Human Factors in Information Assurance: A Review of Behavioral and Cultural Aspects

IA is a critical field in shielding information and information structures from unapproved use, divulging, interference or demolition. Technical controls applied in IA provide ways of preventing such acts and managing the risk but since aspects of operational environment and people’s attitudes significantly influence IA as an exercise, it represents a critical factor. This paper on IA focuses on behavior and culture that affect human decision making process, Cognitive Bias, and emotions, security behaviors and structures. It addresses the aspect of how a user will prefer convenience to security, get to provide information to an unauthorized user and or will not follow most organizational policies due to ignorance of the detected securities put in place. The final factors that the paper analyses as the factors influencing security within an organization include leadership engagement, training, security awareness and security culture. Lastly, information is presented about social engineering as an attack approach as well as measures to prevent them, such as, for example, using multi-factor authentication. The paper insists that strategy for IA cannot do without including technical solutions as well as a consideration of regard human behavior and practice as a method of unfolding a security culture across organizations. In addition, by applying the evaluation framework in this paper, organizations enhance on technical and human IA approach, and reduce risk elements, familiarize people with new hostile forces emerging to threaten secret information.