Assessing the Insider: dis/engaged hero or armed villain

这项工作旨在通过了解参与，以及参与的障碍可能是什么，以及它们对网络安全行为意味着什么来探索人为因素。参与可能涉及旨在影响行为改变的沟通活动，但管理也可能涉及雇主和雇员之间的关系，以及承诺、信任、忠诚、心理契约和道德脱离的程度，这些可能在网络安全行为的发展(或缺失)中发挥作用。我们不能假设，给定适当的工具和知识，人们会仅仅因为被要求就参与并采取有益的网络安全行为。这项工作从心理学角度探索了隐藏的深度，以更好地理解人的因素及其与网络安全的关系，以及通过网络安全意识活动刺激长期行为改变的最有效方式。到目前为止，对提高意识运动的评估以社交媒体统计为中心，这在试图了解实际影响和行为变化时是没有帮助的。这项工作还深入研究了内部威胁，旨在开发预防性工具，使用有助于在早期阶段识别内部风险的衡量标准。这对所有组织都是有用的，特别是安全部门，他们更需要雇佣和留住将继续致力于保护国家及其基础设施的人才。通过这种方式，这项工作旨在开发方法，以促进和促进干预，帮助创造一个安全和繁荣的环境，面对持续的网络攻击和间谍威胁。

This work aims to explore human factors by understanding engagement, and what thebarriers to engagement might be, and what they mean for cybersecurity behaviour. Engagementcan involve communications campaigns which aim to influence behaviour change butengagement can also relate to the relationship between the employer and theemployee, and the degree of commitment, trust, loyalty, psychological contract andmoral disengagement that may be playing a part in the development (or absence) ofcybersecurity behaviour.We can't assume that given the appropriate tools and knowledge that people willengage and adopt conducive cybersecurity behaviour just because they are asked to.This work explores the hidden depths psychologically-speaking, to better understandhuman factors and how they relate to cybersecurity, and the most effective ways ofstimulating long-term behaviour change through cybersecurity awareness campaigns.So far, evaluation of awareness campaigns have centred around social media statistics,which is not helpful when trying to understand actual impact and behaviour change.This work also looks deeply into Insider Threat and aims to develop preventative toolswith the use of metrics that serve to identify insider risk at an early stage. This is usefulto all organisations, but particularly security services who have a graver need to hireand retain talent that will remain committed and morally engaged to protecting thenation and its infrastructure.In this way, this work aims to develop ways to advance and promote interventions thathelp to create a secure and thriving environment in the face of constant threat of cyberattackand espionage.