Cybersecurity, Technology, and Society

Students in IT/CYSE 200T will explore how technology is related to cybersecurity from an interdisciplinary orientation.  Attention is given to the way that technologically-driven cybersecurity issues are connected to cultural, political, legal, ethical, and business domains. The learning outcomes for this course are as follows:

1. Describe how cyber technology creates opportunities for criminal behavior,
2. Identify how cultural beliefs interact with technology to impact cybersecurity strategies,
3. Understand and describe how the components, mechanisms, and functions of cyber systems produce security concerns,
4. Discuss the impact that cyber technology has on individuals’ experiences with crime and victimization,
5. Understand and describe ethical dilemmas, both intended and unintended, that cybersecurity efforts, produce for individuals, nations, societies, and the environment,
6. Describe the costs and benefits of producing secure cyber technologies,
7. Understand and describe the global nature of cybersecurity and the way that cybersecurity efforts have produced and inhibited global changes,
8. Describe the role of cybersecurity in defining definitions of appropriate an inappropriate behavior,
9. Describe how cybersecurity produces ideas of progress and modernism.

Course Material

Opportunities for Workplace Deviance

One example of workplace deviance related to cybersecurity is an employee misusing access that they are legitimately given for their job. An employee may have permission to access customer records, financial information, employee files, or other sensitive data because they need it to do their job. The problem starts when they use that access for something outside of its intended purpose, such as looking up information they do not need, sharing it with someone else, or taking information from the organization.

I think workplace culture can play a big role in whether this happens. If employees regularly see people bending rules without consequences, cybersecurity policies can start to feel more like suggestions than actual requirements. Human behavior also matters because someone may convince themselves that what they are doing is harmless, especially if they already have legitimate access to the system. The criminal justice reading discussed how offenders can rationalize their behavior or deny responsibility for what they are doing, which could also apply to someone misusing technology in the workplace.

The consequences could be much bigger than the employee expects. Misusing access could expose private information, cause financial losses, damage the organization’s reputation, or create legal consequences. It could also affect customers or other employees whose personal information was accessed or shared.

One way organizations could reduce this risk is by using the principle of least privilege, meaning employees only receive access to the information and systems they actually need for their jobs. I also think organizations should monitor access and make expectations clear so employees understand that authorized access does not mean they are free to use information however they want. Technology creates more opportunities for employees to access information quickly, but organizations still have to consider how people may choose to use that access.

 

