Cybersecurity as a Social Science
In CYSE 201S, the human-factor approaches to understanding cybersecurity threats is explored. This course addresses the social, political, legal, criminological, and economic dimensions of cybersecurity through a social science framework. Attention is given to the social factors that contribute to cyber incidents and the political and legal mechanisms that are developed to control the behaviors of those who create risks in cybersecurity incidents. The learning outcomes for this course are as follows:
- Compare how basic psychological, sociological, criminological, political, economic, and legal theories and models explain cybersecurity
- Identify the strengths and weaknesses of those theories in understanding the connections between human behaviors and cybersecurity
- Define key concepts including cybersecurity, cybercrime, cyber criminology, cyber law, digital forensics, human factors, cyber policy, cyber risk, cyber threats, and cyberwar.
- Identify how professionals in various cybersecurity careers apply these multidisciplinary concepts in their daily routines
- Describe how hypotheses and research questions are formed in studies addressing cybersecurity through a social science lens
- Describe how data are collected, measured, and analyzed in studies addressing cybersecurity through a social science lens
- Identify how marginalized groups have confronted challenges and concerns related to cybersecurity as well as how these groups have contributed to our understanding of the topic.
- Explain how the application of social science theories, principles, and research strategies have contributed to our understanding of cybersecurity at the societal level.
Course Material
Module 1 Journal Entry:
Review the NICE Workforce Framework. Are there certain areas that you would want to focus your career on? Explain which areas would appeal the most to you and which would appeal the least.
The NICE Workforce Framework lists a number of career paths, but threat analysis and incident response are the ones that most intrigue me. These are the ones that appeal to me the most simply because they appear to be the most engaging. The intricacies of the human mind and the ability to identify and grasp the skills of potential cybercriminals made threat analysis something I found to be quite compelling. Understanding criminal conduct, including its motivations and timing, caught my attention. This area, in my opinion, is essential for catching cybercriminals, particularly those who engage in detrimental behavior toward the general populace. I’ve always been interested in criminal investigations, so I’d love to be a part of incident response. The least intriguing to me are customer service, technical support, and data administration. I’ve spent most of my working life in customer service roles so I’m not interested in pursuing them.
Module 2 Journal Entry:
Explain how the principles of science relate to cybersecurity.
The principles of science relate to cyber security as it is an applied science. People working in the discipline develop sophisticated computing systems that can be applied in the modern world using ideas, laws, and scientific knowledge. Relativism pertains to the way all objects are related. One illustration would be that modifications to one system would also affect the other. Objectivity alludes to how scientists research things in a value-free manner. There is minimal room for opinion in the field of science because it is filled with facts. Parsimony is the idea that scientists should maintain their explanations clear and concise. Empiricism describes how social scientists can only investigate conduct that is real to the five senses. It discusses how empirical analysis is required to produce scientific knowledge, which is derived from our experiences. When performing research, scientists must follow ethical guidelines, which is known as ethical neutrality. When researching, we must uphold our own human rights as well as everyone else’s, further demonstrating our willingness to investigate subjects empirically and accordingly. Determinism is defined as conduct that is caused, determined, or impacted by previous occurrences. Determinism can be utilized in the discipline of cybersecurity to address a number of issues, such as why someone would commit a crime or why a person would be exposed to one. Every concept has a unique link to cybersecurity, where each can be used in the same way and is essential to the online world.
Module 3 Journal Entry:
Visit PrivacyRights.org to see the types of publicly available information about data breaches. How might researchers use this information to study breaches?
Every year, there are hundreds, if not thousands, of data breaches. Many of them go unreported out of concern that the business could be viewed as unreliable, and some aren’t discovered for months after they happen. However the cause, it might be challenging to gather extensive information on data breaches. Researchers can more easily get this information from sources like PrivacyRights.org, which also provides a more categorizes version that enables researchers to concentrate their study on particular geographic areas and company kinds. The website also provides definitions of data breaches and relevant laws for each state or region. Researchers might focus their research by using the information the company has provided. Researchers can use this data to learn which businesses are most susceptible to data breaches, how long it takes for breaches to be discovered, what effects they have, and how these businesses were able to recover from them.
Module 4 Journal Entry:
Review Maslow’s Hierarchy of Needs and explain how each level relates to your experiences with technology. Give specific examples of how your digital experiences relate to each level of need.
