Human Factors and Security Culture

Introduction

Cybersecurity is often described in technical terms—firewalls, encryption, authentication and monitoring—but security outcomes also depend on people. Employees interpret warnings, choose passwords, approve transactions, handle information, report unusual events and respond to pressure. A technically secure system can therefore be compromised through an unsafe decision, a misunderstood procedure or a workplace culture that discourages reporting.

Human factors and security culture concern the relationship between people, technology, organizational processes and the wider environment. The objective is not to blame individuals for every incident. Rather, it is to understand why people act as they do, reduce opportunities for error, make secure behaviour practical and ensure that managers accept responsibility for the conditions in which decisions are made.

This chapter examines human error, social engineering, insider risk, security awareness, phishing resistance, acceptable-use controls, privacy and usability. It also considers how organizations can measure and improve security culture without creating fear, excessive surveillance or unproductive compliance rituals.

Learning Objectives

By the end of this chapter, you should be able to:

• distinguish human error, unsafe behaviour, social engineering and insider risk;
• explain how usability, workload, incentives and organizational culture affect security;
• identify common social-engineering techniques and appropriate responses;
• design practical awareness and phishing-resistance measures;
• develop balanced acceptable-use requirements;
• analyze insider-risk scenarios while respecting privacy and due process;
• explain the responsibilities of managers, users and security professionals; and
• evaluate security-culture initiatives using meaningful evidence.

1. Human Factors in Cybersecurity

Human factors is the study of how people interact with tools, tasks, environments and organizations. In cybersecurity, it asks questions such as:

• Is the secure action easy to identify and perform?
• Does the system create confusing warnings or excessive authentication prompts?
• Are employees given sufficient time, training and authority to act securely?
• Do organizational incentives reward speed while claiming to value security?
• Can staff report mistakes without fear of disproportionate punishment?

Human error and unsafe behaviour

Human error is an unintended action or omission that produces an undesired result. Examples include sending an attachment to the wrong recipient, misconfiguring a cloud storage permission or approving a fraudulent request while believing it is legitimate. Errors are not necessarily evidence of negligence.

Unsafe behaviour is broader. It may be accidental, such as leaving a laptop unattended, or deliberate, such as bypassing a security control to meet a deadline. Deliberate violations can arise from convenience, inadequate tools, peer pressure or incentives rather than malicious intent.

A useful distinction is between:

This classification supports better controls. A slip may be reduced through confirmation prompts or safer interface design. A mistake may require clearer information and practice. A violation may indicate unrealistic procedures, weak supervision or conflicting incentives. A malicious act requires investigation, access control and appropriate legal or disciplinary processes.

The Swiss-cheese perspective

The Swiss-cheese model represents accidents as the alignment of weaknesses in several defensive layers. A phishing incident might involve a convincing message, inadequate email filtering, rushed work, insufficient verification procedures and excessive privileges. Each layer contains weaknesses, or “holes”; harm occurs when the holes align.

The model discourages simplistic explanations such as “the employee clicked.” It encourages organizations to ask why the message reached the user, why the request appeared plausible, why verification was difficult and why the account had sufficient authority to cause damage. The model is not a precise probability equation; it is a diagnostic framework for layered defenses.

Usability and secure behaviour

Security controls compete with other user goals, including speed, accessibility and task completion. If a control is confusing or consistently obstructs legitimate work, users may create workarounds. Common examples include writing passwords on paper, approving prompts without reading them, using unauthorized cloud services or transferring files through personal accounts.

Secure design therefore follows principles such as:

1. Make the safe action the easy action. Provide password managers, single sign-on, automatic updates and well-designed reporting buttons.
2. Use proportionate friction. Stronger verification should be required for high-risk actions, not imposed identically on every low-risk task.
3. Give meaningful explanations. A warning should state what is happening, why it matters and what the user should do.
4. Support accessibility. Security must work for users with disabilities, different languages, varied technical experience and limited connectivity.
5. Design for recovery. Users need a simple way to report mistakes, revoke sessions and obtain assistance.

2. Security Culture and Managerial Responsibility

Security culture is the shared pattern of beliefs, expectations and behaviours concerning information protection. It is demonstrated by what an organization rewards, tolerates and discusses—not merely by the existence of a policy document.

