The National Institute of Standards and Technology (NIST) recently published a new article that finds that most typical computer users experience security fatigue that leads users to engage in risky behavior when they are at work and at home.
In one interview, a participant said that when it comes to computer security “I don’t pay any attention to those things anymore…People get weary from being bombarded by ‘watch out for this or watch out for that.’”
The study confirms what we all feel daily. Instead of a handful of passwords, we are supposed to use a different password for every online application, and it’s nearly impossible to remember them all. Throughout the study, they “got this overwhelming feeling of weariness throughout all of the data.” They found that computer users feel overwhelmed, bombarded, and were exhausted from being on alert all of the time, trying to adopt safe behavior and understanding the complexities of data security.
Because users are so tired, they feel resigned and out of control, and therefore they avoid decisions, choose easy options, behave impulsively and fail to follow the rules. This is basic psychology.
Individuals don’t feel vulnerable because they don’t think they are big enough to be a target, and feel resigned when large organizations continue to be victims, and think “How can I protect myself if they can’t?”
The Report makes several recommendations to combat security fatigue and stay secure:
-
Limit the number of security decisions users need to make;
-
Make it simple for users to choose the right security action; and
-
Design for consistent decision making whenever possible.
The authors note that a multidisciplinary team of experts, including security professionals, psychologists, sociologists and anthropologists will need to work together to improve computer behavior in order to manage security fatigue. It sounds like a diagnosis or phenomenon for:
-
entrepreneurs to be looking into
-
a cottage industry to build upon
-
colleges courses to study, and
-
research papers and theses to be written.
This writer is out of school, but security fatigue sounds like a field of study if I have ever heard of one.
[View source.]
