(161a) Using Human Factors to Improve Cybersecurity

Human factors have long been recognized as a critical step for reducing the rates of incidents with the potential for negative impacts on personnel safety, the environment, equipment damage, and unplanned downtime. As cybersecurity incidents for industrial control systems become a growing concern it is critical to apply the same lens of human factors to improving cybersecurity hygiene. A 2018 study by the Ponemon Institute including over 150 companies from 13 industries found that roughly 80% of all insider cybersecurity incidents were accidental. With the advent of sophisticated control system specific malware variants, this means that accidentally plugging in an infected USB could not only lead to equipment downtime, but could lead to a potential process safety incident as well. This paper will evaluate how existing practices and techniques for human performance improvement can be effectively leveraged to improve cybersecurity readiness.