A constructive security culture has several characteristics:

• leaders visibly follow security requirements;
• employees understand the purpose of controls;
• reporting a suspected incident is easy and encouraged;
• training is relevant to real work;
• mistakes are investigated for learning, while reckless or malicious conduct is addressed fairly;
• responsibilities are clear; and
• security is treated as an operational responsibility rather than only an IT function.

Culture can be weakened when managers demand urgent results while ignoring controls, punish staff who report mistakes, conduct irrelevant annual training or describe cybersecurity as the responsibility of “the technical team.” Employees learn from these signals more strongly than from formal slogans.

Managerial duties

Managers should identify the information and processes their teams depend on, allocate time for secure work, approve appropriate access, model acceptable behaviour and ensure that staff know how to escalate concerns. They should also examine whether targets or workflows create predictable unsafe shortcuts.

Senior leaders have additional responsibilities: establishing risk appetite, funding controls, ensuring legal compliance, appointing accountable owners and requiring evidence that controls work. Security professionals advise and enable; they cannot compensate indefinitely for leadership decisions that prioritize convenience over risk reduction.

3. Social Engineering

Social engineering is the manipulation of people to obtain information, access, money or an action. It exploits trust, authority, urgency, fear, curiosity and helpfulness rather than relying solely on technical vulnerabilities.

Common techniques include:

• Phishing: fraudulent electronic messages designed to obtain credentials, deliver malware or induce an action.
• Spear phishing: targeted phishing using information about a particular person or organization.
• Business email compromise: impersonation of an executive, supplier or employee to redirect payments or obtain sensitive information.
• Vishing: voice-based deception, often using telephone calls.
• Smishing: deception through text messages or messaging platforms.
• Pretexting: creation of a false story or identity to make a request appear legitimate.
• Baiting: offering something attractive, such as a free download or found USB device.
• Tailgating: following an authorized person into a restricted area.
• Quid pro quo: offering a supposed benefit in exchange for information or access.

Recognizing social-engineering signals

No single indicator proves that a message is fraudulent. Users should consider combinations of signals:

• unexpected requests for passwords, codes, payments or confidential files;
• pressure to act immediately or bypass normal approval;
• unusual sender addresses, domains or reply destinations;
• links whose displayed text does not match the destination;
• requests to keep an action secret;
• unusual changes to payment or delivery details;
• emotional manipulation, authority claims or threats; and
• attachments or login pages that are unexpected.

A robust response is to pause, avoid using the supplied link or contact details, verify through a trusted independent channel and report the event. Verification is especially important for financial transfers, privileged access, payroll changes and disclosure of regulated information.

Phishing awareness and resistance

Awareness is more effective when it combines knowledge, practice and technical support. A practical program should include:

1. short, role-specific learning rather than only annual generic slides;
2. examples based on the organization’s actual workflows;
3. a prominent “report phishing” mechanism;
4. multifactor authentication that limits the value of stolen passwords;
5. email authentication, filtering and attachment protections;
6. safe simulations that teach rather than humiliate; and
7. rapid feedback after reports and incidents.

Phishing simulations require ethical safeguards. Employees should know that exercises may occur, simulations should not collect unnecessary personal information, and results should normally be used for coaching and control improvement rather than public embarrassment. A click rate alone is a weak measure because it is affected by message design, sample selection and reporting opportunities. Reporting rate, time to report, repeat behaviour and successful verification are more informative when interpreted carefully.

4. Insider Risk

Insider risk is the possibility that a person with authorized access causes harm, intentionally or unintentionally. The person may be an employee, contractor, temporary worker, partner or administrator. Insider risk is not synonymous with insider threat: risk includes accidents and compromised accounts, whereas threat often emphasizes potential intentional harm.

Important categories include:

• negligent handling of information;
• accidental disclosure or misdelivery;
• compromised credentials used by an external attacker;
• disgruntled or financially motivated misuse;
• unauthorized use of systems for convenience; and
• collusion with an external actor.

Warning signs should never be treated as proof of malicious intent. A sudden change in working hours, unusual downloads or distress may have innocent explanations. Organizations should use proportionate, evidence-based investigation rather than profiling people by identity, nationality, disability, union membership or other protected characteristics.

