## 5 Towards a Human-Centric Approach to Security  
As we discussed earlier, human behaviour is the weakest link in cybersecurity; it is the employees of any organisation that should be involved and engaged within cybersecurity awareness and the development of mitigation approaches. Furthermore, it is important to accept that these individuals can be simultaneously the point of risk but also the point of success. [PERSON] (2020), suggests as a response, the development of an interaction of trust between the end user and the systems especially as the cybersecurity landscape is vast and continuously expanding with the proliferation of new smarter and interconnected devices and networks [45]. Furthermore, as a result of the global COVID-19 pandemic, new working trends have been introduced, where employees working flexibly use their own devices or are using work devices outside the office, resulting in blurred lines between personal and business limits, exacerbating the risky behaviours. As a result, any measures to mitigate the cyber risks need to go beyond the software updating and hardware maintenance to a more human-centric approach. Human-centric cyber security is still a new domain, which is an intangible concept and is challenging to define and to be understood, not only by the lay end user, but also by specialists in cyberspace. The reason is that it sits at the intersection of human behaviour, computing and security systems. [PERSON] et al. (2021) [46] defined human-centric cyber security as involving all aspects of cyber security, with a particular focus on the human involvement in the system and processes. They propose for the design, implementation and assessment of holistic human centric cyber security systems, three components of what they define as the 3U's, User, Usage and Usability, with each one of them including further subsections, as seen in Table 2.  
The authors suggest that the consideration of all these factors in the development of human-centric cybersecurity approaches can lead to automated functions and, at the same time, keep the end user engaged with the technology in an interaction of what they call 'collaborative intelligence'. Furthermore similar and relevant components are proposed to be considered when organisations wish to build a human-centred security culture by following specific steps, including the assessment of the organisation's information handling, the testing of the employee's awareness, the review of their interactions and the promotion of their critical thinking, the identification of threats, the reflection on past mistakes, the revision of the processes and training and the automation of security functions [47]. Regarding the future and the way forward, similarly to [PERSON] et al. (2021) [46], relevant literature suggests that further research and a paradigm shift is required to validate and test such approaches (i.e., 3 Us) addressing the need for a human-centric approach to cybersecurity. The paradigm shift suggests moving away from quantitative data collection of human behaviour to an observational approach, increasing the number of participants in projects with diverse samples rather than segmented groups and be 'Belief-Driven' \begin{table}
\begin{tabular}{l c l} \hline \hline
**Component** & \multicolumn{2}{c}{**Description**} \\ \hline  & \(\bullet\) & Demography and Culture \\ User & \(\bullet\) & Situational Awareness \\  & \(\bullet\) & Psychology and Behaviour \\  & \(\bullet\) & Cognitive Factors \\ \hline  & \(\bullet\) & Functional Measures \\ Usage & \(\bullet\) & Technical Measures \\  & \(\bullet\) & Legislation, Regulations and Policies \\ \hline Usability & \(\bullet\) & Experience Factors \\  & \(\bullet\) & Interaction Factors \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Design, implementation and assessment of holistic human-centric cyber security systems. where the cybersecurity researchers start considering end users perspectives rather than instructing them only what to do [48].