Maslow’s hierarchy of needs indicates that every person on this entire globe has physiological, safety, love and belonging, esteem, and self-actualization needs. The layout is set up such that as we fulfill our more basic requirements, we can then fulfill our higher demands. Self-actualization, the goal at the top of the pyramid, is something that everyone aspires to but few people actually achieve. Technology has helped me meet my physiological needs by making it simple to get food online. A local restaurant already knows what I’m going to order and swiftly sends the food to me by pushing a button. I discovered ways to enhance my quality of life using technology by making things more simple to access. My safety needs are met with technology as it has provided a multitude of resources that have enhanced the security and protection of those who utilize them. Home security technology like Ring doorbells and cameras are a wonderful example. Furthermore, technology has evolved to the point that individuals who require assistance immediately can acquire it in a quick and convenient manner. The internet has provided a way for people to connect all around the world, satiating desires for belonging and affection. Today, a person in the US can get in touch with and become friends with a person in Australia. People no longer have to settle for the tiny bubble around them and may simply find the group of people they want to be a part of online. Esteem needs can be met with social media and posting photos of one’s self online. For instance, on Instagram, people post selfies and their day-to-day life. Friends, family, and complete strangers get to comment on these posts and most of the time these are words of endearment. The compliments one can receive from post to post provide an esteem boost and feelings of accomplishment. Maslow noted that only a small percentage of humans have attained self-actualization. I still don’t feel like I’ve accomplished what I set out to in life, and I realize it will take some time before I do. But having the technology available makes achieving this objective even more possible. Thanks to social media, I’ve seen hundreds of people progress from nothing to something. Taking Tiktok’s viral influencers as an example. The Tiktok influencer with the highest number of followers has achieved this feat without ever speaking a word in any of his videos. There must be sentiments of satisfaction and success there. People can achieve a point in their lives where they feel completely accomplished thanks to technology.
Module 5 Journal Entry:
Review the articles linked with each individual motive. Rank the motives from 1 to 7 as the motives that you think make the most sense (being 1) to the least sense (being 7). Explain why you rank each motive the way you rank it.
- Multiple Reasons: There are shades of gray among people. There isn’t a single compelling reason why someone would discover a justification to commit a crime. There are always multiple motives for someone to commit a crime, whether it be for monetary gain and retaliation or for monetary gain and boredom. There are many reasons why someone might commit a crime, which is why I included this as the top reason.
- For Money: I think that money is the main motivator for criminal behavior. In the digital world, data can be taken and held for ransom. People steal because they lack money or need money even in the real world.
- Political: Politics dominates our world. Whatever way we look at it, there is some sort of political agenda being pushed. Politics play a role in everything, including gas, housing, and money. This choice is high on my list because it would, regrettably, make sense if someone had committed the crime with politics in mind.
- Revenge: People will conduct crimes in order to get some sort of payback. In the cyber world, this may take the shape of doxing, spreading malware, and other behaviors.
- Entertainment: People can entertain themselves in a variety of ways, such as by watching television series, playing video games, or walking the dog. Then there are the sadistic individuals that enjoy seeing others suffer which is why it isn’t at the very bottom.
- Recognition: People are now starting to understand that committing crimes isn’t the best approach to making history. In fact, to avoid being caught, most crimes are conducted in an anonymous manner. It’s at the bottom since nearly everything online is anonymous, especially in this context.
- Boredom: There are countless ways for us to relieve our boredom, so why would someone claim boredom as a motive? This is similar to why I place entertainment so low. I am aware that it is absolutely possible for someone to have been so bored as to desire to harass others online, but there are hundreds, if not thousands, of alternative ways to pass the time.
Module 6 Journal Entry:
Can you spot three fake websites and compare them to three real websites, plus showcase what makes them fake?
- Pacific Northwest Tree Octopus http://zapatopi.net/treeoctopus
This hoax website is surely one of the best-looking misinformation websites, which greatly contributes to its credibility. Although the material on it appears to be convincing with believable photos, videos, and downloadable plans to build your own tree octopus house, it is false and intended to deceive you. Fact-checking a website to see if it contains any trustworthy sources is a wonderful approach to telling whether it is authentic.
