Expert: Cybersecurity Starts With Human Behaviour

Marek Górka, DSc, Associate Professor

Faculty of Humanities

Koszalin University of Technology

Cybersecurity Education

Is Cybersecurity Merely a Technological Domain?

The debate on cybersecurity should not be conducted solely from a technological perspective. A comprehensive understanding of cyber threats requires the perspectives of lawyers, sociologists, and political scientists in order to explain the numerous interconnected processes taking place at both the local and global levels. Therefore, in order to reduce cyber risks to the lowest possible level, it is essential to recognize that the level of perceived cybersecurity is determined not only by technology, but also by human motivations and behaviour.

The digital revolution affects the functioning of most governments around the world, as well as the security of businesses and citizens. However, analysing these processes is challenging because of their highly dynamic and complex nature. Technologies and applications that were considered up to date yesterday may, as it often turns out, already be obsolete and inadequate to the needs of their users today. Science plays an important role in this context, as its task is to explain and understand the processes taking place. This perspective makes it possible to combine the analysis of risks in cyberspace with insights from the humanities and social sciences.

It is currently the summer holiday period, but young people rarely take a break from cyber technologies. What threats do they face?

The present day is often described as the digital age, while contemporary society is referred to as a network society. New technologies have therefore become an integral part of our everyday lives. The use of social media is also an everyday reality for children and young people. They are, without a doubt, a “digital generation.”

The potential offered by the Internet in various areas, such as communication and education, is enormous. However, we must not forget about the importance of using the Internet responsibly. This is primarily the responsibility of parents, although it is an obligation that is often neglected. Of course, many responsibilities also lie with schools, public administration, and security services.

Controlling the Internet or restricting or completely prohibiting the use of new technologies are merely partial measures that do not produce the expected results in terms of cybersecurity. Instead, preventive measures should be implemented to ensure an adequate level of perceived cybersecurity.

These measures should include, first, mandatory cybersecurity education for children, parents, and educators, focusing on the safe and responsible use of the Internet; second, greater information sharing between security services and educational and research institutions, as well as non-governmental organizations; and third, the rapid identification and removal of harmful content from cyberspace.

What are the responsibilities of schools and other institutions?

Public institutions operating in the fields of education and security should provide training programmes for teachers that address the Internet not only as a teaching and educational tool, but above all in terms of its responsible use, as well as how to respond to potential or actual cases of cyberaggression, cyberbullying, and how to implement preventive measures.

However, schools alone cannot meet this challenge without cooperation with both the academic community and law enforcement and security services. Research conducted in the West Pomeranian Voivodeship at the turn of 2016 and 2017 showed that many educational institutions either failed to recognize the problem or were reluctant to acknowledge it. The problem often became visible only when a tragedy occurred. One example is the emergence of online challenges in which young people set controversial tasks for one another, sometimes with tragic consequences.

Therefore, it can be argued that innovation in cybersecurity education will only become truly effective when greater emphasis is placed on anticipating and preventing potential tragedies rather than merely responding to events after they have already occurred.

Elements of cybersecurity should be incorporated into school curricula. Children need to understand what personal data privacy means and must also learn how to navigate cyberspace safely and responsibly. This educational effort should be complemented by specific training programmes aimed at adults as well.

It is often the case that, during cybersecurity prevention programmes conducted in schools, teachers themselves admit that they have fallen victim to online fraud. This demonstrates that vulnerability and naivety in cyberspace are not determined by gender, age, or level of education.

What role does science and academia play in all of this?

Cybersecurity education involves much more than simply learning how to use cyber resources. It involves acquiring knowledge and skills that are applicable across all sectors of the state and economy. Prevention and protection are fundamental values, but building cybersecurity requires a comprehensive approach based on the knowledge, cooperation, and commitments of multiple institutions.

Today, cybersecurity research and education must remain closely connected to the needs of society and the wider environment. This requires, among other things, sustained cooperation between educational institutions and the services responsible for national security. Such cooperation makes it possible to combine academic knowledge and research with practical experience in identifying, preventing, and responding to cyber threats.

What is the role of parents in ensuring cybersecurity?

It should also be noted that the measures currently in place and traditionally used, such as parental controls, content rating systems, and mechanisms for reporting illegal and harmful content, do not always produce the expected results. Certain types of content remain accessible without effective age restrictions, creating additional difficulties in addressing the constantly evolving threats present in cyberspace. It is questionable whether an immature or inexperienced person can adequately cope with all the risks encountered online. At the same time, there are no technological or software-based solutions capable of ensuring that content filtering and the identification of safe content in Internet search engines are fully effective.

The problem becomes even more serious when adults themselves fail to recognize the potential risks associated, for example, with publishing photographs online. It may, of course, be argued that such precautions are excessive. Nevertheless, it is worth emphasizing that if a person appearing in a photograph is tagged or otherwise identified in a third party's online space, the material may make it possible to identify that individual. Furthermore, once a photograph has been published online, it may circulate beyond the control of the person who originally posted it. There is no way of knowing whether such material might eventually fall into the hands of someone who intends to use it for unlawful or harmful purposes.

We must also remember that whenever we use the Internet, we leave traces of information about ourselves on forums, social media platforms, websites, and other online services. This situation is exploited both by commercial organizations, which use such information to profile consumers and personalize marketing offers, and by criminals seeking to identify and target particular individuals.

What are the sources of cyberaggression among young people?

Whenever controversial reports emerge concerning the behaviour of young people, questions frequently arise about social media and its influence on them. For a young person, exposure to hate speech can be a deeply traumatic experience, while educational institutions and security authorities often struggle to respond effectively to this phenomenon.

We can observe a gradual process of social acceptance of hateful behaviour on the Internet, which, in turn, may create a perception that such behaviour is effectively tolerated or goes unpunished. Victims of so-called “online hate” are often unable to effectively defend their reputation, which only contributes to the spread and normalization of the phenomenon.

Increasingly, the Internet also contains images and videos depicting extreme forms of violence. For their creators, such material may, arguably, serve as a form of gaining “recognition” or status in the public sphere. The dissemination and sharing of such images can become a kind of “trophy” through which individuals seek attention and social approval.

Scenes of aggression and extremely violent comments naturally raise questions about their origins. However, it is difficult to identify a single, specific cause. I would not want to analyse such behaviour exclusively in generational terms, because I do not believe that young people are responsible for the excesses and pathologies present in contemporary society. They operate within a reality created largely by adults.

Aggression, hatred, ridicule, and provocation are common phenomena in the everyday lives of adults as well—although adulthood does not necessarily equate with maturity. Social media, immersed in cyberspace, appears to open a door behind which, in the minds of many people, anything seems possible: one can assume almost any role and express virtually any opinion while believing that one is protected by anonymity.

It is therefore worth repeating as often as necessary: no one on the Internet is truly anonymous or beyond accountability, even if it sometimes appears otherwise. A victim of cyberbullying may not know who is threatening or attacking them, but law enforcement authorities can often identify and locate the perpetrator relatively quickly.

Marek Górka

Ph.D., Associate Professor at the Faculty of Humanities, Koszalin University of Technology, Poland. His research interests include security policy, cybersecurity, terrorism, intelligence, and counter-intelligence services, sociology of the Internet, electoral competition, and charismatic leadership. ORCID: 0000-0002-6964-1581, e-mail: [email protected].