Cyber Security and Cyberpsychology: Georgia Crossland

This piece from 4th Year CDT student Georgia Crossland, looks at how cyber security can be related to the discipline of cyberpsychology.

What is Cyberpsychology?

Cyberpsychology is a diverse area of research aiming to formalise the psychological and scientific understanding of the impact, processes and outcomes that digital technologies have facilitated in individuals, social groups and society. The cyberpsychology discipline involves research surrounding gaming, social media, virtual reality, online learning and virtual interest groups and the impact of such technologies on people. However, another growing research area is the application of psychology to cyber security (also referred to as information security).


How does cyber security fit in?

If we are looking to understand the impact that digital technologies have facilitated in individuals, groups and society, we also need to understand how, why and where security comes into play; how are individuals, groups and society, as well as their privacy and information, protected online? and why and by what means are adversaries attempting to gain unauthorised access to this information? The research in this area has largely surrounded technological solutions to cyber security. However, in more recent years, researchers in the field have realised the human factor cannot be ignored. People still, and will likely always, interact with technologies, design technologies, be targets of attacks, and are also the adversaries. This is where the application of psychology to cyber security is not only useful, but necessary. Psychology can help to answer these questions, and there is previous existing research that can easily be applied. Therefore, cyber security provides other avenues for the cyberpsychology discipline.

One of these avenues looks at how we might encourage ‘better’ cyber security behaviours in individuals (Al-Daeef, Basir & Saudi, 2017). This involves the design of cyber security awareness campaigns and training; engaging individuals in the cyber security area. As well as understanding why certain methods may be effective, while others may fail (Bada, Sasse & Nurse, 2019). These awareness and training techniques often use psychological theories such as Protection Motivation Theory (Rogers, 1975), to understand how individuals respond to different behaviour change techniques. However, this area of research is still heavily under-researched, owing to a lack of psychologists in the area, and of course, new training methods are needed all the time. This area also involves using psychological research on perceptions, biases and attitudes to better understand how individuals perceive cyber security, in order for training methods to be better designed.


Another looks at the usability of cyber security technologies (Smetters, 2008). This is the process of understanding the impact of cyber security technology and policy design on individuals. For example, some previous research has found that the reason many people use poorly formulated and unsecure passwords is because password policies are often so overly complicated. If in an organisation, you require each individual to have ten passwords, all with numbers, letters and different cases, it is no surprise people are sharing passwords, or writing them down. This area of research aims to bridge security and usability.


Summary

Overall, these were two examples of a very diverse area of research. Other psychologists in cyber security have also researched the psychology of ‘hackers’ (Gold, 2014) and cybercrime, cross-cultural understandings of cyber security (Chen, Chen, Lo & Yang, 2008), and individual differences in cyber security behaviours (Whitty, Doodson, Creese & Hodges, 2015). This research area is still heavily under-researched, hopefully the application of psychology can assist in beginning to fill such research gaps.



References

Al-Daeef, M. M., Basir, N., & Saudi, M. M. (2017, July). Security awareness training: A review. In Proceedings of the World Congress on Engineering (Vol. 1, pp. 5-7).


Bada, M., Sasse, A. M., & Nurse, J. R. (2019). Cyber security awareness campaigns: Why do they fail to change behaviour?. arXiv preprint arXiv:1901.02672.


Chen, H. G., Chen, C. C., Lo, L., & Yang, S. C. (2008). Online privacy control via anonymity and pseudonym: Cross-cultural implications. Behaviour & Information Technology, 27(3), 229-242.


Gold, S. (2014). Get your head around hacker psychology [Information Technologycyber-Security]. Engineering & Technology, 9(1), 76-80.


Rogers, R. W. (1975). A protection motivation theory of fear appeals and attitude change1. The journal of psychology, 91(1), 93-114.


Smetters, D. K. (2008). Cyber security technology usability and management. Wiley Handbook of Science and Technology for Homeland Security, 1-1.


Whitty, M., Doodson, J., Creese, S., & Hodges, D. (2015). Individual differences in cyber security behaviors: an examination of who is sharing passwords. Cyberpsychology, Behavior, and Social Networking, 18(1), 3-7.


Comments

  1. Shambhu jhaJanuary 22, 2022 at 6:16 AM

    Wel said Cyber security is a major concern for many companies. It is important to have a strong Physical Security Thanks for the valuable information.

    ReplyDelete

Post a Comment

Popular posts from this blog

Remote working and Cyber Security: Georgia Crossland and Amy Ertan

Introducing the project The shift to remote working represents a huge shift for employees and organisations alike, introducing significant implications for cyber security. Amy Ertan and Georgia Crossland are currently working on a research project, in collaboration with the Research Institute for Sociotechnical Cyber Security (RISCS) and funded by the UK National Cyber Security Centre (NCSC), on the impact of remote working on cyber security and wellbeing. This blog post will give an overview of a section of this project, how remote working impacts cyber security. In response to COVID-19, in March 2020, organisations across the world made the rapid shift away from physical office working to remote working, wherever possible. This shift has had a significant impact across many aspects of organisations. This blog post will offer a high-level overview of how the cyber threat landscape was impacted for many organisations and may further change organisational cyber resilience. Remote workin...
Read more

New Publication: Remote Working and (In)Security?: Amy Ertan

Image
A recent research report by CDT researchers Amy Ertan and Georgia Crossland has been published with the Research Institute for Sociotechnical Cyber Security (RISCS). The report examines ‘The Impact of Pandemic-Driven Remote Working on Employee Wellbeing, the Psychological Contract and Cyber Security’, with research carried out through a series of interviews with senior cyber security colleagues between January and April 2021. The full report can be found on the RISCS website: New publication: Remote Working and (In)Security | RISCS. Context In the UK and around the world, the impact of COVID-19 represented a total shift away from what was considered ‘normal living’. One aspect of this change was the rapid transition to remote working as people were encouraged to work from home and limit contact with others as far as possible through repeated lockdown conditions. Fellow CDT colleague Georgia Crossland and I were curious to explore how remote working has impacted the experiences - and se...
Read more

The Artificial Intelligence Monster: Nicola Bates

Image
Christopher Booker in 2004 wrote of the seven basic plots to any story, one of these being ‘overcoming the monster’. Within Hollywood, such ‘monsters’ often reflects the zeitgeist balancing commercial requirements with the political and societal preoccupations of the age. The monster evolves over time - from Russia in the Cold War years through to lone actors and terrorists and now to seemingly shadowy figures controlling intelligence. Whilst generally lighter in tone, such monsters also exist within children’s cinema. In recent years this monster has become increasingly defined by their use of highly sophisticated technology, finally becoming the technology in ‘The Mitchells vs. the Machine’*. Lethal technology and subversive machines aren’t new concepts in children’s movies. They can, for example, be found in ‘Short Circuit’ back in 1986. This movie begins with five United States military robots in a training exercise against tanks and focusses upon one of the robots becoming ‘alive’...
Read more