Why People, Not Just Technology, Are Often the Weakest Link in Security

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 12.9 Free with a free account

Why People, Not Just Technology, Are Often the Weakest Link in Security

Ethics in Technology · Chapter 12: Cyber Harassment, Cybercrime, and How Digital Criminals OperateSection 12.9 · lesson 75 of 11614 min · free with a free account

← How Businesses Become Targets: Financial Fraud, Data Theft, and Corporate EspionageNext lesson: The Many Ways Criminals Use Computers as Instruments to Commit Offenses →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Make safe actions realistic, support reporting, and evaluate what actually changes.

  • Explain how human actions interact with technical defenses and work conditions.
  • Classify slips, lapses, mistakes, and violations, then match suitable controls.
  • Distinguish negligent, compromised, and malicious insider risks.
  • Evaluate security culture and awareness training using meaningful measures.

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,704 words). Read along, or search it.

Cyber Harassment, Cybercrime, and How Digital Criminals Operate

People, Workflows, and Security

Technical defenses and human behavior interact throughout an organization’s security. A strong vault door still needs a safe process for the people trusted with access. Likewise, encryption and monitoring do not remove the need for usable workflows and verification. We will examine convenience, pressure, routine, fatigue, overconfidence, and helpfulness. Then we will distinguish slips, lapses, mistakes, and deliberate rule violations. Different causes call for different controls, rather than the same reminder for every incident. Insider risks also differ between unintentional harm, a compromised account, and malicious misuse. We will consider access limits and ethical monitoring across those cases. Security culture depends on everyday beliefs and leadership actions, as well as written policies. Training should support useful behavior and be evaluated with more than a completion count. The goal is realistic protection, prompt reporting, and fair accountability for both individual conduct and system conditions.

The Human Side

Ordinary Work Conditions Can Create Security Openings

Ordinary work conditions can create opportunities for error or deception. Convenience matters when the approved security process is slow, confusing, or difficult. Time pressure can lead staff to approve payments before completing an independent check. Habit can make repeated permission prompts feel automatic. Security fatigue occurs when repeated demands or unhelpful warnings make protective decisions harder. Overconfidence can discourage precautions and delay reporting after a problem. Trust and helpfulness can lead someone to accept an unusual request or access exception. These human qualities do not make every person foolish or inherently unsafe. Human involvement in breaches is common, but numerical estimates depend on the dataset and definition. Calling someone the weakest link does not identify the design, workload, or leadership problem. Technology remains valuable and can help prevent or limit human errors through better controls. Treat people, tools, procedures, and work conditions as connected parts of the security system.

Unsafe Human Actions

Match the Cause to the Control

A slip occurs when the plan is correct but the action unintentionally goes wrong. Selecting the wrong recipient from an autocomplete list is one example. A lapse is a forgotten step, such as failing to remove an old account. A mistake concerns a wrong plan based on a misunderstanding. Someone may sincerely believe a storage setting is private when it actually allows public access. A violation is a deliberate deviation from a known rule. It often reflects a well-meaning shortcut, such as sharing a password to meet a deadline. That intentional rule breach is different from necessarily intending harm. Improve interfaces and checks for slips, and reduce reliance on memory for lapses. Clarify procedures and understanding for mistakes; address incentives and safe alternatives for violations. The categories guide analysis, but causes can overlap, so examine the facts rather than label by outcome alone.

Examples and Controls

A Reminder Alone Does Not Fix Every Kind of Failure

Consider a salary spreadsheet sent to an outside contact with a similar name. A slip may call for external-recipient warnings or delay-send options. A testing folder left public after a planned reset illustrates a lapse. Private defaults and exposure detection can reduce that risk. If the person misunderstood the setting instead, the cause may be a mistake. A laptop forgotten on a train also illustrates a lapse. Disk encryption, screen lock, and supported remote response can help; remote wipe is not guaranteed. Knowingly reusing a password against a rule may be a violation. A password manager, supported multifactor authentication, and approved delegation can make safer work easier. Knowingly postponing required updates calls for workable maintenance and tracked exceptions. Selling drives without proper sanitization may reflect a mistaken procedure; documented disposal and verification help. Secure defaults reduce dependence on perfect memory, while the correct response still depends on the actual cause.

