Rick van der Kleij

Professorship chair

Cyber resilient organizations

Research area: minimizing the imbalance between digital threats and resilience

Digital security is crucial for the safe and uninterrupted functioning of our society. The digital threat for organizations, however, remains as high as ever and changes continuously. In the Cyber Security Assessment Netherlands (CSAN) 2023, the National Coordinator for Counterterrorism and Security (NCTV) warns organizations to expect the unexpected and to adapt their security accordingly (NCTV, 2023).

Hence, all organizations and sectors are inherently attractive to malicious actors. Organizations seemingly uninteresting to attackers may still be appealing as a steppingstone to another primary target. Furthermore, the NCTV continuously warns that cyberattacks compromise the nervous system of society, asserting that cyber resilience in our society is still insufficient, with a notable discrepancy in the level of resilience observed among organizations.

Cyber resilience is a comprehensive term that encompasses various means and methods to counter cybercrime and enhance cybersecurity. It is defined as the ability to prepare for, absorb, recover from, and adapt to adverse effects. For organizations, the ultimate goal is to consistently deliver the intended functions or services.

Reducing the imbalance between digital threats and resilience remains a significant challenge. When organizations fall victim to cyber incidents, they are exposed to financial implications, data losses, and potential damage to their reputation. However, the positive news is that many of these incidents can be avoided or have a reduced impact when protective cyber resilience measures are implemented.

These measures can include simple actions like regularly updating software or implementing multi-factor authentication. Although these actions might seem simple, organizations are not always taking them despite their best intentions. Consequently, there is a gap between organizations that have cyber resilience in order and those that do not.

Organizations that lag behind need assistance in taking the right measures, such as implementing resilience management processes, enabling them to achieve an optimal level of cyber resilience. An optimal level of cyber resilience in this context refers to a level of cyber resilience appropriate for the risks to business operations and continuity of services, based on a sound risk assessment and balanced with the necessary investments to reach that level.

The challenge in closing the gap between the haves and haves-not is acute and requires a broader understanding of cyber resilience. There is little insight into relevant actors, dependencies, and mechanisms of cyber resilience and how they reverberate across cyber-resilience practices. It is also unclear how have-nots can be encouraged to act appropriately to reduce this gap.

Top publications

Van der Kleij, R., van ‘t Hoff—De Goede, S., van de Weijer, S., & Leukfeldt, R. (2023). Social engineering and the disclosure of personal identifiable information: Examining the relationship and moderating factors using a population-based survey experiment. Journal of Criminology, 0(0). https://doi.org/10.1177/26338076231162660

Van der Kleij, R. (2022). From Security-as-a-Hindrance Towards User-Centred Cybersecurity Design. In: Tareq Ahram and Waldemar Karwowski (eds) Human Factors in Cybersecurity. AHFE (2022) International Conference. AHFE Open Access, vol 53. AHFE International, USA. http://doi.org/10.54941/ahfe1002209

Van der Kleij, R., Schraagen, J.M., Cadet, B., & Young, H. (2022). Developing decision support for cybersecurity threat and incident managers. Computers & Security, Vol. 113. 102535. Doi: https://doi.org/10.1016/j.cose.2021.102535

Van der Kleij, R., Van ’t Hoff-De Goede, S., Van de Weijer, S., & Leukfeldt, R. (2021). How Safely Do We Behave Online? An Explanatory Study into the Cybersecurity Behaviors of Dutch Citizens. In: Zallio M., Raymundo Ibañez C., Hernandez J.H. (eds) Advances in Human Factors in Robots, Unmanned Systems and Cybersecurity. AHFE 2021. Lecture Notes in Networks and Systems, vol 268. Springer, Cham. https://doi.org/10.1007/978-3-030-79997-7_30

Van der Kleij, R., Wijn, R., & Hof, T. (2020). An application and empirical test of the Capability Opportunity Motivation-Behaviour model to data leakage prevention in financial organizations. Computers & Security, Vol. 97. 101938. https://doi.org/10.1016/j.cose.2020.101970

Van der Kleij, R., & Leukfeldt, R. (2019). Cyber Resilient Behavior: Integrating Human Behavioral Models and Resilience Engineering Capabilities into Cyber Security. In: Ahram T., Karwowski W. (eds) Advances in Human Factors in Cybersecurity. AHFE 2019. Advances in Intelligent Systems and Computing, vol 960. Springer, Cham. DOI: https://doi.org/10.1007/978-3-030-20488-4_2

Van der Kleij, R. Kleinhuis, G., & Young, H. (2017). Computer Security Incident Response Team Effectiveness: A Needs Assessment. Frontiers in Psychology. doi: 10.3389/fpsyg.2017.02179.