A PRODUCT LIFE CYCLE HUMAN-SYSTEM INTERRELATIONSHIP APPROACH FOR CYBERSECURITY

Cybersecurity is often approached from a technology and system-centric perspective. The strengths and limitations of humans, who are integral parts of the system, are not always considered. Humans are cited as weakest part of security and risk management, and human errors are the primary contributor to data breaches, cyber-attacks, and ransomware attacks. In this study, we propose a product life cycle human-system interrelationship approach to discover risks that involve humans for providing insights into human-machine interaction design, training, and behavior-based risk mitigations to eliminate cybersecurity risk. We focus on tracing humans and subsystems that directly and indirectly impact how the product operates. After that, we can analyze the human-system interaction assumptions to discover opportunities for improving cybersecurity from human factors engineering viewpoint. These may include preventing unintended or undesirable actions, understanding workarounds, identifying opportunities to perceive and comprehend cyber-attack, improving the training and process development, and enhancing the risk management and improvement process. We use nuclear power plant computer-based procedures as an example to discuss how to trace through a product’s life cycle, find indirectly interrelated systems, and discover risks. The findings facilitate researchers' and practitioners' understanding of how humans may serve as the bridge between air gapped systems and finding ways to mitigate the impacts. This approach can let developers find opportunities to provide decision support tools, simplify processes, and efficiently use workforces.