Full e-thesis links are provided below. If needed, theses can also be found in the University of Nottingham e-Theses Repository.
Abstract:
The exploitation of so-called insiders is increasingly recognised as a common vector for cyberattacks. Unintentional insider threat– inadvertent mistakes and errors that cause cyber incidents and breaches – can enable nefarious cyberattacks to become successful resulting in a range of potential harms at an individual and organisational level. Managing unintentional insider threat is a growing challenge for organisations and businesses. Emerging work in this area has considered the phenomenon from various perspectives including the technological, the psychological and the sociotechnical. However, there is a gap in terms of (a) investigating unintentional insider threat specifically (rather than being centred on intentional or malicious insider threat) and (b) a human centric approach whereby technologies and humans are considered equally in a sociotechnical context of cyber and physical spaces in which they coexist. In order to address this deficit, this thesis investigates unintentional insider threat to uncover factors that influence it by adopting a human-centric lens to address this challenge. A human factors theory-informed systems approach is used to evaluate and critically analyse related work. Through the application of Critical Decision Method and Theory of Planned Behaviour approaches in two linked studies, a framework is developed and validated through engagement with industry. It is suggested that unintentional insider threat is responsive to a range of factors that can be linked to the individual, the technique used in the attempted attack and, the wider work environment and culture. While attitudes towards human elements within organisational ecosystems are improving, subjective norms can be leveraged to foster the creation of innovative cybersecurity defences in the future. This thesis contributes a tool to enable organisations to reflect on the relevance of unintentional insider threat within their overall approach to cyber security, and provides contributions to human-centred theoretical and practical understanding of unintentional insider threat. Ultimately, it is argued that in i order build to meaningfully tackle this threat all actors must be leveraged to take advantage of the understanding developed in this work to enhance existing systems in which the human element is critical to keeping systems safe.
Faculty of Engineering
Supervisors: Sarah Sharples, Robert Houghton
Keywords: cyber security, insider threat, unintentional insider threat, human factors, risk and safety engineering, systems engineering, humans in systems, organisational cyber security
