Introduction

Security Engineers are at the front line of defense against cyber threats aimed at organizations. Their role exceeds the practice of technical skills, requiring an in-depth understanding of social science principles. This paper discusses how Security Engineers rely on social science research and principles, mainly delving into human factors, psychology, victim behavior, and phishing scams. It will also delve into how the role of Security Engineers has many implications for society, particularly on marginalized groups, and society in general.

Understanding the Human Factor and Psychology

One critical element of cybersecurity deals with the human factor. Security engineers thus do not deal only with machines; they also understand human behavior about security measures. In this light, understanding human psychology is very important, since it helps project and mitigate risky behaviors that might result in security breaches. For instance, if one understands why employees may ignore security protocols or fall for phishing emails, it will be easier to assist security engineers to implement better training programs and safety policies in such situations.

Dialectical Security, Developer Interactions and Victim Behavior

The dialectical security concept insists on the need for challenging dialogues between the developers and their peers throughout the development cycle. According to the interviews with industry experts, secure development is not some checkbox in the list; it involves ongoing constructive dialogue. It is through such interaction that Security Engineers can ensure that developers really internalize security principles and apply them well in their works. Another important course concept is victim behavior and how it interacts with cyber offending. In this regard, the security engineer shall study how victims act when a cyber incident takes place and how offenders exploit those actions to their advantage. For this reason, security engineers are at liberty to make use of social science research about victim behavior while designing strategies to mitigate an incident. For example, easy-to-use reporting mechanisms or support systems for victims could enhance incident response and recovery processes even more.

Phishing Scams and Social Engineering

Phishing scams are very common and can be traced back to the root of social engineering, which aims to fool people into giving out sensitive information. This, therefore, forms the core of the reason as to why Security Engineers have to engineer a competent defense since social engineering manipulates and exploits human psychology. According to a piece of recent research, there is a growing menace that merges social engineering with OSINT. OSINT means the act of collecting information from publicly available sources, in this case, from social media. This is what attackers normally leverage in order to tailor their phishing schemes. For instance, they might gather personal details from LinkedIn or Facebook for crafting plausible phishing emails. Equipped with knowledge of these techniques, Security Engineers will be able to implement effective email filtering and thorough security training so that there are few or no successful attacks against an organization’s targets, thereby increasing the posture of cybersecurity.

Application of Social Science Concepts in Daily Routines

The Security Engineers apply various social science concepts daily to enhance cyber security in their normal life. For example, determinism enables the engineers to understand that some security incidents are inevitable before coming up with proactive defense mechanisms. Objectivity also makes evidence-based practices be in use by the security engineers instead of mere assumptions. Skepticism also makes them continue to verify and question the mechanism of a working security solution. In addition, the CIA triangle (Confidentiality, Integrity, Availability) is the fundamental framework that sets a roadmap for its process of information system protection.

Impact on Marginalized Groups and Society

The work that Security Engineers do bears prime significance on marginalized groups and society at large. Cybersecurity solutions should be designed such that they are inclusive of different populations to prevent entrenched discrimination or denial of fundamental rights to various groups. For example, a study in a Dutch municipality established demographic factors, like age and years of service, as the major factors in the susceptibility to phishing, where older employees were more susceptible. The result is very informative, showing that different groups  have higher susceptibility and thus need tailored, effective training programs. Security engineers should apply such research—with its lessons learned, such as specialized training reducing the susceptibility of different demographic groups to phishing—when moving policies and trainings forward that are more equitable.

Conclusion

The role of a Security Engineer is deeply related to social science; it gives an understanding of human behavior and victim psychology that Security Engineers, with the help of social engineering, will sooner or later be able to design and implement security barriers with maximum effect. Their work protects the organization and makes sure the digital environment remains holistic, secure, and inclusive. The integration of social science research into cybersecurity practices can effectively mitigate the challenges presented by modern cyber threats and their impacts on society. This is further in line with the fact that with many OSINT tools and techniques being developed these days, Security Engineers should look out on increasing visibility to critical infrastructure. If Security Engineers recognize and account for potential abuse using open-source data, they can harden defense solutions and protect against emerging threats.

Reference

Weir, C., Rashid, A., & Noble, J. (2020). Challenging software developers: dialectic as a foundation for security assurance techniques. Journal of Cybersecurity, 6(1). https://doi.org/10.1093/cybsec/tyaa007

Schoenmakers, K., Greene, D., Stutterheim, S., Lin, H., & Palmer, M. J. (2023). The security mindset: characteristics, development, and consequences. Journal of Cybersecurity, 9(1). https://doi.org/10.1093/cybsec/tyad010 

Zhang, Y., Frank, R., Warkentin, N., & Zakimi, N. (2022). Accessible from the open web: a qualitative analysis of the available open-source information involving cyber security and critical infrastructure. Journal of Cybersecurity, 8(1). https://doi.org/10.1093/cybsec/tyac003

What is a Security Engineer? | Cyber Career Guide. (2024, May 20). CU Boulder Digital Skills Bootcamp. https://digitalskills.colorado.edu/cybersecurity/security-engineer/

Spithoven, R., & Drenth, A. (2024b). Who will take the bait? Using an embedded, experimental study to chart organization-specific phishing risk profiles and the effect of a voluntary microlearning among employees of a Dutch municipality. Journal of Cybersecurity, 10(1). https://doi.org/10.1093/cybsec/tyae010

OSINT and Social Engineering: The Dynamic Duo of Cyber Threats | Insights | Elliott Davis. (n.d.). https://www.elliottdavis.com/insights/osint-and-social-engineering-the-dynamic-duo-of-cyber-threats#:~:text=Cybercriminals%20can%20use%20OSINT%20to,transferring%20money%20or%20disclosing%20passwords.