The Psychology of Information Security - Resolving conflicts between security compliance and human behaviour

Security programs cannot succeed without considering people

When implementing security polices, information security professionals are constantly faced with a conflict between the security team and the rest of the business. They must ensure that their organization is adequately addressing information security risks, whilst also communicating the value of security appropriately.

David Ferbrache, Technical Director at KPMG UK, says “No approach can ever succeed without considering people – and as a profession we need to look beyond our computers to understand the business, the culture of the organizations, and, most of all, how we can create a security environment which helps people feel free to actually do their job.”

By gaining an understanding of the psychology of information security, you can ensure your security program is a success.

Augusta University’s Cyber Institute adopted the book “The Psychology of Information Security” as part of our Master’s in Information Security Management program because we feel that the human factor plays an important role in securing and defending an organization…We want our students to not only understand technical and managerial aspects of security, but psychological aspects as well.

- Director of Graduate Studies in Information Security Management, Augusta University

Understand human behaviour and users’ motivations

Based on insights gained from academic research and interviews with security professionals from various sectors, this essential guide explains the importance of careful risk management and reveals how to align a security program with wider business objectives, providing methods and techniques to engage stakeholders and encourage buy-in.

The Psychology of Information Security redresses the balance by considering information security from both end users’ and security professionals’ perspectives, and helps you to understand how a security culture, that puts risk into context, promotes compliance.

Look inside this book >

Contents