Reducing insider risk

Effective measures are layered:

• least privilege and role-based access;
• separation of duties for sensitive transactions;
• periodic access reviews;
• strong authentication and session controls;
• data classification and loss-prevention measures;
• logging that is protected from tampering;
• joiner, mover and leaver procedures;
• secure remote-work arrangements;
• clear reporting and investigation processes; and
• fair disciplinary and legal procedures.

Technical monitoring must be governed. Employees should be informed about what is collected, why it is collected, who may access it and how long it is retained. Monitoring should be necessary, proportionate and consistent with applicable privacy, employment and data-protection law.

5. Acceptable Use and Practical Governance

An acceptable-use policy defines permitted, restricted and prohibited use of organizational devices, networks, accounts and data. It should be understandable and connected to actual work. A useful policy normally addresses:

• account and password responsibilities;
• approved devices, applications and storage services;
• personal use and prohibited activities;
• handling of confidential and regulated data;
• remote work and removable media;
• software installation and administrator rights;
• monitoring and privacy expectations;
• reporting of incidents and suspected loss; and
• consequences for deliberate or reckless violations.

Policies should distinguish between high-risk and low-risk behaviour. For example, occasional limited personal browsing may present less risk than installing unapproved software or transferring customer data to a personal account. Rules should be specific enough to guide decisions but flexible enough to support legitimate exceptions through an approval process.

A policy is effective only when supported by controls and management. If employees are prohibited from using external file sharing but no approved alternative exists, noncompliance is predictable. Governance should therefore include exception handling, periodic review, communication and measurement.

6. Designing an Awareness Program

A practical awareness program begins with risk assessment. Identify important information, common attack paths, user groups, previous incidents and tasks that involve sensitive decisions. Training can then be tailored to roles such as finance staff, developers, help-desk personnel, executives and general users.

A program may include:

Evaluation should combine quantitative and qualitative evidence. Possible measures include the percentage of staff completing relevant training, the proportion reporting simulated messages, time from detection to report, number of repeated unsafe actions, use of multifactor authentication and results from interviews or focus groups. Metrics should be interpreted in context. A low incident count may indicate effective prevention—or poor reporting.

7. Illustrative Case: The Urgent Supplier Payment

Background

Northbridge Services is a fictional medium-sized organization. Its finance team processes supplier payments through an online banking portal. The organization has annual security training but no formal verification procedure for changed bank details.

Problem

A finance officer receives an email apparently from a long-standing supplier. The message explains that the supplier has changed banks and requests an urgent payment before the end of the day. The display name is familiar, but the actual domain contains an additional word. The officer is busy, follows the email instructions and changes the supplier record. A second employee notices the change the next morning, but the payment has already been sent.

Analysis

The incident is not adequately explained by saying that the officer failed to inspect the domain. Several defensive layers were weak:

• the attacker used a plausible supplier relationship;
• the request exploited urgency and authority;
• the organization had no independent callback requirement;
• payment and supplier-record changes were not separated;
• the email system did not flag the look-alike domain prominently; and
• training had not addressed business email compromise in the finance workflow.

The officer made a mistake under pressure, but the organization also designed a process in which one person could make a high-impact change without independent verification.

Approach and solution

Northbridge introduces a mandatory callback to a previously verified supplier number for bank-detail changes. A second authorized employee approves the change and the first payment. Email security controls are strengthened, multifactor authentication is enabled for the banking portal, and staff receive short role-specific training. The reporting process is revised so that suspicious messages can be forwarded with one click.

Management also reviews workload and payment deadlines. The goal is not simply to tell staff to be more careful, but to make careful verification possible during busy periods.

Outcome and learning points

Later simulated exercises show faster reporting and increased use of independent verification. The organization does not treat simulation results as a public ranking. It uses them to improve workflows and coaching.

The case demonstrates five principles: human behaviour is shaped by context; high-risk actions require layered controls; independent verification defeats many impersonation attacks; managers must address workload and process design; and learning-oriented reporting is more valuable than blame.