- All About Explorers http://allaboutexplorers.com
Students would be immediately reminded of several instructive Webquest websites from years past after a brief look at this website. Fake websites will have a cluttered and complex user interface unless the website is purposefully intended to have an early 2000s vibe. They’ll have weird fonts with ridiculously annoying advertising bugged with possible malware.
- Dihydrogen Monoxide http://www.dhmo.org
This misinformation website provides loads of “scientific data” on the “dangers” of a common substance called Dihydrogen Monoxide. However, two hydrogens and one oxygen make up H2O, so it is just a fancy name for plain old water.
Module 8 Journal Entry:
After watching the video, write a journal entry about how you think the media influences our understanding of cybersecurity.
The video made it quite evident that popular media, including movies, television series, and other forms of entertainment, frequently romanticizes what it’s like to work as a cybersecurity professional. They give the impression that this role is far more exciting and action-packed than it actually is. Not to suggest that cybersecurity isn’t fun, but the media oversells it to the point where it looks completely fake. It makes it reasonable that people need to be entertained in order to watch these broadcasts. But putting entertainment before truth results in the effect of what people mistakenly think of being cybersecurity.
Module 9 Journal Entry:
Complete the Social Media Disorder scale. How did you score? What do you think about the items on the scale? Why do you think that different patterns are found across the world?
I received a score of 4 on the social media disorder scale, almost half, out of a possible 9. In all honesty, I agreed with this score. I frequently use social media to spend my free time, which causes me to purposefully forget about or avoid other tasks because of procrastination. I can believe all of these items happen on the scale because I’ve witnessed other people experience them including myself dozens of times. Due to social media and the internet, people frequently find it difficult to concentrate or refuse to perform anything that isn’t popular and trendy. The world has gradually transformed into a hive mentality where people blindly consume information from social media. Since various countries and people have different perspectives on social media and the internet, I think diverse patterns can be seen all around the world.
Module 10 Journal Entry:
As you watch the video, think about how the description of the cybersecurity analyst job relates to social behaviors. Write a paragraph describing social themes that arise in the presentation.
There are a few societal themes that are highlighted during the presentation after watching the video. Cybersecurity analysts must be highly adaptable in what they do in order to excel in the profession because each position may contain different tasks. The job title varies depending on location and might include a number of different jobs. The position is also highly sought after due to its significance inside a corporation. The location has a significant impact on these jobs’ wages, but denser areas typically offer better chances. Most likely since they have more individuals to safeguard and are more vulnerable to cyber threats.
Module 11 Journal Entry:
Read this article and write a summary reaction to the use of the policies in your journal. Focus primarily on the literature review and the discussion of the findings.
I’m now more open-minded and knowledgeable about the advantages of bug bounty hackers as a result of reading the article. The policy is crucial for large businesses that want to preserve their data and secure their networks. By examining the consequences of bug bounties both before and after they take place and how participating hackers are encouraged to keep up the practice, the research elaborates on the advantages of bug bounty policies. It analyzes how these rules impact businesses in the end. It was discovered that data records are the most economically valuable asset in the healthcare sector. Due to the higher expenses associated with a cyberattack on these organizations, they actively look for bug bounty breaches to strengthen network security.
Module 12 Journal Entry:
Andriy Slynchuk has described eleven things Internet users do that may be illegal. Review what the author says and write a paragraph describing the five most serious violations and why you think those offenses are serious.
IIlegal searches on the internet can have serious consequences depending on what is searched. Especially if what is being searched is something that is known for fact to be illegal. Faking one’s identity online in order to steal information, fool someone, or hurt another person is obviously against the law, and identity theft is a serious felony. The act of doxxing involves revealing someone else’s passwords, addresses, or photographs without their permission. Doxxing someone is dangerous since there are billions of people on the internet, and no one can anticipate the danger the victim is in given that their personal information is made public. Bullying and trolling should never be tolerated in any form, but because of the anonymity that the internet provides, online bullying is more prevalent. Bullying has an emotional impact on people and has the capacity to harm them mentally and physically. The most serious of the 11 violations is collecting information about children because it is horrendous. In any situation, children shouldn’t be exploited for personal “benefit” and subjected to harm.
