The Human Factor in Cybersecurity: Addressing the Risks of Insider Threats

Hewa Majeed Zangana; Zina Bibo  Sallow; Marwan Omar

doi:10.58602/jics.v3i2.37

Hewa Majeed Zangana IT Dept., Duhok Technical College, Duhok Polytechnic University, Duhok, Iraq
Zina Bibo Sallow Ararat Technical Private Institute
Marwan Omar Illinois Institute of Technology - USA

DOI: https://doi.org/10.58602/jics.v3i2.37

Keywords: Cybersecurity; Human Factors; Insider Threats; Organizational Culture; Training and Awareness

Abstract

In the rapidly evolving landscape of cybersecurity, the human element remains one of the most critical and complex factors to manage. Insider threats, whether originating from malicious intent or inadvertent actions, pose significant risks to organizational security. This paper explores the multifaceted nature of insider threats, examining the motivations and behaviors that drive individuals to compromise systems. By analyzing case studies and current research, we identify key vulnerabilities and the role of organizational culture in mitigating these risks. Furthermore, we propose comprehensive strategies for detecting, preventing, and responding to insider threats, emphasizing the importance of continuous education, robust access controls, and advanced monitoring technologies. This paper aims to provide a holistic understanding of the human factor in cybersecurity and offers practical solutions to address the pervasive challenge of insider threats.

References

R. A. Alsowail and T. Al-Shehari, “Techniques and countermeasures for preventing insider threats,” PeerJ Comput Sci, vol. 8, p. e938, 2022.

N. Saxena, E. Hayes, E. Bertino, P. Ojo, K.-K. R. Choo, and P. Burnap, “Impact and key challenges of insider threats on organizations and critical businesses,” Electronics (Basel), vol. 9, no. 9, p. 1460, 2020.

U. D. Ani, H. He, and A. Tiwari, “Human factor security: evaluating the cybersecurity capacity of the industrial workforce,” Journal of Systems and Information Technology, vol. 21, no. 1, pp. 2–35, 2019.

J. R. Schoenherr, “Insider threats and individual differences: Intention and unintentional motivations,” IEEE Transactions on Technology and Society, vol. 3, no. 3, pp. 175–184, 2022.

T. R. McEvoy and S. J. Kowalski, “Deriving cyber security risks from human and organizational factors–a socio-technical approach,” Complex Systems Informatics and Modeling Quarterly, no. 18, pp. 47–64, 2019.

A. Pollini et al., “Leveraging human factors in cybersecurity: an integrated methodological approach,” Cognition, Technology & Work, vol. 24, no. 2, pp. 371–390, 2022.

M. L. Green and P. Dozier, “Understanding Human Factors of Cybersecurity: Drivers of Insider Threats,” in 2023 IEEE International Conference on Cyber Security and Resilience (CSR), IEEE, 2023, pp. 111–116.

C. Nobles, “Stress, burnout, and security fatigue in cybersecurity: A human factors problem,” HOLISTICA–Journal of Business and Public Administration, vol. 13, no. 1, pp. 49–72, 2022.

L. Liu, O. De Vel, Q.-L. Han, J. Zhang, and Y. Xiang, “Detecting and preventing cyber insider threats: A survey,” IEEE Communications Surveys & Tutorials, vol. 20, no. 2, pp. 1397–1417, 2018.

M. Canham, C. Posey, and P. S. Bockelman, “Confronting information security’s elephant, the unintentional insider threat,” in Augmented Cognition. Human Cognition and Behavior: 14th International Conference, AC 2020, Held as Part of the 22nd HCI International Conference, HCII 2020, Copenhagen, Denmark, July 19–24, 2020, Proceedings, Part II 22, Springer, 2020, pp. 316–334.

A. Georgiadou, S. Mouzakitis, and D. Askounis, “Detecting insider threat via a cyber-security culture framework,” Journal of Computer Information Systems, vol. 62, no. 4, pp. 706–716, 2022.

L. Kasowaki and O. Yusef, “The Human Factor in Cybersecurity: Addressing Social Engineering and Insider Threats,” EasyChair, 2023.

M. K. S. Alwaheidi1, S. Islam, S. Papastergiou, and K. Kioskli, “Human Factors in Cybersecurity, Vol. 127, 2024, 187-193 AHFE,” Human Factors in Cybersecurity, p. 187, 2024.

N. Khan, R. J. Houghton, and S. Sharples, “Understanding factors that influence unintentional insider threat: a framework to counteract unintentional risks,” Cognition, Technology & Work, vol. 24, no. 3, pp. 393–421, 2022.

T. Baluta, L. Ramapantulu, Y. M. Teo, and E.-C. Chang, “Modeling the effects of insider threats on cybersecurity of complex systems,” in 2017 Winter Simulation Conference (WSC), IEEE, 2017, pp. 4360–4371.

I. Ghafir et al., “Security threats to critical infrastructure: the human factor,” J Supercomput, vol. 74, pp. 4986–5002, 2018.

M. Theis et al., “Common sense guide to mitigating insider threats,” 2019.

W. J. Triplett, “Addressing human factors in cybersecurity leadership,” Journal of Cybersecurity and Privacy, vol. 2, no. 3, pp. 573–586, 2022.

C. Nobles, “Botching human factors in cybersecurity in business organizations,” HOLISTICA–Journal of Business and Public Administration, vol. 9, no. 3, pp. 71–88, 2018.

M. Omar and H. M. Zangana, Redefining Security With Cyber AI. in Advances in Information Security, Privacy, and Ethics. IGI Global, 2024. doi: 10.4018/979-8-3693-6517-5.

H. M. Zangana and M. Omar, “Threats, Attacks, and Mitigations of Smartphone Security,” Academic Journal of Nawroz University, vol. 9, no. 4, pp. 324–332, 2020.

V. Zimmermann and K. Renaud, “Moving from a ‘human-as-problem” to a ‘human-as-solution” cybersecurity mindset,” Int J Hum Comput Stud, vol. 131, pp. 169–187, 2019.

S. Nifakos et al., “Influence of human factors on cyber security within healthcare organisations: A systematic review,” Sensors, vol. 21, no. 15, p. 5119, 2021.

J. Jeong, J. Mihelcic, G. Oliver, and C. Rudolph, “Towards an improved understanding of human factors in cybersecurity,” in 2019 IEEE 5th International Conference on Collaboration and Internet Computing (CIC), IEEE, 2019, pp. 338–345.

H. Young, T. van Vliet, J. van de Ven, S. Jol, and C. Broekman, “Understanding human factors in cyber security as a dynamic system,” in Advances in Human Factors in Cybersecurity: Proceedings of the AHFE 2017 International Conference on Human Factors in Cybersecurity, July 17− 21, 2017, The Westin Bonaventure Hotel, Los Angeles, California, USA 8, Springer, 2018, pp. 244–254.