8. Ethical, Legal and Contemporary Issues

Security programs can create ethical harm if they use excessive surveillance, discriminatory profiling or humiliating training. Privacy principles generally require a legitimate purpose, data minimization, transparency, appropriate security and limited retention. Exact legal obligations vary by jurisdiction and sector, so organizations should obtain appropriate legal and data-protection advice.

Artificial intelligence has increased the quality and scale of social engineering. Generative systems can produce convincing messages, cloned voices and personalized content. At the same time, AI can assist defenders by prioritizing suspicious communications, identifying unusual access patterns and helping produce role-specific training. AI outputs remain fallible: organizations need human review, data governance, secure deployment and controls against disclosure of confidential information to external services.

Remote and hybrid work create additional challenges, including home-network dependence, shared devices, isolation from colleagues and greater reliance on messaging platforms. Controls should address these conditions without assuming that office presence equals security.

Challenges and Limitations

No awareness program eliminates human error. Attackers adapt, employees face changing workloads and security decisions often involve uncertainty. Excessive training can produce fatigue; excessive controls can encourage workarounds; excessive monitoring can reduce trust and reporting. Metrics may also become targets, causing organizations to optimize visible numbers rather than genuine resilience.

Security culture is difficult to measure directly. Surveys may be affected by fear or social desirability, while incident data reflects both actual events and reporting behaviour. A balanced evaluation therefore combines observations, interviews, incident analysis, control testing and carefully selected metrics.

The most important limitation is that responsibility cannot be transferred entirely to users. Secure culture requires appropriate technology, realistic procedures, accountable leadership and fair governance. Employees are part of the security system, but they should not be treated as its sole protective barrier.

Best-Practice Checklist

• Make secure actions convenient and accessible.
• Use layered controls rather than relying on attention alone.
• Require independent verification for high-impact requests.
• Enable multifactor authentication and least privilege.
• Provide a simple, non-punitive reporting channel.
• Train by role and scenario, not only by annual compliance module.
• Use simulations ethically and interpret their results cautiously.
• Review whether performance incentives encourage unsafe shortcuts.
• Monitor proportionately, transparently and lawfully.
• Investigate incidents for both individual actions and system conditions.
• Ensure managers visibly follow the same rules as staff.
• Review policies, exceptions and metrics as technology and threats change.

Chapter Summary

Human factors are central to cybersecurity because people interact with systems, interpret requests and operate organizational processes. Human error includes slips, lapses and mistakes; violations and malicious acts require different responses. The Swiss-cheese model shows that incidents commonly result from aligned weaknesses across people, technology and procedures.

Social engineering exploits trust, authority, urgency and emotion. Phishing resistance is strengthened through role-based practice, easy reporting, independent verification, multifactor authentication and technical filtering. Insider risk includes accidental, negligent, compromised and malicious activity. Least privilege, separation of duties, access reviews, secure offboarding and proportionate monitoring reduce this risk while respecting privacy.

Security culture is expressed through leadership behaviour, incentives, reporting practices and operational design. Acceptable-use policies must be understandable, enforceable and supported by realistic alternatives. Effective programs measure behaviour and resilience rather than merely training completion or click rates. Ultimately, managers and organizations share responsibility with users for creating conditions in which secure behaviour is practical, respected and continuously improved.

Key Terms

Human factors: Study of interactions among people, technology, tasks and organizations.

Human error: An unintended action or omission that produces an undesired result.

Slip: An unintended action during a familiar task.

Lapse: A memory or attention failure.

Mistake: An incorrect plan, interpretation or judgment.

Violation: A deliberate departure from an established rule or procedure.

Security culture: Shared beliefs, expectations and behaviours concerning information protection.

Social engineering: Manipulation of people to obtain information, access, money or action.

Phishing: Fraudulent electronic communication intended to induce a harmful or unauthorized action.

Spear phishing: Targeted phishing directed at a particular person or organization.

Business email compromise: Impersonation used to induce payments, data disclosure or other unauthorized actions.

Pretexting: Deception based on a fabricated identity or story.

Insider risk: Possibility of harm caused by a person with authorized access, intentionally or unintentionally.

Least privilege: Providing only the access required for an authorized task.

Separation of duties: Dividing sensitive responsibilities among different people or roles.

