title: The Role of Human Factors/Ergonomics in the Science of Security: Decision Making and Action Selection in Cyberspace.
abstract: OBJECTIVE
  The overarching goal is to convey the concept of science of security and the contributions that a scientifically based, human factors approach can make to this interdisciplinary field.
  
  
  BACKGROUND
  Rather than a piecemeal approach to solving cybersecurity problems as they arise, the U.S. government is mounting a systematic effort to develop an approach grounded in science. Because humans play a central role in security measures, research on security-related decisions and actions grounded in principles of human information-processing and decision-making is crucial to this interdisciplinary effort.
  
  
  METHODS
  We describe the science of security and the role that human factors can play in it, and use two examples of research in cybersecurity--detection of phishing attacks and selection of mobile applications--to illustrate the contribution of a scientific, human factors approach.
  
  
  RESULTS
  In these research areas, we show that systematic information-processing analyses of the decisions that users make and the actions they take provide a basis for integrating the human component of security science.
  
  
  CONCLUSIONS
  Human factors specialists should utilize their foundation in the science of applied information processing and decision making to contribute to the science of cybersecurity.
authors.affiliation: Purdue University, West Lafayette, Indiana, USA proctor@psych.purdue.edu.
authors.forename: Robert W
authors.initials: RW
authors.lastname: Proctor
authors.affiliation: Purdue University, West Lafayette, Indiana, USA.
authors.forename: Jing
authors.initials: J
authors.lastname: Chen
mesh_terms: D016494:Computer Security; D003657:Decision Making; D034742:Electronic Mail; D006804:Ergonomics; D006801:Humans; D020407:Internet; D063731:Mobile Applications; D012637:Security Measures; D014481:United States
keywords: human information processing; information security; privacy; risk communication; risk perception