Article 1 Review: Government Censorship of Information In China
In order to prevent any potential challenge to its control, the Chinese government has consistently maintained strong control across both print and electronic media. These strategies frequently involve the use of tight media controls such as monitoring systems and firewalls, the closure of publications or websites, and the imprisonment of dissident reporters, bloggers, and activists.
China has one of the most repressive media environments in the world, reliant on censorship to manage news, online, and social media content. The government coerces Chinese journalists and media outlets into self-censorship through the use of libel lawsuits, arrests, and other legal and illegal tactics. Many American websites, including Facebook, Instagram, and some Google services are blocked in China, but its citizens have discovered ways to get over the Great Firewall (Xu, 2017). The official media policy is discussed including tactics to control it utilizing firewalls and surveillance systems, closing publications or websites, and imprisoning journalists. Although the Chinese constitution guarantees freedom of the press and of speech, authorities can suppress news reports by arguing that they reveal state secrets and threaten the nation.
The freedom of expression and the press are granted by the Chinese constitution, but due to the ambiguous media laws, the government can censor press reports by arguing that they reveal private national security data and threaten the nation. In May 2010, the government adopted its first white paper on the internet, which concentrated on the idea of “internet sovereignty” and demanded that all users of the internet in China—including those who are foreign organizations or individuals—adhere to Chinese laws and regulations. Chinese internet enterprises are enforced to sign the “Public Pledge on Self-Regulation and Professional Ethics for China Internet Industry,” that have much tighter requirements than those outlined in the white paper (Xu, 2017).
The state’s endeavor to control and track users online is centered on The Great Firewall. It uses techniques including keyword filtration, bandwidth restriction, and website access banning. Deep Packet Inspection software is extensively utilized by the firewall to restrict access based on keyword detection (Xu, 2017). Authorities also use a variety of tactics, such as firing or demoting journalists, defamation claims, penalties, arrests, and coerced public confessions, to compel them to restrict their speech.
Reference
Xu, B., & Albert, E. (2017, February 17). Media censorship in China. Council on Foreign Relations. Retrieved November 21, 2022, from https://www.cfr.org/backgrounder/media-censorship-china
Article 2 Review: The Social Meaning and Impact of Cybersecurity Technical Systems
The impact of technology on the world’s current cybersecurity can be perceived as both a blessing and a curse. This constant expansion and evolution of hyperconnectivity have stimulated the spread of innovation all around. Although it has also built the rapidly-growing world of cybercrime where harassment and stalking are normalized. As technology develops in our society so do the dangers and threats of cybercrime. For this reason, what will happen if we continue down the path of connectivity? It is time we evaluate the future from the impacts of technology and in turn, update our cyber policy.
Technology has grown to be a constant element of our daily lives. It is intertwined in everything we do whether it’s the internet, cellphones, computers, or software, it’s advancing with no signs of slowing down. For this reason, cybercrime is also growing with these technological advancements. The internet and social media are where people interact with one another. These online forms of communication have allowed cyber harassment with bullying, stalking, threats, intimidation, and more to cause harm to others. Cyber harassment generally includes engaging in an act that annoys, offends, terrorizes, or threatens an individual via email, text messages, social media, and other means with the intent of harming that person. Cyberstalking is all of this but with the repeated pursuit of an individual using electronic devices. Repeated pursuits involve any unwanted online communications, and may be threatening, coercive, and intimidating.
Although there is legislation barring traditional harassment and stalking it does not specifically address these issues as an online occurrences. The digital harassment people have faced has resulted in drastic effects on their health even resulting in suicide. The local, state and federal governments should be trying to diminish these online threats to create a safer cyberspace. This could be done by adding new legislation that explicitly defines and prohibits cyber harassment and cyberstalking. There is also a need for clear legislation that describes the protections and penalties for any and all forms of cyber harassment. Legislators should be aiming to ban online stalking by specifying that persistent contact originating from using the internet would identify as harassment. Also, the legislators should be pushing for more funding to determine interventions like expanding the field of digital forensics. In doing this, it would provide greater analysis for a criminal investigation that refers to inquiries of cyber, computer, electronic, or other types of cybercrimes. With the addition of policies specifically defining cybercrime and explaining cyber offending and victimization, we can get closer to closing the gap and having real and more accurate justice.
