About
What is Human-Centered Cybersecurity?
Human-centered cybersecurity is an approach that considers human needs, motivations, behaviors, abilities, and limitations when developing and implementing cybersecurity products, processes, policies, and services. Within an organizational context, human-centered cybersecurity is a multi-faceted concept that includes:
- Security culture - establishing organization-wide values, attitudes, and beliefs that contribute to better cybersecurity outcomes
- Human-system interactions – understanding and designing security systems that align with human psychology and workflows, minimize friction, reduce human errors, and make secure behavior as easy as possible
- Knowledge, awareness, and training - equipping employees with the understanding and education needed to guide their security decision-making, build strong security habits, and empower them to protect organizational assets
Program Goal
The Human-Centered Cybersecurity program within the NIST Human-Centered Technologies Group provides research evidence and guidance to policymakers, system engineers, organizational decision makers, and cybersecurity professionals so that they can make better decisions that consider the human element, thereby advancing cybersecurity adoption and empowering people to be active, informed partners in cybersecurity.
Ideally, this guidance should:
- Have a basis in real empirical data
- Create solutions that are secure in practice, not just in theory
- Take stakeholders' needs and behaviors into account
- Create an environment in which people feel empowered and engaged in cybersecurity
- Address the relationship between people, process, and technology factors
Ultimately, we want to make it easier for people to do the right thing in cybersecurity, harder to do the wrong thing, and easy to recover if the wrong thing happens.
Interdisciplinary Approach
Usability, human factors, and cybersecurity are context-specific and influenced by a number of factors, such as the nature of the user population, organizational mission, and the specifications of the organization’s systems and cybersecurity measures themselves. Therefore, human-centered cybersecurity research requires an interdisciplinary approach. To that end, our team consists of experts in multiple fields, including cybersecurity, computer science, human factors, human-computer interaction, cognitive science, and psychology.
