Students in\u00a0IT\/CYSE 200T\u00a0will explore how technology is related to cybersecurity from an interdisciplinary orientation.\u00a0 Attention is given to the way that technologically-driven cybersecurity issues are connected to cultural, political, legal, ethical, and business domains. The learning outcomes for this course are as follows:<\/p>\n
One example of workplace deviance related to cybersecurity is an employee misusing access that they are legitimately given for their job. An employee may have permission to access customer records, financial information, employee files, or other sensitive data because they need it to do their job. The problem starts when they use that access for something outside of its intended purpose, such as looking up information they do not need, sharing it with someone else, or taking information from the organization.<\/span><\/p>\n <\/p>\n Kiah Burrell<\/p>\n Cybersecurity is often associated with computers, software, and other technology, but <\/p>\n Kiah Joseph<\/p>\n Supervisory Control and Data Acquisition (SCADA) systems play an important role in Cybersecurity, Technology, and Society Students in\u00a0IT\/CYSE 200T\u00a0will explore how technology is related to cybersecurity from an interdisciplinary orientation.\u00a0 Attention is given to the way that technologically-driven cybersecurity issues are connected to cultural, political, legal, ethical, and business domains. The learning outcomes for this course are as follows: Describe how cyber technology creates opportunities for criminal… <\/p>\n
\nI think workplace culture can play a big role in whether this happens. If employees regularly see people bending rules without consequences, cybersecurity policies can start to feel more like suggestions than actual requirements. Human behavior also matters because someone may convince themselves that what they are doing is harmless, especially if they already have legitimate access to the system. The criminal justice reading discussed how offenders can rationalize their behavior or deny responsibility for what they are doing, which could also apply to someone misusing technology in the workplace.<\/span><\/p>\n
\nThe consequences could be much bigger than the employee expects. Misusing access could expose private information, cause financial losses, damage the organization’s reputation, or create legal consequences. It could also affect customers or other employees whose personal information was accessed or shared.<\/span><\/p>\n
\nOne way organizations could reduce this risk is by using the principle of least privilege, meaning employees only receive access to the information and systems they actually need for their jobs. I also think organizations should monitor access and make expectations clear so employees understand that authorized access does not mean they are free to use information however they want. Technology creates more opportunities for employees to access information quickly, but organizations still have to consider how people may choose to use that access.<\/span><\/p>\nThe Human Factor in Cybersecurity<\/strong><\/h2>\n
\npeople can be just as important to an organization’s security. The human factor refers to the
\nways that people’s actions, decisions, habits, and reactions can either strengthen
\ncybersecurity or create vulnerabilities. Attackers take advantage of this through methods
\nsuch as phishing and social engineering, while everyday behaviors such as poor password
\npractices can also increase risk. Because people cannot simply be removed from
\ncybersecurity, organizations must combine technical protections with training, clear
\npolicies, communication, and a workplace culture that encourage employees to take
\nsecurity seriously.
\nThe Human Factor in Cybersecurity<\/strong>
\nThe human factor in cybersecurity is the role that people and their behavior play in protecting
\nor weakening information and systems. Cybersecurity is sometimes viewed mainly as a
\ntechnical problem, but the course textbook describes it as a complex socio-technical
\nchallenge that also involves human and organizational factors (Kirkpatrick, 2025). Even an
\norganization with strong technology can still experience a security incident if someone
\nclicks on a malicious link, shares sensitive information, uses poor passwords, or ignores
\nsecurity procedures.
\nHuman behavior creates a difficult cybersecurity problem because people do not always
\nmake decisions based only on what is most secure. Convenience, trust, stress, lack of
\nknowledge, and workplace expectations can influence what someone does. An employee
\nmay know not to open suspicious emails but react differently when a message appears to
\ncome from a supervisor and says something needs to be completed immediately. In
\nsituations like this, vulnerability is not necessarily a failure of the computer system. The
\nattacker is taking advantage of the person’s reactions.
\nThis is also why cybersecurity cannot rely only on technical controls. Technology can block
\nmany threats, but employees still make decisions while using that technology every day.
\nUnderstanding why people make those decisions can help organizations build security
\npractices that work in real situations instead of assuming that employees will always
\nrespond perfectly.
\nPhishing and Social Engineering<\/strong>
\nPhishing and social engineering are strong examples of attackers using human behavior as
\npart of an attack. The course textbook defines social engineering as the manipulation of
\nhuman behavior to obtain sensitive information. It describes phishing as using fraudulent
\ncommunication to trick victims into disclosing information such as passwords and other
\nconfidential information (Yalpi, 2025).
\nWhat makes these attacks especially dangerous is that the attacker does not always need
\nto defeat the organization’s technical security directly. Instead, the attacker does not always
\nneed to defeat the organization’s technical security directly. Instead, the attacker can try to
\nconvince authorized people to provide access to them. The textbook explains that social
\nengineering can exploit psychology, trust, or lack knowledge. Attackers may also create
\nurgency or fear so that the victim reacts quickly instead of taking time to question what is
\nhappening (Oesteraas, 2025).
