A new from the National Institute of Standards and Technology (NIST) found that a majority of the typical computer users experienced security fatigue that often leads users to risky computing behavior at work and in their personal lives.
“The finding that the general public is suffering from security fatigue is important because it has implications in the workplace and in people’s everyday life,” cognitive psychologist and co-author Brian Stanton said. “It is critical because so many people bank online, and since health care and other valuable information is being moved to the internet.”
“If people can’t use security, they are not going to, and then we and our nation won’t be secure,” Stanton said.
The study, published in IEEE’s IT Professional, draws on data from a qualitative study on computer users’ perception and beliefs about cybersecurity and online privacy. The subjects ranged in age from their 20s to their 60s, hailed from urban, suburban and rural areas, and held a variety of jobs.
The interviews focused on the subjects’ work and home computer use, specifically about online activity, including shopping and banking, computer security, security terminology, and security icons and tools.
“We weren’t even looking for fatigue in our interviews, but we got this overwhelming feeling of weariness throughout all of the data,” computer scientist and co-author Mary Theofanos said.
“Years ago, you had one password to keep up with at work,” she said. “Now people are being asked to remember 25 or 30. We haven’t really thought about cybersecurity expanding and what it has done to people.”
The multidisciplinary team learned that the majority of their average computer users felt overwhelmed and bombarded, and they got tired of being on constant alert, adopting safe behavior, and trying to understand the nuances of online security issues.
When asked to make more computer security decisions than they are able to manage, they experience decision fatigue, which leads to security fatigue.
Researchers found that the result of weariness leads to feelings of resignation and loss of control. These reactions can lead to avoiding decisions, choosing the easiest option among alternatives, making decisions influenced by immediate motivations, behaving impulsively, and failing to follow security rules.
Participants also wonder why they would be targeted in a cyberattack. The data showed that many interviewees did not feel important enough for anyone to want to take their information, nor did they know anyone who had ever been hacked.
Commenters also expressed the sentiment that safeguarding data is someone else’s responsibility, leaving computer security up to their bank, online store or someone with more experience.
Individuals also questioned how they could effectively protect their data when large organizations frequently fall victim to cyberattacks.
The data provided evidence for three ways to ease security fatigue and help users maintain secure online habits and behavior. They are:
- Limit the number of security decisions users need to make;
- Make it simple for users to choose the right security action; and
- Design for consistent decision making whenever possible.
To obtain a clearer picture of computer security behavior, the researchers will be interviewing additional computer users of varying levels of responsibility, including cybersecurity professionals; mid-level employees with responsibilities to protect personally identifiable information in fields such as health care, finance and education; and workers who use computers but for whom security is not their primary responsibility.
Stanton and Theofanos suggest it will take a multidisciplinary team of computer security experts, psychologists, sociologists and anthropologists working together to improve computer security issues, including behavior, to manage security fatigue.
