IEEE Consumer Electronics Magazine - July/August 2022 - 80

Special Section on the IEEE International Symposium on Smart Electronic Systems
together as they are highly correlated, and virtually
inseparable. In terms of human-factors combining
these two dimensions will help portraying
a better picture of the attack initiators, who they
are, their skills, and their objectives. The CE community
has largely ignored that degrading the
human performance and decisionmaking can be a
primary goal of cyberattacks. In terms of human-
machine interactions, attacks may target system
interfaces causing disruptions, cause overloading
of operators, or even target situational awareness
of autonomous and IoT systems.6 In terms of
human-factors the increased cognitive workload,
time-pressure, affective changes, or even changed
mental models are some issues that need to be
considered.
The operational construct gives information
related to the target of the attack, along
with the attack vector, i.e., it is related to the
attack methodology. The chosen target has a
set of vulnerabilities, and each attack vector
has the capability to exploit different vulnerabilities.
To exploit the human-factors mainly
social engineering methods are employed,
however, using such techniques are not so
much popular.7 In relation to consumer IoT
devices, research has shown that pop-ups can
lead to increased user frustration and distraction
leading to errors, however knowledge and
operationalization of other attack vectors in
this aspect are limited.3
The Outcome construct refers to the overall
impact of the cyberattack. Currently, the impact
focuses heavily on the IoT systems, networking
infrastructure, or the information loss. Thus,
the losses that arise due to the impact from the
attacks are more technology oriented. Mostly
the impacts are measured qualitatively, when it
would have been better to assess the damages
on a quantitative level. From a human-aspect,
there is a gap in assessing the damages caused
due to the absence of any standardized measurement
tools, and other mediators. Measuring
the organizational cybersecurity readiness,
stress, workload, time-pressure, and effect of
the users can be useful metrics of human factors
that are seldom considered. As new types of
attacks emerge, the outcome can be operationalized
by technological, human, and socio-technical
variables.
80
THREE PILLARS OF HUMANCENTERED
CYBERSECURITY
In a consumer IoT context, cybersecurity solutions
can be broadly classified into two types.
The first type is common, which we call to be an
intrinsic approach (inward looking), where the
focus is to secure the vulnerabilities present in
the system. In fact, this is the most traditional
approach that is followed by current CE security
researchers. However, with the emergence of
the IoT paradigm where man-machine interactions
have reached to the next level, there could
be a second extrinsic approach (outward looking)
too that focuses on the threat actors, rather
than the system. Such extrinsic approach that
focuses on securing the vulnerabilities of the
humans is rare. In fact, these two approaches
should complement each other, with one focusing
to secure the system or organization and the
other one the human assets keeping in mind
their diversity in terms of their behavioral patterns,
psychological needs, cognitive biases, and
the manner of system interaction.8
While proposing the Linear Waterfall Model,
we had stressed on the importance of technical,
human, and socio-technical factors for operationalizing
the outcome. Such an approach is
possible if there is an integration of the traditional
cybersecurity principles with human-
computer interactions, accepting that human
and machines are destined to be close partners
for a variety of purposes. To consider this
" humans-in-the-loop, " we propose three essential
pillars of cybersecurity: user, system, and usability.
The concept is shown in Figure 3. The user
entity refers to the humans who interact with
the systems based on their purpose. The users
are the most complex entity as they have wide
variations in terms of their personality, culture,
demographics, behavior, and other psychological
factors. System entity represents the cybersecurity
system that is to be protected and is
concerned with the technological and nontechnological
measures that are employed to protect
against cyberattacks.9 Thus, this component is
system-centric and involves mechanisms such
as antivirus softwares, firewalls, different types
of authorization schemes, spam detection algorithms,
framing organizational policies, and
cybersecurity laws. The third important aspect,
IEEE Consumer Electronics Magazine
IEEE Consumer Electronics Magazine - July/August 2022

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - July/August 2022
