Macro & Micro cybersecurity: from cybersecurity culture to tailored cybersecurity

In the realm of cybersecurity and cybercrime, attackers carefully study their target to identify weak points and vulnerabilities to increase their chances to succeed. However, this is more complicated from the defensive perspective, especially when it comes to human beings whose fundamental rights must be respected. Thus, Cyber Threat Intelligence (CTI) focuses on learning more about attackers, not about our own employees; User Behaviour Analytics (UBA) are indeed used to learn more about our own employees, but may compromise privacy; and prevention and awareness campaigns are currently designed to cover a broad spectrum, not being tailored to specific needs or problems.

This research project aims to explore the relationship between cybersecurity, technology, and human factors both from a collective or macro perspective (i.e., cyberculture) and from a unique or micro perspective (i.e., each individual), duly respecting privacy (e.g., using differential privacy). Thus, the project will investigate about what the most influential factors in cybersecurity are and how cybersecurity can be measured from a collective perspective (e.g., cybersecurity culture of a given company), as well as from an individual perspective (e.g., gender, personality traits, etc.) to then develop training and technological solutions accordingly. The research will follow a data-driven approach, gathering available data as well as data collected through experiments specifically designed as part of the project, and will leverage the experience obtained in the RAYUELA project on the use of games as research tools and on the use of probabilistic machine learning (e.g., Bayesian networks and causal models) to improve the interpretability, explainability, and transparency of the data analysis.