\nFor example, an employee might receive an email that appears to be from management
\nstating that there is an urgent problem with the employee’s account. If the employee clicks
\nthe link and enters a password into a fake website, the attacker may obtain legitimate
\ncredentials. This could compromise confidentiality if the attacker gains access to private
\ncompany or customer information. The situation shows how a person’s normal tendency to
\ntrust authority or react quickly to an urgent request can become a cybersecurity vulnerability.
\nPasswords and Everyday Security Behavior<\/strong>
\nPassword practices are another example of the human factor. Passwords are meant to
\nprevent unauthorized access, but their effectiveness depends partly on how people use
\nthem. The textbook discusses several forms of password attacks and recommends
\npractices such as not sharing passwords, avoiding easily guessed passwords, avoiding
\ndefault passwords, and using controls such as account lockouts (Yalpi, 2025).
\nThe problem is that secure behavior is not always the easiest behavior. Someone managing
\nseveral accounts may be tempted to reuse the same password because remembering
\ndifferent passwords is inconvenient. An employee may also share credentials with a
\ncoworker because it seems faster than going through the correct access process. Those
\nchoices may save time in the moment, but they can increase the organization’s exposure if
\ncredentials are stolen or misused.
\nOrganizations can reduce this risk by using technical controls such as multifactor
\nauthentication along with policies that clearly explain acceptable passwords and account
\npractices. However, policies are more useful when employees understand why they exist. If
\ncybersecurity rules are seen only as obstacles that make work harder, employees may be
\nmore likely to work around them.
\nReducing Human-Related Cybersecurity Risk<\/strong>
\nOrganizations cannot eliminate human behavior from cybersecurity, but they can create an
\nenvironment where secure decisions are easier to make. Training is one part of that process.
\nInstead of treating cybersecurity training as something employees complet3 once and forget,
\norganizations can provide continued education that includes realistic situations such as
\nsuspicious emails, credential requests, and social engineering attempts.
\nCommunication also matters. Employees should know how to report something suspicious
\nand should feel comfortable doing so, even if they think they may have made a mistake. A
\nworkplace culture that causes employees to hide mistakes could allow an incident to
\nbecome worse before the cybersecurity team knows about it. In comparison, encouraging
\nquick reporting gives the organization a better opportunity to respond.
\nOrganizations also have to consider psychological and social factors. Attackers understand
\nthat people respond to authority, fear, urgency, curiosity, and trust. Security policies should
\naccount for those behaviors instead of assuming employees will always recognize an attack.
\nCombining employee awareness with controls such as multifactor authentication and
\nappropriate access permissions creates multiple layers of protection. If one person makes
\na mistake, another security measure may still prevent that mistake from becoming a larger
\nincident.
\nConclusion<\/strong>
\nThe human factor shows why cybersecurity is not only about protecting computers and
\nnetworks. People are involved in almost every part of an organization’s technology, and their
\ndecisions can either strengthen security or create opportunities for attackers. Phishing and
\nsocial engineering demonstrate how attackers can manipulate trust and emotions, while
\npoor password practices show how ordinary decisions can create vulnerabilities without
\nmalicious intent. Organizations can reduce these risks through training, strong policies,
\ntechnical safeguards, communication, and a culture where cybersecurity is treated as
\neveryone’s responsibility. Technology will continue to change, but understanding how
\npeople interact with that technology will remain an important part of protecting
\norganizations and their information.
\nReferences<\/strong>
\nKirkpatrick, C. E. (2025). The interdisciplinary nature of cybersecurity. In H. Aldabagh, C.
\nBowman, C. E. Kirkpatrick, I. Oesteraas, & V. L. D. Yalpi, Cybersecurity, technology &
\nsociety (1st ed.).
\nOesteraas, I. (2025). Cybersecurity and the criminal justice system. In H. Aldabagh, C. Bowman,
\nC. E. Kirkpatrick, I. Oesteraas, & V. L. D. Yalpi, Cybersecurity, technology & society (1st
\ned.).
\nYalpi, V. L. D. (2025). Common cybersecurity threats. In H. Aldabagh, C. Bowman, C. E.
\nKirkpatrick, I. Oesteraas, & V. L. D. Yalpi, Cybersecurity, technology & society (1st ed.).<\/p>\nSCADA Systems and Critical Infrastructure Security<\/h2>\n
\ncritical infrastructure because they allow organizations to monitor and control physical processes
\nacross systems such as water treatment, power generation, transportation, and manufacturing.
\nHowever, the same connectivity that makes these systems useful can also create cybersecurity
\nrisks. Unauthorized access, insecure network communications, and attacks against control
\nsystems could cause more than the loss of information because SCADA systems interact with
\nphysical equipment. Protecting these systems requires organizations to understand their
\nvulnerabilities, control access to their networks, monitor for threats, and have security measures
\nin place that allow critical operations to continue or recover after an incident.
\nSCADA Systems and Critical Infrastructure<\/strong>
\nSCADA stands for Supervisory Control and Data Acquisition and is a type of industrial
\ncontrol system used to monitor and coordinate physical processes. SCADA systems are used in
\nareas such as water and wastewater treatment, gas pipelines, wind farms, airports,
\nmanufacturing, refining, and power generation (SCADA Systems, n.d.). Instead of requiring
\nsomeone to physically monitor every piece of equipment, SCADA allows information to be
\ncollected from equipment and presented to operators so they can make decisions about the
\nsystem.
