A Psychological Approach to Information Security: Some Ideas for Establishing Information Security Psychology

摘要

Information Systems are composed in four main portions, people, information, appliance and facilities. These four portions are called information assets. Information security protects information assets and keeps safe them from the view point of Confidentiality, Integrity and Availability (CIA). Recently, cyber-attacks to people in specific organizations are called advanced persistent threat (APT) or targeted attacks. APT attacks are attacks using psychological and behavioral science weakness of people, are not technical attacks. Kevin Mitnick, the most competent and the most famous attacker for people says "Security is not a technology problem. It is a human and management problems" in his book. By using the knowledge of psychology, behavioral science and criminology, the attackers attack people, and achieve the purposes. Targets of the attacks are not only the direct objects that are theft or destruction of information, but also the indirect objects that obtain the information necessary to achieve the goal. Sun Tzu, a Chinese military general, strategist and philosopher said "If you know your enemies and know yourself, you can win a hundred battles without a single loss". Attackers and victims are classified into people, appliance (hardware and software) and hybrid (people and appliance). The methods of attackers for each attack and cases of attacks are classified in this paper. Some organizations are beginning to use the elements of games and competitions to motivate employees, and customers. This is known as gamification which is the application of game elements and digital game design techniques to non-game problems, such as business and social impact challenges. Gamification is very useful for awareness training of information security, I believe. This paper attempts to classify and systematize attackers, victims and the methods of attacks, as by psychology, behavioral science, criminal psychology, and cognitive psychology I have proposed some ideas for education, training and awareness for information security using the findings of psychology and behavioral science.