Human Factors of Cyber Attacks: a Framework for Human-centered Research

Cyber security has been a growing focus within the human factors community. Over the last several years, human-centered cyber research has provided valuable insights into the cognitive and collaborative work within cyber operations, but has largely ignored how the genesis, intentions, methods and outcomes of cyber attacks impact human-related outcomes. Leveraging insights from other, more technologically focused communities, the goal of this paper is to synthesize previous work and to present a unified, descriptive framework of cyber attacks. Our framework, which consists of three dimensions, adversarial, methodological, and operational, aims to maintain the rich interactions between the components of a cyber attack while offering a further abstraction useful to future human factors research. We present each dimension in terms of the previous techno-centered research, demonstrate how the human factors community can contribute to our understanding, and ground each within the context of the StuxNet virus.