The development of cyber-policy and infrastructure can be approached by carrying the best defense as a better offense. In today’s society, we do not have the ability to predict the future of the cyber world. Additionally, cybersecurity is a branch of technology where if you don’t prepare for the worst, then destruction will occur. For this reason, it is better to make sure that you are constantly prepared for the “what-ifs” in the world of hacking. This is why it’s best to want to have exemplary network security with many protections in the instance of a breach. As hackers are continuously computing new means to attack a network, one should want to make sure they are always one step ahead of them. Essentially, you want to have the most formidable firewall that a hacker has ever seen. After all, we humans only have the “short-arm” of predictive knowledge to rely on for what could happen in the networks of the digital age. We never know what new kinds of malware or cyberattacks are out there and are being created every day. That’s why preparing for the worst is the best countermeasure for whatever new scenario is presented by attackers. It’s best to make sure to always be one step ahead of them.
Between deciding to train individuals more than add in additional technology… I would stick to the addition of technology. This is because within the 9 areas of the psycho-technological matrix of cybersecurity threats the human psychology factor is over half of the area’s weak spots. It is noteworthy that humans are the weak link within the equation. This is why additional technology would help improve security that humans would otherwise “sabotage” due to social engineering. Hackers can create tricks like phishing to manipulate people into a hole of viruses. They do this in an attempt to get an individual to open an email attachment and click on a link to go to a website in order to set viruses in motion. These threats such as phishing may utilize digital tools but depend mainly on the social engineering of humans. For this reason, it is necessary to employ more technology rather than training because human error is inevitable. It can’t be helped and it’s bound to happen no matter the amount of training. More technology as a replacement would help mitigate the potential errors of humans. This way the risks and vulnerabilities can be minimized and the welfare of cybersecurity is overall protected. With additional technological advancements added to data security systems, the breaches within an organization would decrease. According to Jeff Capone with CSO, “A technology solution would automatically log all the data for reporting and auditing purposes, and also enables security orchestration tools to take immediate action based on any risks uncovered in the logs”. With automation, a virus can be detected and responded to immediately. This way the data quickly and automatically stays secured and protected. All in all, important data should be protected and encrypted with technology. Securing everything shields companies from both internal and external threats.
With the impact of technology on our civilization persisting to grow with no signs of stopping, so do the accessibility, authority, and communicative abilities of cyber criminals. Although society would not be as evolved, connected, or knowledgeable as it is today without these technologies, the weaknesses must always be addressed. Humans may have developed technology, but decades of investigation, innovation, and transformation of our way of life reveal that technology has seized control of all of us. There is no longer an option between existing with only a small association, having an online presence, or being under technological control. This lack of choice in the security of human applications is very complex and should be objectively assessed before pushing conclusions about humanity’s destiny. For this reason, society should consider modifications in our cybersecurity policies for the sake of protecting our cyber future.
References
Capone, J. (2018, May 25). The impact of human behavior on security. CSO Online. Retrieved April 24, 2022, from https://www.csoonline.com/article/3275930/the-impact-of-human-behavior-on-security.html
Hazelwood, S. D., & Koon-Magnin, S. (2013). Cyber Stalking and Cyber Harassment Legislation in the United States: A Qualitative Analysis. International Journal of Cyber Criminology. Retrieved April 25, 2022, from https://www.cybercrimejournal.com/hazelwoodkoonmagninijcc2013vol7issue2.pdf
Career Paper
The field of cybersecurity is broad, and there are numerous prospective career routes. This field is getting more and more well-known and sought-after as a result of the prevalence and significance of technology and information technology. As my interest in cybersecurity has grown, so has my desire to learn more about cybercrime. The prime objective of cybercrime investigators is to gather information from digital systems that can be used to prosecute criminal activity that takes place online or in cyberspace (Bowcut, 2022). They are frequently related to or directly connected with social sciences as a result.
Due to their responsibility to protect, cybercrime investigators have a daily connection with society. For instance, it is projected that 5 billion people worldwide own some type of mobile device and that 40% of the world’s population has access to technology (Darina, 2022). People are becoming more at ease with technology as a result, and they are discovering ways to exploit it. The targets of these cyber-threats may suffer financial loss, emotional stress, or physical harm. Society relies on cybercrime detectives to safeguard their data, take action when laws are violated or when people are in danger, and preserve their privacy. Cybercrime investigators have a similar symbiotic relationship with society as police officers or criminal investigators do in their efforts to bring down criminals. Cybercrime has reached a point where it’s no longer considering only technical solutions, but also human solutions (Amos et al., 2021).
