Leveraging human factors in cybersecurity: an integrated methodological approach.

Area of Science:

• Computer and Information Security (CIS)
• Human Factors (HF)
• Healthcare Cybersecurity

Background:

• Traditional cybersecurity models are technology-centric, often viewing humans as the weakest link.
• Limited consideration is given to end-users' cognitive traits, needs, and motivations in cybersecurity.
• Healthcare organizations face unique cybersecurity challenges due to the integration of complex sociotechnical systems.

Purpose of the Study:

• To present a holistic Human Factors (HF) approach to cybersecurity in healthcare.
• To investigate the impact of individual, organizational, and technological factors on cybersecurity risks.
• To assess the cybersecurity maturity of pilot healthcare organizations from a user-centered perspective.

Main Methods:

• An integrated top-down and bottom-up methodology was employed.
• Qualitative and quantitative research methods were used to assess organizational maturity.
• The study involved both management and employees in pilot healthcare organizations, adopting a user-centered perspective.

Main Results:

• A strong cybersecurity culture does not always equate to improved rule compliance.
• Conflicts between cybersecurity rules and procedures can inadvertently create human vulnerabilities.
• Human Factors vulnerabilities significantly impact overall cybersecurity risks in healthcare.

Conclusions:

• Integrating Human Factors into cybersecurity strategies enhances Computer and Information Security (CIS) systems.
• Non-technical countermeasures, such as user awareness training, are crucial for holistic cybersecurity management.
• A comprehensive approach leveraging Human Factors is essential for effectively managing cyber threats and attacks in organizations.