The Missing Engineering Discipline in Cybersecurity: Human Factors Engineering

Abstract

Human factors remain the most critical vulnerability in cybersecurity, with many breaches involving human errors or social engineering. Integrating human factors engineering (HFE) into cybersecurity strategies is crucial for addressing these vulnerabilities and enhancing security resilience. Despite its importance, HFE is not widely recognized as an engineering discipline in cybersecurity, and many educational programs lack dedicated courses on human factors. Academic institutions, cybersecurity professionals, and federal agencies must advocate for incorporating HFE into cybersecurity curricula to prepare professionals with a comprehensive understanding of human behavior and its impact on security, ultimately leading to more robust and resilient cybersecurity practices.

Introduction

The human element remains the most critical vulnerability in cybersecurity. According to the Verizon Data Breach Investigative Report (2023), 74% of security breaches involve human participation through errors, misuse of privileges, stolen credentials, or social engineering. A joint report by Stanford University and Tessian emphasizes that human errors are primary contributors to cybersecurity incidents, exacerbated by distractions, burnout, stress, fatigue, understaffing, and increased targeting by threat actors. Neglecting human factors engineering (HFE) in cybersecurity strategies significantly heightens organizational risk (Neigel et al., 2020; Wiederhold, 2014).

An educational gap contributes to this issue, with many programs lacking explicit content on human vulnerabilities. Schultz (2005) highlights the shortage of research on human factors in information security, underscoring the need to understand how organizational culture influences employee behavior. Mancuso et al. (2014) stress the importance of human factors practitioners in addressing these challenges. Nobles (2018, 2022a) notes that the complexity of cybersecurity operations often exceeds the capabilities of typical professionals, and decision-makers are reluctant to involve human factors specialists.

Integrating HFE into cybersecurity is essential for managing human-induced errors and maintaining acceptable risk levels (Prabhu & Thompson, 2022). Recognizing HFE as an engineering discipline within cybersecurity can help mitigate human vulnerabilities and improve overall security resilience. The absence of human factors practitioners exacerbates stress, burnout, and security fatigue, undermining cybersecurity effectiveness. Leveraging HFE in cybersecurity practices is crucial for developing effective, practical solutions and enhancing security outcomes (Nobles, 2022a).

Background

Human factors, encompassing the interaction between end-users and systems, extend beyond technological aspects and draw from cognitive psychology and biomechanics to optimize human performance and minimize errors (Bergman, 2012). In cybersecurity, this discipline is crucial for designing systems, policies, and practices that reduce human vulnerability and organizational risk. Human errors and system malfunctions are responsible for 49% of data breaches (Ponemon Institute, 2019), with 90% of cyber breaches attributed to human errors (Chartered Institute of Ergonomics & Human Factors [CIEHF], 2022). Research indicates that 70% to 80% of cyber-attacks result from human-induced errors (Blau et al., 2017; Meshkat et al., 2020). Despite these statistics, cybersecurity education often lacks a focus on human factors. Beach (2014) found that only 2% of cybersecurity programs required a human factors course, and 62% did not offer it. This gap is exacerbated by inadequate support from stakeholders and the complexity of integrating human factors into cybersecurity (Jones et al., 2018; Nobles, 2019, 2022a, 2022b). While high-reliability industries have successfully integrated human factors to improve performance, cybersecurity has not fully adopted these practices, missing opportunities to enhance system design and decision-making (Nobles et al., 2022). Traditional security models often undervalue human factors, relying too heavily on technology and failing to address the psychological aspects of user behavior (Orshesky, 2003; Prabhu & Thompson, 2022). Addressing these gaps requires interdisciplinary research and a consolidated framework for human factors in cybersecurity (Jeong et al., 2019).

Discussion

The Human Factors Definition Conundrum

Human factors, as defined by the Human Factors and Ergonomics Society (n.d.), is a scientific discipline focused on optimizing human interactions with systems through theory, principles, data, and design techniques to enhance performance, behavior, and safety. Understanding human factors is crucial for effective cybersecurity solutions. Nobles (2022a) highlights the importance of integrating human factors into cybersecurity, though its interpretation varies. One definition focuses on negative behaviors impacting security (Nobles, 2022b), while another emphasizes enhancing performance through human factors engineering (Gosbee, 2002). The lack of understanding amongst cybersecurity professionals, coupled with the growing demand for experts, hinders this integration (Nobles, 2019). Academic discourse often focuses on negative behaviors leading to breaches (Jeong et al., 2019; Mohammad et al., 2022; Rahman et al., 2021), neglecting the benefits of human factors. Comprehensive definitions are needed to guide research and practice, facilitating the inclusion of human-centric methods and reducing risks (Nobles, 2022b). Recognizing human factors as a core discipline in cybersecurity aids in addressing and mitigating human-related vulnerabilities.

