Cybersecurity threats are increasing in all aspects of society due to the integration of digital systems into modern-day life and a volatile geo-political landscape. Technical factors are an ongoing arms race; however, the threat surface from human and social factors is still present, often providing malicious actors the means to bypass complex technical security controls. Understanding human factors in light of technical evolution is essential to ensure security controls remain effective. This study presents the results of a survey on cybersecurity challenges within public and private sector organisations, including critical infrastructure providers, in Iceland (N = 130). From the management perspective, human factors were strongly noted as challenges and barriers to their organisations' security. These challenges include a lack of adequate training or awareness, hiring issues, poor cybersecurity culture, and time and/or financial resource constraints. Based on these findings, recommendations for mitigating threats from human factors are derived. These include: prioritising targeted over generic training to reduce employee fatigue, external government support for financially constrained organisations, and building a strong cybersecurity culture through constructive communication around shared responsibilities.

翻译：随着数字系统融入现代生活以及地缘政治格局的不稳定，社会各层面的网络安全威胁日益加剧。技术因素是一场持续的军备竞赛；然而，由人为和社会因素构成的威胁面依然存在，经常为恶意行为者提供绕过复杂技术安全控制的手段。在技术演进背景下理解人为因素对于确保安全控制措施持续有效至关重要。本研究呈现了一项针对冰岛公共和私营部门组织（包括关键基础设施提供者）网络安全挑战的调查结果（样本量N=130）。从管理层视角来看，人为因素被明确视为组织安全面临的挑战与障碍。这些挑战包括：缺乏充分的培训或安全意识、招聘困难、网络安全文化薄弱，以及时间和/或财政资源限制。基于这些发现，本研究提出了缓解人为因素威胁的建议，包括：优先采用针对性培训而非通用培训以减少员工疲劳感，为财政受限的组织提供政府外部支持，以及通过围绕共同责任进行建设性沟通来构建强大的网络安全文化。