\nSeveral components work together to make this possible. Remote Terminal Units (RTUs)
\nand Programmable Logic Controllers (PLCs) collect information from physical equipment, while
\nthe supervisory system gathers the data. A Human Machine Interface (HMI) then allows an
\noperator to view information and control processes (SCADA Systems, n.d.). For example, an
\nHMI can show an operator whether a pump is running and how much fluid is moving through a
\npipe. The operator can then shut the pump off if necessary and see the change in flow in real
\ntime.
\nThis is what makes SCADA so important to critical infrastructure. These systems are not
\nsimply storing information. They can be connected to equipment that controls something
\nhappening in the physical world. Because of that connection, a failure or cyberattack can
\npotentially affect both the organization operating the system and the people who depend on the
\nservice.
\nCybersecurity Risks and Societal Impact<\/strong>
\nOne major vulnerability is unauthorized access to SCADA software or the devices
\nconnected to the network. The course reading identifies unauthorized access, malicious changes,
\nand malware infections as threats that can affect the control host. It also explains that some
\nSCADA environments have limited security protecting the network packets sent to devices. In
\nthose situations, someone who gains the ability to send packets to a SCADA device could
\npotentially control it (SCADA Systems, n.d.).
\nAnother concern is the increased connectivity of modern SCADA systems. Earlier
\nSCADA systems operated independently, but modern networked systems can communicate
\nusing Internet Protocols. The reading explains that this connectivity increases vulnerability even
\nthough it also allows modern security techniques to be applied (SCADA Systems, n.d.). This
\ncreates a difficult situation because organizations need connectivity for efficient operations, but
\nevery additional connection can create another possible way into the system if it is not properly
\nsecured.
\nA cyberattack against SCADA could also have consequences that go far beyond stolen
\ninformation. SCADA systems monitor and control physical processes involving water
\ndistribution, traffic lights, electricity transmission, gas transportation, and oil pipelines (SCADA
\nSystems, n.d.). If an attacker gained control of one of these systems, the result could be disrupted
\nservices, damaged equipment, financial losses, or even risks to public safety. This is one reason
\ncybersecurity in critical infrastructure is different from protecting a typical computer system.
\nLosing access to a file is serious, but losing control of equipment responsible for electricity or
\nclean water could affect an entire community.
\nImproving SCADA Security and Resilience<\/strong>
\nOrganizations need multiple layers of protection because there is not one security
\nmeasure that can eliminate every SCADA risk. The course reading discusses industrial firewalls
\nand virtual private networks as well as application whitelisting, which can prevent unauthorized
\nchanges to applications (SCADA Systems, n.d.). These protections can reduce opportunities for
\nattackers to reach critical devices or execute unauthorized software.
\nAdditional protections should also focus on separating critical systems from unnecessary
\nnetwork access. NIST recommends network segmentation and isolation as part of a defense-indepth approach for operational technology (Stouffer et al., 2023). Segmentation can restrict
\ncommunication between different parts of a network so that only authorized traffic is allowed
\nbetween them. This would be especially important in a SCADA environment because an attacker
\ngaining access to one part of an organization’s network should not automatically have access to
\nthe systems controlling physical equipment.
\nResilience is just as important as prevention. Critical systems cannot always be taken
\noffline easily, so organizations must consider reliability and safety when choosing cybersecurity
\nprotections. NIST recognizes that operational technology security has to account for
\nperformance, reliability, and safety requirements in addition to cybersecurity (Stouffer et al.,
\n2023). Organizations should therefore prepare not only to prevent attacks but also to maintain
\ncritical operations and recover when something does go wrong. The SCADA reading gives an
\nexample of this idea by describing redundant servers and backup hardware that can take over
\nwhen equipment fails (SCADA Systems, n.d.).
\nConclusion<\/strong>
\nSCADA systems make it possible for organizations to monitor and control many of the
\nphysical processes that society depends on every day. At the same time, connecting computers
\nand networks to physical infrastructure creates cybersecurity risks that can have real-world
\nconsequences. Unauthorized access, malware, and insecure network communication can threaten
\nthe confidentiality, integrity, and especially the availability of these systems. Protecting SCADA
\ntherefore requires more than one security solution. Organizations need access controls, network
\nprotections, monitoring, redundancy, and plans for maintaining or restoring operations after an
\nincident. As critical infrastructure becomes more connected, securing the systems behind it
\nbecomes just as important as protecting the physical infrastructure itself.
\nReferences<\/strong>
\nStouffer, K. A., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V. Y., Lightman, S., Hahn, A.,
\nSaravia, S., Sherule, A., & Thompson, M. (2023). Guide to operational technology (OT)
\nsecurity (NIST Special Publication 800-82 Rev. 3). National Institute of Standards and
\nTechnology. https:\/\/doi.org\/10.6028\/NIST.SP.800-82r3<\/p>\n","protected":false},"excerpt":{"rendered":"