| This thesis presents a multi-dimensional examination of the human and organizational factors that affect computer and information security (CIS) and explains how human and organizational factors contribute to CIS vulnerabilities, namely, the various pathways and mechanisms leading to a technical CIS vulnerability. Human factors in CIS, such as password memorability or usability of encryption methods, in addition to organizational factors in CIS, such as implementation and monitoring of security policies or procedures are analyzed.; Research was conducted using an "adversarial" approach. A red team, a group of security analysts who model hacker behavior in order breach CIS systems in a sanctioned environment, was used as a source of information. Data collection methods included interviews, focus groups, and review of red team reports.; Fourteen red team members in individual interviews reported 589 total comments on human and organizational factors consistent with the work system categories (Carayon and Smith, 2000; Smith and Carayon-Sainfort, 1989). The work system categories consist of: organization (372 comments), individual (124 comments), task (46 comments), technology (40 comments), and environment (7 comments).; Two focus groups of five red team members each constructed the various mechanisms and pathways of human and organizational factors related to CIS vulnerabilities: design, implementation, configuration (Howard and Longstaff, 1998; Howard and Meunier, 2002) and operational vulnerabilities. Both focus groups emphasized organizational factors, such as management commitment, resources, funding, and CIS policy.; This study created a work systems framework that characterizes the complex and multivarious nature of CIS systems. This framework serves as a novel contribution to the fields of human factors engineering and computer science, as it provides a systems approach to CIS that incorporates human and organizational factors. This contribution furthers the understanding and etiology of CIS system vulnerabilities, which will allow system defenders to build more secure computer and information systems to remediate CIS breaches and attacks. |
