assessments.The article presents this as part of the conceptual high-level framework.Source: §7 · p. 18
  • The proposed framework requires organisations to invest additional time and resources, prioritising effectiveness over efficiency.Those resources could be internal or external and independent.Source: §7 · p. 18

8. Conclusion

The conclusion calls for more research and a defined, repeatable framework to quantify human aspects of cyber security. It identifies human reliability assessment, statistical quality control, and human-focused vulnerability scoring as components, while noting that human error is reported at the core of half of the breaches discussed.

8. Conclusion

  • Half of the breaches discussed are reported to have human error at their core, motivating increased empirical and theoretical research into human aspects of cyber security.The article describes breaches across technical implementations and routine processing of confidential electronic information.Source: §8 · p. 18
  • The article proposes a defined, repeatable framework to quantify human-related tasks that affect, or are intended not to harm, cyber-security posture.The proposed components are human reliability assessment, statistical quality control, and a human-aspect vulnerability scoring system.Source: §8 · p. 19
  • The conclusion calls for further research because a common usable solution is not currently available and organisations rely on individuals’ skills and knowledge.The article identifies human error as a risk that cyber security has not yet addressed.Source: §8 · p. 19
Loading 1601.03921v1…