A cyber-risk framework for coordination of the prevention and preservation of behaviours

Simon Parkin*, Yi Ting Chua

*Corresponding author for this work

Research output: Contribution to journalArticleScientificpeer-review

164 Downloads (Pure)


Cybersecurity controls are deployed to manage risks posed by malicious behaviours or systems. What is not often considered or articulated is how cybersecurity controls may impact legitimate users (often those whose use of a managed system needs to be protected, and preserved). This oversight characterises the blunt' nature of many cybersecurity controls. Here we present a framework produced from consideration of concerns across methods from cybercrime opportunity reduction and behaviour change, and existing risk management guidelines. We illustrate the framework and its principles with a range of examples and potential applications, including management of suspicious emails in organizations, and social media controls. The framework describes a capacity to improve the precision of cybersecurity controls by examining shared determinants of negative and positive behaviours in a system. This identifies opportunities for risk owners to better protect legitimate users while simultaneously acting to prevent malicious activity in a managed system. We describe capabilities for a novel approach to managing sociotechnical cyber risk which can be integrated alongside elements of typical risk management processes. This includes consideration of user activities as a system asset to protect, and a consideration of how to engage with other stakeholders in the identification of behaviours to preserve in a system.
Original languageEnglish
Pages (from-to)327-356
Number of pages30
JournalJournal of Computer Security
Issue number3
Publication statusPublished - 2022


  • cyber risk
  • Risk management
  • sociotechnical security


Dive into the research topics of 'A cyber-risk framework for coordination of the prevention and preservation of behaviours'. Together they form a unique fingerprint.

Cite this