Introduction

Australian organisations face an array of cybersecurity challenges that didn’t exist half a decade ago.

And yet the reliance on traditional security and legacy systems is largely the status quo – often falling short in addressing the nuanced interplay between human behaviour and technological vulnerabilities.

A New Approach

Enter human-centric security – a fundamental first step to enhance the cyber security resilience of Australian companies. This forms part of the Skills component in a broader cybersecurity strategy that should include the five S’s: Stability, Security, Skills, Sustainability and Sovereignty.

What is Human-Centric Security?

While human-centric security isn’t a solve-all solution in cyber resilience, it should play a fundamental role in the cybersecurity framework for all Aussie companies.

Human-centric security emphasises the integration of human behaviour, psychology, and interaction within cybersecurity frameworks. It recognises that individuals can be both the weakest link and the strongest defence – an approach that aligns security measures with human capabilities and limitations.

According to the Office of the Australian Information Commissioner’s (OAIC) Notifiable Data Breaches Report for January to June 2024, human error accounted for 30% of all reported data breaches during that period 1, a statistic that underscores the ongoing impact human error plays in cyber breaches.

Notable examples of the critical importance of human-centric security include the Latitude Financial Services Data Breach in March 2023 where approximately 14 million customers were impacted by a major data breach, compromising sensitive information including names, addresses and ID numbers initiated by the theft of a single employee’s security credentials 2. Whilst unauthorised access to the Western Sydney University systems occurred three times in 2024. The most recent in August saw a large amount of students’ sensitive information leaked—including names, addresses, tuition and enrolment data, and demographic data—after their Student Management System was accessed through a compromised IT account 3.

So how can companies strengthen their human-centric cybersecurity?

Strategies for Human-Centric Security

Implementing regular training programs focusing on the psychological aspects of cyber threats can significantly reduce human error. Tailored workshops and simulations help employees recognise and respond to phishing attempts and social engineering tactics. It’s critical to ensure these are interactive, learning-orientated and focus on opening strong lines of communication around reporting mistakes and cyber threats–this ensures employees feel empowered to speak up when things go wrong, rather than embarrassed or reprimanded.

Designing security systems with user experience in mind ensures that security protocols are intuitive and less likely to be bypassed. Simplifying authentication processes using solutions such as passwordless logins and single-sign on, and providing clear guidelines can enhance compliance and reduce friction.

Establishing channels for employees to report security concerns and provide feedback fosters a culture of vigilance. Regular surveys and open forums encourage proactive participation in the organisation’s security posture.

Strong leadership commitment to cybersecurity is crucial, from the top down. Allocating resources and setting clear policies demonstrate the organisation’s commitment to protecting data and systems, and embeds this into the very fibre of how you do things.

Seeking expert advice outside of the organisation helps uncover potential vulnerabilities and proactively creates safeguards against these. This is where having the right managed security partner on board is critical – helping advance the cyber maturity of the company beyond the internal resources available, and ensuring the latest solutions are utilised.

The future of Australian cybersecurity is human-centric

The Australian government’s recent introduction of new cybersecurity measures for critical sectors, including healthcare and finance, reflects a national commitment to safeguarding private data. These initiatives aim to replicate physical world protections in the digital space, emphasizing the need for a human-centric approach to security.

Integrating human-centric security strategies is vital for Australian organisations to remain cyber resilient now, and into the future. By focusing on human behaviour, user-centric design, continuous engagement, and strong governance, a robust defence against evolving cyber threats is possible.

Sources

1 Office of the Australian Information Commissioner’s (OAIC): www.oaic.gov.au/privacy/notifiable-data-breaches

2 Data breach cost Latitude $76 million | Information Age | ACS

3 University of Western Sydney: https://www.westernsydney.edu.au/news/public-notification