Practitioner’s view – Hesitations on the term ‘behaviour change’

The term “behavior change” in the context of cybersecurity is met with some skepticism by practitioners, particularly those with backgrounds in education or psychology. This skepticism stems from the belief that the concept of behavior change is often oversimplified and misunderstood, especially in complex systems like cybersecurity. Here’s a detailed explanation of why some practitioners are hesitant to use this term:

1. Complexity of Human Behavior:
   • Behavior change implies a straightforward process where individuals simply alter their actions based on new information or incentives. However, human behavior is complex and influenced by various factors, making it challenging to enforce consistent changes across a large group of people.
   • The practitioner emphasizes that while in theory, behavior change sounds simple, in practice, it is nearly impossible to achieve universally. Even with widespread adoption of new behaviors, there will always be outliers who resist change.
2. Focus on Systems Rather than Individuals:
   • The practitioner advocates for focusing on improving systems rather than solely trying to change individual behaviors. The idea is to create environments and systems that naturally guide individuals toward secure behaviors, rather than relying on the assumption that people will change on their own.
   • The analogy of drink-driving laws is used to illustrate this point. While laws and moral standards have reduced the behavior, some people still engage in it. The solution, therefore, lies more in systemic changes, such as better law enforcement and technology, rather than solely relying on behavior change.
3. Misconceptions and Oversimplifications:
   • The term “behavior change” can lead to oversimplifications and misconceptions. For example, in organizations, the concept might be applied without a deep understanding of the behavioral and psychological factors involved, leading to ineffective strategies.
   • The practitioner also highlights that behavior change is often treated as a transactional process, where a specific input (like training or policies) is expected to lead to a direct output (changed behavior). This approach neglects the complexity of human behavior and the various factors that can influence it.
4. Challenges in Organizational Contexts:
   • In organizations, security behavior change is not just about individual actions but involves understanding the broader context, including organizational culture, system design, and the specific challenges employees face.
   • The practitioner suggests that instead of focusing on changing behavior, organizations should aim to make security practices fit seamlessly into daily routines, making it easier for employees to adopt secure practices without feeling overwhelmed.
5. Critique of the ‘Nudging’ Concept:
   • The concept of “nudging” is mentioned as an example of how behavior change ideas can be misapplied. While nudging is meant to subtly guide people toward better decisions, it is often implemented in a way that feels more like shoving or forcing, which can lead to resistance and unintended consequences.
   • Proper nudging requires careful design and consideration of choice architecture, which is often overlooked in practice.

Key Takeaways:

• Behavior Change is Complex: Human behavior is influenced by multiple factors, making it difficult to enforce consistent changes across a group.
• Systems Over Individuals: Focus should be on designing systems that naturally guide secure behaviors rather than solely trying to change individual actions.
• Misconceptions: The term “behavior change” can lead to oversimplifications, particularly in organizational contexts where the broader environment plays a significant role.
• Organizational Fit: Security practices should be integrated into daily routines in a way that feels manageable and relevant to individuals.

Book References:

1. “Thinking, Fast and Slow” by Daniel Kahneman (2011):
   • This book explores how people think and make decisions, which is critical to understanding behavior change. It provides insights into the complexity of human behavior and decision-making processes.
2. “Nudge: Improving Decisions About Health, Wealth, and Happiness” by Richard H. Thaler and Cass R. Sunstein (2008):
   • This book introduces the concept of nudging and how subtle changes in the environment can lead to better decision-making, which is relevant to discussions on behavior change in cybersecurity.
3. “The Power of Habit: Why We Do What We Do in Life and Business” by Charles Duhigg (2012):

This book delves into the science of habits, explaining how behaviors are formed and changed, which is directly applicable to security behavior change strategies