Excerpts from the NCSC problem book

The National Cyber Security Centre (NCSC) Research Problem Book (2023) identifies several unresolved or partially resolved cybersecurity challenges that require further research and innovative solutions. This collection of problems is designed to guide researchers and practitioners in addressing some of the most pressing issues in the field of cybersecurity. Below is a detailed explanation of the key themes and problems highlighted in the NCSC Problem Book and how behavior change might contribute to solving them.

1. Unsolved and Ongoing Cybersecurity Problems

Known Solutions vs. Ongoing Challenges: Many cybersecurity challenges have well-established solutions, such as encryption for data protection or firewalls for network security. However, the Problem Book emphasizes that there are still areas where solutions are either incomplete or non-existent. These challenges are critical because they represent vulnerabilities that could be exploited by adversaries, or areas where the existing solutions are not scalable, user-friendly, or effective in real-world scenarios.
Examples of Unsolved Problems:

Secure System Design: Designing systems that are secure by default, without requiring significant user intervention, remains a challenge. This includes creating systems that are resilient to various attack vectors while being easy for users to operate.
Human Factors in Cybersecurity: Understanding and influencing user behavior to improve security practices is a persistent challenge. Despite awareness programs, users often engage in insecure behaviors due to convenience, lack of understanding, or because security measures are too burdensome.
Adaptive Security Measures: The dynamic nature of cyber threats means that security measures must be adaptable. However, creating systems that can adapt in real-time to new threats without compromising usability is an ongoing area of research.

2. Role of Behavior Change in Addressing Cybersecurity Problems

Enhancing User Engagement with Security Protocols: One of the key areas where behavior change can contribute is in improving user engagement with security protocols. For instance, if users can be encouraged to adopt secure practices, such as using strong passwords or enabling multi-factor authentication, many security vulnerabilities can be mitigated. Behavior change techniques, such as nudges or incentives, could be employed to make secure behaviors more habitual.
Reducing Insecure Behaviors: Understanding why users engage in insecure behaviors (e.g., clicking on phishing links, reusing passwords) is crucial. Behavior change strategies could involve redesigning systems to reduce the cognitive load on users, making secure behaviors the default option, or providing timely feedback to correct insecure actions.
Promoting Organizational Culture of Security: Beyond individual behavior, creating a culture of security within organizations can have a significant impact. This involves not only training and awareness programs but also embedding security into the organizational ethos, where secure behavior is valued and rewarded. Leadership buy-in is essential to drive this cultural shift, and behavior change strategies could be employed to align organizational incentives with security goals.

3. Application of Behavioral Insights to Cybersecurity Problems

Human-Centric Security Design: By incorporating behavioral insights into the design of security systems, developers can create solutions that are more aligned with how users naturally think and behave. For example, systems that minimize the number of decisions a user has to make regarding security, or that provide clear and simple instructions, are more likely to be adopted and used correctly.
Gamification and Engagement: Using gamification techniques to engage users in security practices could be another way to encourage behavior change. For instance, security awareness programs that incorporate game elements (e.g., earning points for completing security tasks) might increase user participation and retention of security practices.
Behavioral Interventions in Security Policies: Organizational policies often dictate security practices, but these policies need to be informed by an understanding of human behavior. Behavioral interventions, such as simplifying complex security policies or providing immediate consequences for insecure actions, can lead to better adherence to security protocols.

Book References for Further Reading:

“Nudge: Improving Decisions About Health, Wealth, and Happiness” by Richard H. Thaler and Cass R. Sunstein – This book introduces the concept of “nudging” people towards better decisions, which is highly relevant for designing cybersecurity interventions that guide users towards secure behaviors.
“The Psychology of Security” by Bruce Schneier – This book explores the psychological aspects of security, providing insights into why people make insecure choices and how understanding these tendencies can help in designing better security systems.
“Behavioral Economics and Its Applications” edited by Peter Diamond and Hannu Vartiainen – This book provides a comprehensive overview of behavioral economics, which is useful for understanding how behavior change can be applied to cybersecurity.
“The Human Factor in Cybersecurity: Empowering People to Stay Safe” by Jennifer J. Anderson – This book focuses on the role of human behavior in cybersecurity and offers strategies for empowering users to adopt secure practices.
“Inside the Nudge Unit: How Small Changes Can Make a Big Difference” by David Halpern – This book provides practical examples of how behavioral science can be applied to various domains, including cybersecurity, to effect meaningful change.

By considering these behavioral insights and applying them to the unsolved problems outlined in the NCSC Problem Book, researchers and practitioners can develop more effective and user-friendly cybersecurity solutions