Data Management Plan for PhD "Cyber Discourse"

‘Humans are the Weakest Link’ is a common phrase when discussing the role of people in cybersecurity. This, and similar phrases aim to depict how human behaviour can expose vulnerabilities in secure systems. However, when this mindset is enacted by security professionals through language, practice, and policy-building it has the potential to be negatively interpreted by staff. If this underpinning conceptualisation of users is understood as inherently true it may create a vicious cycle between unintentionally unhelpful security communication and low staff cybersecurity performance.

This study seeks to explore the ways in which cybersecurity professionals may be exposed to this conceptualisation. It will focus on the production, recitation, and reinforcement of conceptualisations of humans in cyber-security at a global level by manually applying critical thematic analysis to publicly available sources of knowledge production. It will examine:

1. How influential sources of knowledge production construct and discuss non-technical staff?

2. What assumptions and expectations are conveyed when discussing the role of people?

3. Where conceptualisations and assumptions might act in a constructive manner that is likely to result in increased security behaviours among non-technical staff.

4. Where conceptualisations and assumptions may overlap with known damaging behaviours such as victim-blaming.