Exploring the Role of Service Personnels' Key Relationships in Military Cyber Resilience.

Abstract

When creating an organisation with a strong Cybersecurity Culture, a consideration of individuals’ awareness, attitudes and values are key to building a workforce that is resilient to cyber-attacks. Military organisations and the extended military community share characteristics with civilian populations but have additional unique attributes that influence individual attitudes and values. Whilst research into Cybersecurity Culture in military settings has focused on employee behaviours, there is limited existing literature that considers the role of the extended community, including military personnel’s close friends and relatives. This research aims to investigate the extent military personnel’s Key Relations contribute to military cyber resilience through their online behaviours. The thesis explores the perspective of military personnel, military friends and relatives, and subject matter experts in military cyber education and cyber incident reporting, to identify online behaviours Key Relations exhibit that could be a target for a military adversary. The thesis contributes to the literature on cyber security culture by applying theories of accountability and responsibility to understand these online behaviours. Building on this understanding, recommendations are put forward for how military organisations should engage with military key relations to encourage a positive cyber security culture, using cyber security training, education and awareness materials. The research applied a mixed methods approach and consisted of three separate, but inter-related studies. Phase 1 explored the perspective of military personnel across the front-line commands in an online mixed methods survey, that was analysed using frequency analysis and qualitative content analysis. Phase 2 also investigated the perspective of military personnel, alongside the perspective of Subject Matter Experts in cyber incident reporting and monitoring, and cyber education and awareness in Defence. The data collection for Phase 2 consisted of semi-structured interviews, which were analysed with a thematic analysis. Phase 3 differed slightly as it studied the perspective of military personnel’s close friends and relatives with an online mixed-methods survey. Similarly to Phase 1, the Phase 3 survey was analysed using frequency analysis and qualitative content analysis. Findings from across these three studies found that to reduce the cyber risk profile for military organisations, further engagement is needed with the extended military community about their cyber security behaviours and understanding. The results suggest that close relationships for military personnel are vast and include extended family and friends alongside immediate family, defined within the thesis as Key Relations. The research identifies online behaviours exhibited by these key relations, such as oversharing on social media can present a risk to military organisations, which heightens during certain military operations such as deployment or re-location. The thesis summarises by providing suggestions for how military organisations should engage with the extended military community to encourage awareness and application of secure online behaviours that protect Military Key Relations, military personnel and consequently military organisations.