Human Factors within the Cybersecurity Domain

The basic idea of human factors is fairly straightforward. “Human error” is not a cause of trouble; rather, it&s;s an effect of trouble deeper inside your system. Human factors acknowledges that we are not the custodians of entirely safe systems. It refuses to believe that designers and developers and engineers can somehow make our systems entirely perfect, and that our only job is to then protect those systems from erratic, unreliable human operators—with procedures, warnings, labels, instructions, protocols, documentation, risk assessments, and more ( Clarke, 1999 ). Instead, even the earliest human factors work ( Fitts & Jones, 1947 ; Roscoe, 1997 ) showed how “human errors” are systematically connected to features of people&s;s tasks, tools, and their operational and organizational environment. What people do makes sense at the time, given their goals, their knowledge of the system, their mindset, and focus of attention—much of which gets driven by the setting in which we make these people work.