The Human Factor in Cybersecurity

Kiah Burrell

Cybersecurity is often associated with computers, software, and other technology, but
people can be just as important to an organization’s security. The human factor refers to the
ways that people’s actions, decisions, habits, and reactions can either strengthen
cybersecurity or create vulnerabilities. Attackers take advantage of this through methods
such as phishing and social engineering, while everyday behaviors such as poor password
practices can also increase risk. Because people cannot simply be removed from
cybersecurity, organizations must combine technical protections with training, clear
policies, communication, and a workplace culture that encourage employees to take
security seriously.
The Human Factor in Cybersecurity
The human factor in cybersecurity is the role that people and their behavior play in protecting
or weakening information and systems. Cybersecurity is sometimes viewed mainly as a
technical problem, but the course textbook describes it as a complex socio-technical
challenge that also involves human and organizational factors (Kirkpatrick, 2025). Even an
organization with strong technology can still experience a security incident if someone
clicks on a malicious link, shares sensitive information, uses poor passwords, or ignores
security procedures.
Human behavior creates a difficult cybersecurity problem because people do not always
make decisions based only on what is most secure. Convenience, trust, stress, lack of
knowledge, and workplace expectations can influence what someone does. An employee
may know not to open suspicious emails but react differently when a message appears to
come from a supervisor and says something needs to be completed immediately. In
situations like this, vulnerability is not necessarily a failure of the computer system. The
attacker is taking advantage of the person’s reactions.
This is also why cybersecurity cannot rely only on technical controls. Technology can block
many threats, but employees still make decisions while using that technology every day.
Understanding why people make those decisions can help organizations build security
practices that work in real situations instead of assuming that employees will always
respond perfectly.
Phishing and Social Engineering
Phishing and social engineering are strong examples of attackers using human behavior as
part of an attack. The course textbook defines social engineering as the manipulation of
human behavior to obtain sensitive information. It describes phishing as using fraudulent
communication to trick victims into disclosing information such as passwords and other
confidential information (Yalpi, 2025).
What makes these attacks especially dangerous is that the attacker does not always need
to defeat the organization’s technical security directly. Instead, the attacker does not always
need to defeat the organization’s technical security directly. Instead, the attacker can try to
convince authorized people to provide access to them. The textbook explains that social
engineering can exploit psychology, trust, or lack knowledge. Attackers may also create
urgency or fear so that the victim reacts quickly instead of taking time to question what is
happening (Oesteraas, 2025).
For example, an employee might receive an email that appears to be from management
stating that there is an urgent problem with the employee’s account. If the employee clicks
the link and enters a password into a fake website, the attacker may obtain legitimate
credentials. This could compromise confidentiality if the attacker gains access to private
company or customer information. The situation shows how a person’s normal tendency to
trust authority or react quickly to an urgent request can become a cybersecurity vulnerability.
Passwords and Everyday Security Behavior
Password practices are another example of the human factor. Passwords are meant to
prevent unauthorized access, but their effectiveness depends partly on how people use
them. The textbook discusses several forms of password attacks and recommends
practices such as not sharing passwords, avoiding easily guessed passwords, avoiding
default passwords, and using controls such as account lockouts (Yalpi, 2025).
The problem is that secure behavior is not always the easiest behavior. Someone managing
several accounts may be tempted to reuse the same password because remembering
different passwords is inconvenient. An employee may also share credentials with a
coworker because it seems faster than going through the correct access process. Those
choices may save time in the moment, but they can increase the organization’s exposure if
credentials are stolen or misused.
Organizations can reduce this risk by using technical controls such as multifactor
authentication along with policies that clearly explain acceptable passwords and account
practices. However, policies are more useful when employees understand why they exist. If
cybersecurity rules are seen only as obstacles that make work harder, employees may be
more likely to work around them.
Reducing Human-Related Cybersecurity Risk
Organizations cannot eliminate human behavior from cybersecurity, but they can create an
environment where secure decisions are easier to make. Training is one part of that process.
Instead of treating cybersecurity training as something employees complet3 once and forget,
organizations can provide continued education that includes realistic situations such as
suspicious emails, credential requests, and social engineering attempts.
Communication also matters. Employees should know how to report something suspicious
and should feel comfortable doing so, even if they think they may have made a mistake. A
workplace culture that causes employees to hide mistakes could allow an incident to
become worse before the cybersecurity team knows about it. In comparison, encouraging
quick reporting gives the organization a better opportunity to respond.
Organizations also have to consider psychological and social factors. Attackers understand
that people respond to authority, fear, urgency, curiosity, and trust. Security policies should
account for those behaviors instead of assuming employees will always recognize an attack.
Combining employee awareness with controls such as multifactor authentication and
appropriate access permissions creates multiple layers of protection. If one person makes
a mistake, another security measure may still prevent that mistake from becoming a larger
incident.
Conclusion
The human factor shows why cybersecurity is not only about protecting computers and
networks. People are involved in almost every part of an organization’s technology, and their
decisions can either strengthen security or create opportunities for attackers. Phishing and
social engineering demonstrate how attackers can manipulate trust and emotions, while
poor password practices show how ordinary decisions can create vulnerabilities without
malicious intent. Organizations can reduce these risks through training, strong policies,
technical safeguards, communication, and a culture where cybersecurity is treated as
everyone’s responsibility. Technology will continue to change, but understanding how
people interact with that technology will remain an important part of protecting
organizations and their information.
References
Kirkpatrick, C. E. (2025). The interdisciplinary nature of cybersecurity. In H. Aldabagh, C.
Bowman, C. E. Kirkpatrick, I. Oesteraas, & V. L. D. Yalpi, Cybersecurity, technology &
society (1st ed.).
Oesteraas, I. (2025). Cybersecurity and the criminal justice system. In H. Aldabagh, C. Bowman,
C. E. Kirkpatrick, I. Oesteraas, & V. L. D. Yalpi, Cybersecurity, technology & society (1st
ed.).
Yalpi, V. L. D. (2025). Common cybersecurity threats. In H. Aldabagh, C. Bowman, C. E.
Kirkpatrick, I. Oesteraas, & V. L. D. Yalpi, Cybersecurity, technology & society (1st ed.).

 

