Introductory description

Human-computer interaction (HCI) is concerned with designing interactions between human activities and the computational systems that support them, and with constructing interfaces to afford those interactions. Interaction between users and computational artefacts occurs at an interface that includes both software and hardware. Human behaviour should influence interface design and implementation of core functionality. For end-users, the interface is the system, meaning design in this domain must be interaction-focused and human-centred. It is therefore imperative that during the design phase of this human-computer interface cyber security component of human behaviour is addressed. One of the most significant challenges in the cyber domain is the transfer of meaning between the fully human agent, and the fully digital sub-system. Failure to correctly align human behaviour with computing sub-system behaviour has contributed to numerous, historic cyber security problems.

In addition, psychological traits and individual differences among computer system users can further explain vulnerabilities to cyber security attacks and crimes, as cognitive biases and impaired brain health can make individuals more susceptible to exploitation by cyber criminals. Cyber security procedures and policies are prevalent countermeasures for protecting organizations from cybercrimes and security incidents, however, without considering human behaviours, implementing these countermeasures will remain useless.

Consequently, this module places the person at the centre of the cyber domain by addressing the problematic of human factors in general and usable security in particular. As such, the focus is on trade-offs between usability and security on the one hand, and human psychology and human error on the other hand. Human vulnerabilities will be addressed in detail to build greater cyber resilience, and narrative around security awareness/training programmes and security culture will be also introduced for understanding broader, non-technical influences on security through minimising human related risks.

Module aims

Outline syllabus

This is an indicative module outline only to give an indication of the sort of topics that may be covered. Actual sessions held may differ.

The content of this module will be taught from a cyber security perspective, embracing cognitive science and human factors engineering, and will include:

• Foundations;
• User-centred design and testing;
• Usable security incl. trade-offs;
• Human factors and security.

Specifically, the module will cover:

• Cognitive hacking, incl. psychological levers used by cyber criminals;
• Human error and insider threat;
• Approaches and frameworks for changing behaviour;
• Approaches and frameworks for ethical decision making;
• Nudging and persuasion towards better cyber security;
• Human cognitive capabilities and limitations;
• Cyber security culture and hygiene.

As such the module is highly interdisciplinary, incorporating diverse concepts and approaches from many different disciplines, including computer science, psychology, ethics and cyber security.

Learning outcomes

By the end of the module, students should be able to:

• Select and critically evaluate the different factors that are pertinent to the security and usability of secure systems in their contexts of use.
• Apply techniques from interaction design to design and evaluate secure systems including security concerns for web application security.
• Analyse the relationship between user behaviour in digital space and cyber security consequences.
• Propose a theory-informed intervention appraising the role of human factors in delivering cyber security.

Indicative reading list

Rogers et al. (2007). Interaction Design: Beyond Human-Computer Interaction. Forth Edition. John Wiley and Sons.
Corradini (2020). Building a cybersecurity culture in organizations. How to Bridge the Gap Between People and Digital Technology (Vol. 284). Berlin/Heidelberg, Germany: Springer International Publishing.
Thaler and Sunstein (2009). Nudge: Improving decisions about health, wealth, and happiness. Penguin Books Ltd.

View reading list on Talis Aspire

Interdisciplinary

The module uses insights from Psychology and Sociology to understand usability issues, human behaviour, requirements gathering and innovation processes relevant for cyber security.

Subject specific skills

Knowledge of issues and problems in HCI.
Understanding of different disciplinary perspectives and ability to apply them to solve design and deployment challenges pertaining to cyber security.
Devising, planning, and executing requirements investigations and system evaluation, and presenting findings in a clear and effective manner.
Demonstrating awareness of current areas of research in human factors by locating and summarising examples of recent controversy and progress.

Transferable skills

Researching literature.
Communication, critical thinking, and problem solving.
Time management.
Teamwork.
Competence in multi-disciplinary research.
Presenting to peers a critical evaluation of own research work.
Defending their own work to an audience of peers.