PhD student co-authors book on cyber dilemmas
The Danish book, Cyberdilemmaer - om mødet med virkeligheden, which has just been published, focuses on everyday situations where we must make decisions about IT security. One of the book’s authors is Raha Asadi, a PhD student at the IT University of Copenhagen, who hopes the book will help create a basis for dialogue between technical and non-technical colleagues.
Written 9 January, 2026 17:19 by Jari Kickbusch
“Imagine a company dealing with a ransomware attack. Hackers have encrypted the company’s vital data and are demanding a ransom to unlock it. What should the company do? Should they pay to regain access to their data and avoid further damage? Or should they refuse, standing firm on the principle that paying will only encourage hackers to target other businesses? Whatever they choose, there are consequences – either for their own survival or for the broader fight against cybercrime.” This is how the Danish book, Cyberdilemmaer - om mødet med virkeligheden (Cyber Dilemmas – Facing Reality), published in November 2025, begins.
In the book, academics and practitioners share their perspectives on various dilemmas related to the cybersecurity decisions many Danes face daily: Is security or usability more important? How should we deal with suppliers in our supply chain? Should we share our data or protect it? One of the authors, Raha Asadi, writes about the link between human behaviour and IT security.
“When we talk about IT security, the narrative is often that humans are the weakest link, and if you look long enough, you’ll almost always find a human element when something goes wrong. Perhaps an employee clicked on a malicious link, or maybe a developer made a coding error that opened vulnerabilities,” she explains.
Hunting the guilty person
In the book, Raha Asadi writes about the importance of recognising human factors in relation to cybersecurity because awareness, motivation, and the ability to identify and respond to security threats play a crucial role in developing secure behaviour. She explains that this recognition is needed because companies often focus on assigning blame when a security breach occurs – rather than on why the problem arose:
“When a mistake happens, companies often focus on who did it. Let’s find the guilty person! The circumstances that enabled the mistake to become secondary, which isn’t very constructive when it comes to solving the underlying issues. For example, I know of a case where an employee with a tight deadline decided to send a document from his work email to his private Gmail account. When this was discovered, the company introduced a new rule forbidding employees from sending work documents to their own email addresses. This didn’t solve the real problem, namely that some employees need to work from home in the evenings, and that there was no technical solution for that. The company could simply have provided a VPN”, says Raha Asadi, who hopes the book will appeal to a broader audience than the more technically heavy IT security books:
“Good IT security is much more than just a technical matter. It’s very much about the interaction between people and technology, and I think the book offers important and concrete examples that can be used by anyone who deals with IT security – which is basically all of us. In that way, the book is inclusive because it gives the IT department staff and everyone else a common ground for a discussion,” she concludes.
Read more about the book at
https://cyberdilemma.dk/ Jari Kickbusch, phone 7218 5304, email jark@itu.dk