Acceptable-use policy: Rules governing appropriate use of organizational systems and information.

Security awareness: Knowledge and practical understanding that support secure decisions.

Multifactor authentication: Authentication using two or more distinct factor categories.

Security monitoring: Collection and analysis of activity data to identify risks or incidents.

Usability: Degree to which a system enables users to achieve goals effectively, efficiently and satisfactorily.

Review Questions

5 Short Answer Questions

1. What is the difference between a slip, a lapse and a mistake?
2. Why is human error not always evidence of negligence?
3. Define social engineering and give two examples.
4. What is insider risk?
5. State two characteristics of a constructive security culture.

5 Long Answer Questions

1. Explain how usability and workload can influence secure behaviour. Include practical design responses.
2. Describe the main stages of an effective phishing-awareness and resistance program.
3. Compare negligent, accidental, compromised-account and malicious insider risks.
4. Explain the Swiss-cheese model and apply it to a phishing incident.
5. Discuss how an acceptable-use policy can balance security, productivity and privacy.

3 Analytical / Application Questions

1. A manager receives an urgent request to transfer money to a new account from a familiar supplier. Design a safe verification process and explain why each step is necessary.
2. An organization’s phishing simulation click rate falls, but reports of real phishing also fall. Analyze at least three possible explanations and identify additional evidence that should be collected.
3. Employees repeatedly use personal cloud storage because the approved system is slow and difficult to access remotely. Recommend a response that addresses technology, policy, management and culture.

Multiple Choice Questions with Answers

Question 1

Which example is a lapse?

A. Selecting the wrong email recipient unintentionally

B. Forgetting to lock a workstation

C. Believing a fraudulent login page is genuine

D. Deliberately sharing an account

Correct Answer: B. Forgetting to lock a workstation

Question 2

What does the Swiss-cheese model emphasize?

A. That users are the only security barrier

B. That every incident has one technical cause

C. That weaknesses in several defenses can align

D. That security controls should be removed

Correct Answer: C. That weaknesses in several defenses can align

Question 3

Which action best verifies an unexpected supplier bank-detail change?

A. Replying directly to the requesting email

B. Calling a number supplied in the same email

C. Waiting for the supplier to send a reminder

D. Using a previously verified independent contact channel

Correct Answer: D. Using a previously verified independent contact channel

Question 4

Which statement best describes insider risk?

A. Only deliberate theft by employees

B. Potential harm involving authorized access, intentional or unintentional

C. Only attacks conducted by external criminals

D. A technical vulnerability in a firewall

Correct Answer: B. Potential harm involving authorized access, intentional or unintentional

Question 5

Which control most directly limits damage from a compromised ordinary user account?

A. Least privilege

B. Annual policy printing

C. A larger email mailbox

D. Publicly ranking employees

Correct Answer: A. Least privilege

Question 6

What is a key ethical safeguard for phishing simulations?

A. Publicly naming employees who click

B. Collecting all personal browsing data

C. Using results for learning and improvement rather than humiliation

D. Never telling staff that simulations occur

Correct Answer: C. Using results for learning and improvement rather than humiliation

Question 7

Why can excessive security friction create risk?

A. It guarantees that attacks will stop

B. It may encourage users to create unsafe workarounds

C. It eliminates the need for training

D. It prevents all unauthorized access

Correct Answer: B. It may encourage users to create unsafe workarounds

Question 8

Which feature is most characteristic of a constructive security culture?

A. Employees are punished for reporting mistakes

B. Security is treated only as an IT responsibility

C. Managers visibly follow security requirements

D. Policies are kept vague to preserve flexibility

Correct Answer: C. Managers visibly follow security requirements

Question 9

Which measure is most useful for a high-impact payment request?

A. Independent verification and separation of duties

B. Allowing one person to approve and execute it

C. Removing authentication to improve speed

D. Relying only on annual awareness training

Correct Answer: A. Independent verification and separation of duties

Question 10

Why should insider-risk monitoring be proportionate and transparent?

A. To make monitoring unnecessary

B. To support privacy, trust and lawful governance

C. To ensure every employee is treated as malicious

D. To prevent incident investigations

Correct Answer: B. To support privacy, trust and lawful governance