The UK’s leading security agency is asking organizations to help reduce cyber risk by ensuring accessibility is built into cybersecurity policies, processes and technology.
Almost a quarter (22%) of working-age adults in the UK are disabled, with 4.9 million currently in the workforce, said Lee C of the NCSC’s Social Technology and Risk Group. Cited statistics.
“There are many reasons to work on accessibility, such as to meet legal requirements, to deliver better business outcomes, or to attract and retain a more diverse workforce,” he argued.
“Addressing accessibility also provides cybersecurity benefits by making systems easier to use and less likely for human error and circumvention. Conversely, not considering accessibility increases these risks. To do.”
For more information on obstacles in cybersecurity, see Cyber Diversity: A Focus on Neurodiversity and Physical Disability.
He gave some examples of how security can be inaccessible to some people. These include awareness campaigns that are not written in plain language. Complex interface and audio-only/visual-only warnings. Color schemes that may be inappropriate for people with color blindness.
Lee C argued that accessibility is often seen as “someone else’s responsibility” and that usability and security cannot coexist.
“This is surprising given the number of incidents that still claim ‘human error’ was a factor,” he added.
“Considering accessibility in security requirements means proactively considering ‘risks caused by human factors’ and stress-testing security against conditions that people find most difficult to use and conditions where human error occurs. It’s a great way to make sure you’re doing it, most likely.”
NCSC recommends that security leaders:
- Encourage further consultation and feedback in the security decision-making process
- Be open to different ways of achieving your security requirements. In other words, don’t compromise on the “what” and be flexible on the “how.”
- Treat accessibility and usability as an intrinsic part of your security requirements rather than separate add-ons, such as requiring vendors to provide accessibility statements for their products