The social science principles provide an ideal framework for understanding how cybercrime investigators respond to opportunities and circumstances. Cybercrime investigators might rely on a set of ideas from social science while conducting their investigations. Determinism enables individuals to maintain an open mind, relativism provides an idea of the consequence and response to the event, and determinism provides a pattern to follow. To make sure that what they’re doing is morally just and within the bounds of the law, cybercrime investigators must also exercise objectivity and ethical neutrality. They can also use parsimony to make it simpler for the population and cybercriminals to understand what went wrong. Cybercrime investigators can utilize the trends and more detailed data on criminal activities to better understand possible attacks and prospects to stop data from being compromised, according to social science studies.
There are a few other ideas that cybercrime investigators should take into account in addition to the social science principles when performing their duties or pursuing their careers. Victimization is the first idea that investigators of cybercrime must take into account. Recent assessments by Amos et al. (2021) have shown that human error accounts for between 60 to 90 percent of cyber accidents. Cybercrime detectives must take victim precipitation—the part the victim serves in the victim experience—into consideration, whether it is clicking a suspicious link, falling for a phishing scam, or accessing websites that shouldn’t be accessed. Although victims are never to blame for the crimes committed against them, cybercrime investigators can acquire a better picture of how the crime was carried out and who was responsible for doing so.
Another important concept is when human factors come into play. Among many other human elements, cybercrime investigators play a role in the investigation of crimes online. Cybercrime investigators can reduce human error and boost security by considering human factors. A cybercrime investigator can understand the motive by acquiring a sense of how a victim is positioned within the crime scene. Another idea that applies to cybercrime investigators is motive. By comprehending the purpose—whether it’s monetary, personal, or driven by boredom—a cybercrime investigator can start to piece together the offender responsible for the crime. Additionally, it contributes to the formation of a pattern that indicates the criminal may repeat the act or seek out the same victims.
Investigators of cybercrime perform their responsibilities to safeguard the public while also practicing cyberlaw, another important concept. Due to the complexity of cyberspace and the relative youth of both technology and cybercrime, there are few laws that specifically address it. Cybercriminals take advantage of the majority of laws’ ambiguity or a large number of gray areas. Intellectual property theft, intentional computer misuse, computer crimes that break certain laws, and computer-related crimes can all be considered forms of cybercrime. Furthermore, cybercrime detectives run the risk of breaching the law. They must be well-versed in local laws, including cyber laws, in order to conduct their investigations legally.
Discrimination in cyberspace is just as real as it is in the real world. Women, children, and people of color are marginalized groups. Due to their appearance and origins, numerous minority groups experience discrimination. Given how simple it is, cyberbullying of youth on social media is a problem that frequently goes unchecked. Minority and oppressed groups are more likely to be victims of cyberbullying, and they are frequently in more danger because there are little to no consequences. It’s a good thing that organizations and investigators of cybercrime are working to raise awareness of these issues. Additionally, because they are perceived as less important, members of marginalized groups are more susceptible to these crimes. Some hackers only target marginalized groups, and when they do, investigators for cybercrime report both cybercrimes and hate crimes. Another point of contention among minority groups and cybercrime investigators is that the profession is dominated by white men. Marginalized groups encounter greater challenges entering the field because they might not receive the proper aid and feel discouraged by the lack of representation.
References
Amos, Z., Coguic, D. L., Biseul, X. (2021, September 2). Social Science and cybersecurity: A key challenge for the future. InCyber. Retrieved November 27, 2022, from https://incyber.org/en/social-science-and-cybersecurity-a-key-challenge-for-the-future/
Anonymous. (n.d.). Cyber crime investigator – NICCS. Retrieved November 27, 2022, from
Bowcut, S. (2022, April 21). How to become a cybercrime investigator: A complete career
guide. Cybersecurity Guide. Retrieved November 29, 2022, from https://cybersecurityguide.org/careers/cyber-crime-investigator/
L., Darina. (2022, April 26). “How Fast Is Technology Growing Statistics” Best Tech Jobs Near You, Leftronic. Retrieved November 29, 2022, from https://leftronic.com/blog/how-fast-is-technology-growing-statistics/.