A cyber-risk framework for coordination of the prevention and preservation of behaviours

A cyber-risk framework for coordination of the prevention and preservation of behaviours

Parkin, S.E. (TU Delft Organisation & Governance)
Chua, Yi Ting (University of South Alabama)

2022

Cybersecurity controls are deployed to manage risks posed by malicious behaviours or systems. What is not often considered or articulated is how cybersecurity controls may impact legitimate users (often those whose use of a managed system needs to be protected, and preserved). This oversight characterises the blunt' nature of many cybersecurity controls. Here we present a framework produced from consideration of concerns across methods from cybercrime opportunity reduction and behaviour change, and existing risk management guidelines. We illustrate the framework and its principles with a range of examples and potential applications, including management of suspicious emails in organizations, and social media controls. The framework describes a capacity to improve the precision of cybersecurity controls by examining shared determinants of negative and positive behaviours in a system. This identifies opportunities for risk owners to better protect legitimate users while simultaneously acting to prevent malicious activity in a managed system. We describe capabilities for a novel approach to managing sociotechnical cyber risk which can be integrated alongside elements of typical risk management processes. This includes consideration of user activities as a system asset to protect, and a consideration of how to engage with other stakeholders in the identification of behaviours to preserve in a system.

cyber risk
Risk management
sociotechnical security

http://resolver.tudelft.nl/uuid:04369cd2-d7be-4e12-a472-d24bf93a8789

https://doi.org/10.3233/JCS-210047

0926-227X

Journal of Computer Security, 30 (3), 327-356

Institutional Repository

journal article

© 2022 S.E. Parkin, Yi Ting Chua