Cardiff academic examines ‘human-centric’ cyber security

A Cardiff academic is leading a new Airbus Accelerator in a bid to better understand human cyber strengths, vulnerabilities, and methods of securely interacting with digital systems within organisations.

The Human-Centric Cyber Security Accelerator, based at the Airbus Cyber Innovation Hub in Newport, brings human factors psychology experts together with a range of partners, including Cardiff University and the UK’s National Cyber Security Centre (NCSC).

Under the technical leadership of Dr Phillip Morgan, School of Psychology, the venture combines a wealth of University expertise with Airbus’ own innovation teams, partners and commercial capability.

Historically it is suggested that humans can often be ‘the most vulnerable’ link in the cyber security chain. Phishing emails now represent, on average, one out of every 200 emails received by users1, and, globally, 990 million records were exposed due to human error last year2. However, the team behind the new Airbus Accelerator aim to demonstrate that humans can be a strong cyber defence for organisations, through effective interventions based on research tapping into, for example, individual differences, adaptive cognition, and human-computer interaction.

“The programme represents a ‘first of a kind’ research accelerator within a commercial organisation - a novel approach for the cyber security industry,” said Dr Morgan, who is on a three-year secondment to Airbus.

“This is an exciting opportunity for the University because it allows us to work within Airbus, with a workforce of over 135,000, and with a team of over 800 security specialists to shape and accelerate research programmes and projects in the critical area of human-centric cyber security.

“As well as funding my post as Technical Lead for the accelerator, Airbus have already invested in others from the School of Psychology at Cardiff University, including a Research Associate and two PhD students."

The partnership is supported by Airbus Endeavr Wales - a joint initiative between Airbus and the Welsh Government to drive and deliver ground-breaking innovation in Wales.

Dr Morgan added: “We are seeking to challenge the common cyber security industry perception that ‘people are always the weakest link’ and will offer crucial insights into human-centric approaches that work with and engage people with the outcome of improving cyber security effectiveness.”

Dr Morgan, who has conducted research in collaboration with multiple industry organisations over the past two decades describes his secondment as “a once in a lifetime opportunity to be embedded within Airbus - a world leading aerospace giant - conducting cutting edge research that has so much potential to have short- and longer- term positive impact on employee cyber security awareness, knowledge, understanding, and behaviours.”

The team will use a wide range of research techniques and conduct studies to develop human-centric tools, techniques and methods tailored towards human cyber strengths, including cognitive flexibility, self-awareness, and adaptability, to optimally protect employees against cyber-attack attempts.

Findings and initiatives will be tested and rolled out across Airbus through existing training and awareness schemes, and also shared with partners including affiliated universities, the NCSC and industry partners in an attempt to drive a step change in thinking for the cyber security community.

Cardiff University President and Vice-Chancellor, Professor Colin Riordan, said: “Cardiff University recently placed third in a UK-wide ranking of UK universities’ success in turning research into commercial success. "

The launch follows the opening of the Cyber Innovation Hub, located in the Airbus facility in Newport, Wales, in April 2019, and reflects the company’s commitment to delivering world-class cyber security across Airbus and adopting a multi-disciplinary approach.

The initial phase of the Human-Centric Cyber Security work has been fully funded and will run for three years in the first instance.
The Accelerator will offer placements for qualifying university students, as well as establishing collaboration opportunities with research teams and businesses, including start-ups.