SCADA Systems and Critical Infrastructure Security

Kiah Joseph

Supervisory Control and Data Acquisition (SCADA) systems play an important role in
critical infrastructure because they allow organizations to monitor and control physical processes
across systems such as water treatment, power generation, transportation, and manufacturing.
However, the same connectivity that makes these systems useful can also create cybersecurity
risks. Unauthorized access, insecure network communications, and attacks against control
systems could cause more than the loss of information because SCADA systems interact with
physical equipment. Protecting these systems requires organizations to understand their
vulnerabilities, control access to their networks, monitor for threats, and have security measures
in place that allow critical operations to continue or recover after an incident.
SCADA Systems and Critical Infrastructure
SCADA stands for Supervisory Control and Data Acquisition and is a type of industrial
control system used to monitor and coordinate physical processes. SCADA systems are used in
areas such as water and wastewater treatment, gas pipelines, wind farms, airports,
manufacturing, refining, and power generation (SCADA Systems, n.d.). Instead of requiring
someone to physically monitor every piece of equipment, SCADA allows information to be
collected from equipment and presented to operators so they can make decisions about the
system.
Several components work together to make this possible. Remote Terminal Units (RTUs)
and Programmable Logic Controllers (PLCs) collect information from physical equipment, while
the supervisory system gathers the data. A Human Machine Interface (HMI) then allows an
operator to view information and control processes (SCADA Systems, n.d.). For example, an
HMI can show an operator whether a pump is running and how much fluid is moving through a
pipe. The operator can then shut the pump off if necessary and see the change in flow in real
time.
This is what makes SCADA so important to critical infrastructure. These systems are not
simply storing information. They can be connected to equipment that controls something
happening in the physical world. Because of that connection, a failure or cyberattack can
potentially affect both the organization operating the system and the people who depend on the
service.
Cybersecurity Risks and Societal Impact
One major vulnerability is unauthorized access to SCADA software or the devices
connected to the network. The course reading identifies unauthorized access, malicious changes,
and malware infections as threats that can affect the control host. It also explains that some
SCADA environments have limited security protecting the network packets sent to devices. In
those situations, someone who gains the ability to send packets to a SCADA device could
potentially control it (SCADA Systems, n.d.).
Another concern is the increased connectivity of modern SCADA systems. Earlier
SCADA systems operated independently, but modern networked systems can communicate
using Internet Protocols. The reading explains that this connectivity increases vulnerability even
though it also allows modern security techniques to be applied (SCADA Systems, n.d.). This
creates a difficult situation because organizations need connectivity for efficient operations, but
every additional connection can create another possible way into the system if it is not properly
secured.
A cyberattack against SCADA could also have consequences that go far beyond stolen
information. SCADA systems monitor and control physical processes involving water
distribution, traffic lights, electricity transmission, gas transportation, and oil pipelines (SCADA
Systems, n.d.). If an attacker gained control of one of these systems, the result could be disrupted
services, damaged equipment, financial losses, or even risks to public safety. This is one reason
cybersecurity in critical infrastructure is different from protecting a typical computer system.
Losing access to a file is serious, but losing control of equipment responsible for electricity or
clean water could affect an entire community.
Improving SCADA Security and Resilience
Organizations need multiple layers of protection because there is not one security
measure that can eliminate every SCADA risk. The course reading discusses industrial firewalls
and virtual private networks as well as application whitelisting, which can prevent unauthorized
changes to applications (SCADA Systems, n.d.). These protections can reduce opportunities for
attackers to reach critical devices or execute unauthorized software.
Additional protections should also focus on separating critical systems from unnecessary
network access. NIST recommends network segmentation and isolation as part of a defense-indepth approach for operational technology (Stouffer et al., 2023). Segmentation can restrict
communication between different parts of a network so that only authorized traffic is allowed
between them. This would be especially important in a SCADA environment because an attacker
gaining access to one part of an organization’s network should not automatically have access to
the systems controlling physical equipment.
Resilience is just as important as prevention. Critical systems cannot always be taken
offline easily, so organizations must consider reliability and safety when choosing cybersecurity
protections. NIST recognizes that operational technology security has to account for
performance, reliability, and safety requirements in addition to cybersecurity (Stouffer et al.,
2023). Organizations should therefore prepare not only to prevent attacks but also to maintain
critical operations and recover when something does go wrong. The SCADA reading gives an
example of this idea by describing redundant servers and backup hardware that can take over
when equipment fails (SCADA Systems, n.d.).
Conclusion
SCADA systems make it possible for organizations to monitor and control many of the
physical processes that society depends on every day. At the same time, connecting computers
and networks to physical infrastructure creates cybersecurity risks that can have real-world
consequences. Unauthorized access, malware, and insecure network communication can threaten
the confidentiality, integrity, and especially the availability of these systems. Protecting SCADA
therefore requires more than one security solution. Organizations need access controls, network
protections, monitoring, redundancy, and plans for maintaining or restoring operations after an
incident. As critical infrastructure becomes more connected, securing the systems behind it
becomes just as important as protecting the physical infrastructure itself.
References
Stouffer, K. A., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V. Y., Lightman, S., Hahn, A.,
Saravia, S., Sherule, A., & Thompson, M. (2023). Guide to operational technology (OT)
security (NIST Special Publication 800-82 Rev. 3). National Institute of Standards and
Technology. https://doi.org/10.6028/NIST.SP.800-82r3