Review: The Psychology of Information Security

Executive summary: This is a review of Leron Zinatullin’s The Psychology of Information Security arguing that security controls often fail when they ignore human factors; the book synthesizes organizational psychology, change management, and usability research and applies frameworks (COM-B, Fogg, nudge/boost, ISO 27001 scenarios, Kotter, SWOT, etc.) to design people-centred security policies. It is aimed at security professionals seeking behavioural approaches to improve compliance and policy effectiveness rather than technical control guidance.