Human-driven and human-centred cybersecurity: policy-making implications

Abstract

PurposeThe purpose of this paper is to challenge the prevailing, stereotypical approach of the human aspect of cybersecurity, i.e. treating people as weakness or threat. Instead, several reflections are presented, pertaining to the ways of making cybersecurity human-centred.Design/methodology/approachThis paper bases on the authors’ own experiences, gathered whilst working in cybersecurity projects; the resulting comments and reflections have been enriched and backed up by the results of a targeted literature study.FindingsThe findings show that the way the human aspects of cybersecurity are understood is changing, and deviates from the stereotypical approach.Practical implicationsThis paper provides a number of practical recommendations for policymakers, as well as cybersecurity managers on how to make the cybersecurity more human-centred; it also inspires further research directions.Originality/valueThis paper presents a fresh, positive approach to humans in cybersecurity and opens the doors to further discourse about new paradigms in the field.