Insider Types

Intent and Account Compromise Are Separate Questions

Insiders include employees, contractors, temporary staff, and trusted suppliers with authorized access. Unintentional harm can arise from carelessness, a mistake, rushing, or disregard of a rule. The person does not necessarily intend the harmful result. A malicious insider deliberately misuses trusted access for harmful advantage. Possible motives include money, revenge, ideology, or pressure from outsiders. A compromised account is different: an outsider acts using the legitimate account’s identity and permissions. The account holder may be entirely unaware. Compromise is not evidence that the employee partly intended harm. Use safer tools, defaults, learning, and supportive reporting for unintentional risks. For deliberate misuse, emphasize limits, divided responsibilities, appropriate review, and timely access changes. Protect accounts and respond rapidly to compromise, while applying access limits across all categories. Frequency and cost depend on definitions and samples; an illustrative ranking cannot establish a universal pattern.

Shared Controls and Ethics

Limit Reach, Check Sensitive Actions, and Review Fairly

Least privilege gives a person or account only the access the current role requires. It can limit the reach of an accident, deliberate misuse, or account takeover. Separation of duties divides sensitive responsibilities between people. For example, one person requests a payment while another approves it. Reassess permissions when roles change, and remove access no longer needed when relationships end. Review unusual transfers, access, or repeated exceptions through authorized processes. Monitoring should be proportionate, with appropriate notice and applicable privacy protections. Unusual hours, frustration, or a large download alone do not prove malicious intent. Investigate context and evidence fairly, rather than treat every worker as a suspect. Access limits cannot guarantee a small incident when an account still holds essential privileges. Combine controls because collusion, stolen credentials, and other failures can defeat individual protections.

Security Culture

Visible Behavior Reflects Deeper Values and Assumptions

Security culture is the set of shared beliefs, habits, and unwritten expectations surrounding security. The source’s conceptual model shows three connected layers. Visible behavior includes locked screens and reported concerns. Stated values include policies, posters, and what leaders say matters. Shared assumptions concern what people believe actually determines success or consequences. The layers explain influences, rather than measured sizes or guaranteed causes. Suppose a policy requires verification, but a manager criticizes staff when that check delays a deadline. People may learn that speed really matters more than the written security rule. A poster alone cannot resolve that conflicting incentive. Leaders need to follow the process and provide enough time, resources, and usable tools. Culture becomes credible when actual actions and work conditions support the stated values.

Strong and Weak Signals

A Policy Can Be Identical While Everyday Behavior Differs

Two organizations can have identical policies and different everyday security behavior. In a weak reporting culture, people hide mistakes because they fear blame. A stronger culture supports prompt reports and uses them to improve protection. Leadership also sends signals by following the process or demanding exceptions. Security should involve appropriate responsibilities across roles, supported by specialists. Treating it only as an IT obstacle can leave business workflows unprotected. Staff need permission to verify odd requests, including requests apparently from senior managers. Questioning should be a normal protective step, rather than a personal challenge to authority. Confusing rules and difficult tools can encourage improvised workarounds. Clear procedures and usable tools make the approved path more realistic. Look at leadership responses, incentives, workload, and reporting behavior, rather than judge culture from the policy document alone.

Just Culture and a Scenario

Support Honest Reports While Applying Fair Accountability

A just culture learns from honest mistakes while fairly addressing reckless behavior or deliberate misconduct. It is neither automatic punishment nor immunity from accountability. Consider an assistant receiving an urgent apparent director request to change supplier bank details. The request seems odd, but a colleague was publicly criticized for questioning that director. The assistant processes it, and the payment is lost. The individual action matters, but the surrounding incentive also needs attention. Require independent bank-change verification that applies regardless of seniority or urgency. Leaders should visibly support staff who check, and provide enough time and usable tools. Offer a safe escalation and reporting route for concerns or suspected mistakes. A rule on paper is weakened when following it attracts punishment. Prompt reporting can help response, but it does not guarantee every incident will remain small.