The Need for Human Factors Engineering in Cybersecurity

Engineering disciplines such as software engineering, information security engineering, network engineering, computer engineering, and cybersecurity engineering are critical for safeguarding an organization’s digital infrastructure. However, Human Factors Engineering (HFE) is not yet regarded as an engineering discipline in cybersecurity despite its broader scope beyond human-computer interaction (HCI) (Nobles, 2022a). The dynamic business environment, increasing reliance on advanced technologies, a shortage of cybersecurity professionals, heightened regulatory demands, and a relentless threat landscape exacerbate security fatigue (Nobles, 2019). Operational stress, fatigue, and burnout are extensively documented (Grier, 2015; Nobles, 2022a), yet these issues remain underemphasized among security executives. Over 80% of security incidents result from human errors, highlighting the need for research on human factors within cybersecurity environments (Nobles, 2018). Challenges include limited access to employees, overreliance on technology, and a knowledge gap in human factors (Dykstra & Paul, 2018). A survey revealed that 90% of Chief Information Security Officers (CISOs) are willing to accept a pay cut to reduce stress, with 88% reporting excessive stress impacting their mental health and work-life balance (Sheridan, 2020). Prolonged stress leads to burnout, affecting both technical and non-technical staff due to constant changes in cybersecurity policies and technology (Kävrestad et al., 2024; Nobles, 2018; 2022a). Understanding and integrating HFE in cybersecurity is crucial for reducing human-induced risks and enhancing overall security resilience.

Factors Impeding Cybersecurity Engineering in Cybersecurity

While the human factors discipline and profession have existed for over 80 years, gaining recognition and value in cybersecurity is too slow. A recent article highlights the variability in existing cybersecurity literature regarding the definition of human factors (Nobles & Burrell, 2024). The extensive variability in defining human factors is problematic and indicates that most do not recognize human factors as scientific, a discipline, and a profession (Nobles & Burrell, 2024). Other domains, such as aviation, healthcare, and industrial safety, leverage human factors to reduce friction around the human element and intentionally design systems to optimize human performance and behavior.

Another alarming issue is the lack of human factors courses taught in cybersecurity programs. Recent analysis determined that most National Centers of Academic Excellence accredited undergraduate and graduate programs do not teach human factors courses (Nobles, 2023). Although some colleges and universities offer courses in human-computer interaction (HCI), these curricula do not encompass the full breadth of human factors engineering. HCI is often mistakenly conflated with human factors engineering, yet they are distinct disciplines.

Most cybersecurity incidents result from systemic failures, often emphasized as human errors. Systemic failures in cybersecurity are undoubtedly human errors; however, without the inclusion of human factors engineering in cybersecurity as an engineering discipline, the problem could potentially worsen.

Industry perpetuates the lack of HFE in cybersecurity, as evident by the paucity of HFE professionals working in cybersecurity operations. As cybersecurity operations grow increasingly complex, the need for HFE is paramount to reducing the friction surrounding end-users in cybersecurity. Cyber threat actors increasingly target end-users’ weaknesses and limitations to gain access to sensitive systems and information. Traditional cybersecurity teams lack human factors expertise to implement practices to reduce friction and human vulnerabilities.

Human Factors Engineering as a Cybersecurity Discipline

Researchers have emphasized the need for mandated guidance in designing effective cybersecurity education and training curricula (Jones et al., 2018). Despite the critical importance of human factors practices, their integration in cybersecurity remains limited. Colleges and universities are pivotal in driving this change by fostering scholarly research, forming partnerships, and developing specialized curricula (Nobles et al., 2022). Although research on human factors in cybersecurity is increasing, including human factors practitioners in cyber operations is still rare. Leveraging Human Factors Engineering (HFE) could significantly enhance system design, optimize employee performance, reduce errors, and improve security decision-making. However, the cybersecurity industry often overlooks human factors, attributing breaches to human error without integrating HFE principles into frameworks and standards. Academia must advocate for and incorporate HFE into cybersecurity programs to prepare professionals with a comprehensive understanding of human behavior and its impact on security, ultimately leading to more robust and resilient cybersecurity practices (Jones et al., 2018; Nobles et al., 2022).

Conclusion

Colleges and universities serve as pivotal institutions for educating industry, academic, and government leaders on the critical importance of human factors engineering in cybersecurity (Nobles et al., 2022). Through rigorous scholarly research, strategic partnerships with government and industry, and the development of comprehensive human factors curricula, academic institutions have the potential to influence business decision-makers profoundly (Nobles et al., 2022). By emphasizing the integration of human factors engineering with the same rigor and commitment typically reserved for cybersecurity, software, and network engineering, academia can drive the adoption of human factors engineering in cybersecurity.