The Missing Engineering Discipline in Cybersecurity: Human Factors Engineering

Background

Human factors, encompassing the interaction between end-users and systems, extend beyond technological aspects and draw from cognitive psychology and biomechanics to optimize human performance and minimize errors (Bergman, 2012). In cybersecurity, this discipline is crucial for designing systems, policies, and practices that reduce human vulnerability and organizational risk. Human errors and system malfunctions are responsible for 49% of data breaches (Ponemon Institute, 2019), with 90% of cyber breaches attributed to human errors (Chartered Institute of Ergonomics & Human Factors [CIEHF], 2022). Research indicates that 70% to 80% of cyber-attacks result from human-induced errors (Blau et al., 2017; Meshkat et al., 2020). Despite these statistics, cybersecurity education often lacks a focus on human factors. Beach (2014) found that only 2% of cybersecurity programs required a human factors course, and 62% did not offer it. This gap is exacerbated by inadequate support from stakeholders and the complexity of integrating human factors into cybersecurity (Jones et al., 2018; Nobles, 2019, 2022a, 2022b). While high-reliability industries have successfully integrated human factors to improve performance, cybersecurity has not fully adopted these practices, missing opportunities to enhance system design and decision-making (Nobles et al., 2022). Traditional security models often undervalue human factors, relying too heavily on technology and failing to address the psychological aspects of user behavior (Orshesky, 2003; Prabhu & Thompson, 2022). Addressing these gaps requires interdisciplinary research and a consolidated framework for human factors in cybersecurity (Jeong et al., 2019).

The Human Factors Definition Conundrum

Human factors, as defined by the Human Factors and Ergonomics Society (n.d.), is a scientific discipline focused on optimizing human interactions with systems through theory, principles, data, and design techniques to enhance performance, behavior, and safety. Understanding human factors is crucial for effective cybersecurity solutions. Nobles (2022a) highlights the importance of integrating human factors into cybersecurity, though its interpretation varies. One definition focuses on negative behaviors impacting security (Nobles, 2022b), while another emphasizes enhancing performance through human factors engineering (Gosbee, 2002). The lack of understanding amongst cybersecurity professionals, coupled with the growing demand for experts, hinders this integration (Nobles, 2019). Academic discourse often focuses on negative behaviors leading to breaches (Jeong et al., 2019; Mohammad et al., 2022; Rahman et al., 2021), neglecting the benefits of human factors. Comprehensive definitions are needed to guide research and practice, facilitating the inclusion of human-centric methods and reducing risks (Nobles, 2022b). Recognizing human factors as a core discipline in cybersecurity aids in addressing and mitigating human-related vulnerabilities.

The Need for Human Factors Engineering in Cybersecurity

Engineering disciplines such as software engineering, information security engineering, network engineering, computer engineering, and cybersecurity engineering are critical for safeguarding an organization’s digital infrastructure. However, Human Factors Engineering (HFE) is not yet regarded as an engineering discipline in cybersecurity despite its broader scope beyond human-computer interaction (HCI) (Nobles, 2022a). The dynamic business environment, increasing reliance on advanced technologies, a shortage of cybersecurity professionals, heightened regulatory demands, and a relentless threat landscape exacerbate security fatigue (Nobles, 2019). Operational stress, fatigue, and burnout are extensively documented (Grier, 2015; Nobles, 2022a), yet these issues remain underemphasized among security executives. Over 80% of security incidents result from human errors, highlighting the need for research on human factors within cybersecurity environments (Nobles, 2018). Challenges include limited access to employees, overreliance on technology, and a knowledge gap in human factors (Dykstra & Paul, 2018). A survey revealed that 90% of Chief Information Security Officers (CISOs) are willing to accept a pay cut to reduce stress, with 88% reporting excessive stress impacting their mental health and work-life balance (Sheridan, 2020). Prolonged stress leads to burnout, affecting both technical and non-technical staff due to constant changes in cybersecurity policies and technology (Kävrestad et al., 2024; Nobles, 2018; 2022a). Understanding and integrating HFE in cybersecurity is crucial for reducing human-induced risks and enhancing overall security resilience.

Factors Impeding Cybersecurity Engineering in Cybersecurity

While the human factors discipline and profession have existed for over 80 years, gaining recognition and value in cybersecurity is too slow. A recent article highlights the variability in existing cybersecurity literature regarding the definition of human factors (Nobles & Burrell, 2024). The extensive variability in defining human factors is problematic and indicates that most do not recognize human factors as scientific, a discipline, and a profession (Nobles & Burrell, 2024). Other domains, such as aviation, healthcare, and industrial safety, leverage human factors to reduce friction around the human element and intentionally design systems to optimize human performance and behavior.

Another alarming issue is the lack of human factors courses taught in cybersecurity programs. Recent analysis determined that most National Centers of Academic Excellence accredited undergraduate and graduate programs do not teach human factors courses (Nobles, 2023). Although some colleges and universities offer courses in human-computer interaction (HCI), these curricula do not encompass the full breadth of human factors engineering. HCI is often mistakenly conflated with human factors engineering, yet they are distinct disciplines.

Most cybersecurity incidents result from systemic failures, often emphasized as human errors. Systemic failures in cybersecurity are undoubtedly human errors; however, without the inclusion of human factors engineering in cybersecurity as an engineering discipline, the problem could potentially worsen.

Industry perpetuates the lack of HFE in cybersecurity, as evident by the paucity of HFE professionals working in cybersecurity operations. As cybersecurity operations grow increasingly complex, the need for HFE is paramount to reducing the friction surrounding end-users in cybersecurity. Cyber threat actors increasingly target end-users’ weaknesses and limitations to gain access to sensitive systems and information. Traditional cybersecurity teams lack human factors expertise to implement practices to reduce friction and human vulnerabilities.

Human Factors Engineering as a Cybersecurity Discipline

Researchers have emphasized the need for mandated guidance in designing effective cybersecurity education and training curricula (Jones et al., 2018). Despite the critical importance of human factors practices, their integration in cybersecurity remains limited. Colleges and universities are pivotal in driving this change by fostering scholarly research, forming partnerships, and developing specialized curricula (Nobles et al., 2022). Although research on human factors in cybersecurity is increasing, including human factors practitioners in cyber operations is still rare. Leveraging Human Factors Engineering (HFE) could significantly enhance system design, optimize employee performance, reduce errors, and improve security decision-making. However, the cybersecurity industry often overlooks human factors, attributing breaches to human error without integrating HFE principles into frameworks and standards. Academia must advocate for and incorporate HFE into cybersecurity programs to prepare professionals with a comprehensive understanding of human behavior and its impact on security, ultimately leading to more robust and resilient cybersecurity practices (Jones et al., 2018; Nobles et al., 2022).