Awareness Learning

Different Approaches Have Strengths and Limitations

Awareness learning can take several forms, with different strengths and limits. An annual session can establish a baseline and record participation. One session alone may not sustain safer behavior throughout changing work. Short, frequent refreshers reinforce relevant actions, but require varied content and appropriate timing. Role-based learning addresses specific tasks in finance, development, reception, leadership, and other roles. It also requires suitable design and updates. Safe practice exercises can build rehearsal and provide immediate supportive feedback. Public shaming or unfair punishment can undermine that benefit and damage trust. Gamified challenges may improve engagement, but speed or scores can distract from understanding. Knowledge can fade without reinforcement, often illustrated as a forgetting curve; the actual pattern varies. The knowing-doing gap occurs when someone knows the safe action but the approved option is inconvenient or unavailable. Pair relevant learning with usable tools, such as a supplied password manager or approved delegation process, and assess results.

Evaluate Effectiveness

Participation, Behavior, and Outcomes Answer Different Questions

Completion rate shows who finished the learning activity. It supports a participation goal, but does not alone establish knowledge or safer behavior. Reporting rate shows how often people bring concerns or mistakes to responders. A change can reflect culture, reporting tools, or a change in suspicious activity. Time to report shows how quickly a concern reaches the team. Faster notice can support response without guaranteeing a particular incident size or cost. Repeat-error rate helps identify recurring learning needs or process failures. Incident trends show outcomes, while threats, workload, detection, and reporting can also change. If ninety-eight percent completed training, that is useful participation evidence. To claim broader success, compare consistent measures, relevant job behavior, and contextual outcomes over time. Use supportive feedback and proportionate assessment without publicly naming people as failures. A single wrong click cannot replace fair review of intent, conditions, learning needs, and applicable policy.

Review and Apply

Improve the System, Support People, and Check the Evidence

Use the review to connect human actions with system conditions and suitable controls. Three employee-action incidents do not prove that technical defenses are useless. Improve technology, safer design, culture, and learning together. Forgetting to reset a public folder is a lapse; defaults and exposure detection can help. Knowingly sharing a password against a rule is a violation. Provide a quick approved delegation path, clear expectations, and fair review. A negligent insider lacks harmful intent, while a malicious insider deliberately misuses access. Least privilege limits the reach of both, and also helps when an outsider takes over an account. Low reporting after public criticism suggests a conflict between stated values and actual leadership behavior. Support honest reports, while preserving fair accountability. Ninety-eight percent training completion does not alone prove effectiveness; examine behavior and contextual outcomes. Make safe work realistic and treat people as supported defenders, while checking the evidence for improvement.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Why People, Not Just Technology, Are Often the Weakest Link in Security

Why are people called the weakest link in cybersecurity?
People are called the weakest link because convenience, time pressure, habit, security fatigue, overconfidence, and helpfulness can lead to errors or successful deception. The label is misleading on its own, though, because it hides the design, workload, and leadership problems that make unsafe shortcuts likely. Security works best when people, tools, procedures, and work conditions are treated as one connected system, with technology helping to prevent or limit human error.
What is the difference between a slip, a lapse, a mistake, and a violation?
A slip is a correct plan carried out wrongly, such as picking the wrong autocomplete recipient. A lapse is a forgotten step, like leaving an old account active. A mistake is a wrong plan based on a misunderstanding, such as believing a public storage setting is private. A violation is a deliberate break from a known rule, often a well-meant shortcut. Each calls for a different fix, from better interfaces to clearer procedures to safer approved alternatives.
What is the difference between a negligent insider, a malicious insider, and a compromised account?
A negligent insider causes harm without intending it, through carelessness, rushing, or ignoring a rule. A malicious insider deliberately misuses trusted access for money, revenge, ideology, or outside pressure. A compromised account is controlled by an outsider using a real employee's identity, often without that person knowing. Least privilege and separation of duties limit damage in all three cases, while supportive reporting, firm access controls, and fast account response address each one specifically.
What is a just culture in cybersecurity?
A just culture is an approach that learns from honest mistakes while still fairly addressing reckless behavior or deliberate misconduct. It is neither automatic punishment nor immunity. If staff are criticized for questioning an odd request from a senior manager, they learn to skip checks, and fraud succeeds. Leaders support a just culture by following the process themselves, rewarding people who verify or report, and judging training by behavior and outcomes rather than completion rates alone.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →