Information and Cyber Security

Information and cyber security research examines how organizations protect their data, systems, and networks—not only through technical controls but through the policies, incentives, and behavioral norms that shape how people actually act. A central challenge is that breaches often originate from within: employees who circumvent security policies out of convenience, misjudge risk, or respond poorly to threat communications, making human behavior as consequential as software vulnerabilities. Researchers draw on deterrence theory, game theory, and protection motivation psychology to understand when and why individuals comply with security directives, and how factors like fear appeals, top management support, and organizational culture either reinforce or undermine those directives. Open questions include how to design policies that remain effective as attack methods evolve, and how to model the strategic interactions between defenders and adversaries—including malicious insiders—in ways that yield actionable guidance for real organizations.

Works

101,129

Total citations

538,162

Keywords

Information SecurityPolicy ComplianceSecurity AwarenessDeterrenceAttack GraphsRisk Management