Deriving Cyber Security Risks from Human and Organizational Factors – A Socio-technical Approach

Thomas Richard McEvoy, Stewart James Kowalski


Cyber security risks are socio-technical in nature. They result not just from technical vulnerabilities but also, more fundamentally, from the degradation of working practices over time – which move an organization across the boundary of secure practice to a place where attacks will not only succeed, but also have a significantly greater impact on the organization. Yet current risk analysis and management methodologies are not designed to detect these kinds of systemic risks. We present an approach, devised in the field, to deriving these risks – using a qualitative research methodology, akin to grounded theory, but based on preset coding descriptors. This allows organizational and individual behavior identified during interviews, observations or document research to be thematically analyzed, collated and mapped to potential risks, linked to poor working practices. The resulting risk factors can be linked together forming “risk narratives”, showing how the degradation of working practices in one part of the organization can contribute to undermining its ability to respond to cyber security threats in another part of the organization.


Human Factors; Socio-technical; Security Culture; Secure Behavior

Full Text:


DOI: 10.7250/csimq.2019-18.03


1. An evaluation of practitioners’ perceptions of a security risk assessment methodology in air traffic management projects
Karin Bernsmed, Guillaume Bour, Martin Lundgren, Erik Bergström
Journal of Air Transport Management  vol: 102  first page: 102223  year: 2022  
doi: 10.1016/j.jairtraman.2022.102223


  • There are currently no refbacks.

Copyright (c) 2019 Complex Systems Informatics and Modeling Quarterly