Updating the map – adding the schools of thought and epistemological traditions to the security behaviour map

This session introduces the different schools of thought and epistemological traditions that inform the study of security behaviors. These perspectives provide the foundation for understanding and influencing behaviors in the context of cybersecurity, drawing from various disciplines like psychology, sociology, economics, and human-computer interaction (HCI).

1. Psychological Perspective

• Cognitive Psychology: This subfield focuses on mental processes such as perception, attention, memory, and decision-making. In the context of security behaviors, cognitive psychology helps us understand how people perceive risks, how their risk perceptions change with varying impact or probability of loss, and their willingness to take protective actions. Cognitive biases, such as overconfidence or optimism bias, can influence both end-users and security professionals’ decisions and behaviors.
• Behavioral Psychology: This area concentrates on observable behaviors and how they are influenced by external factors. For security behaviors, behavioral psychology is concerned with how habits are formed and how to create lasting behavior changes, such as promoting compliance with security policies or enhancing security hygiene practices. Mechanisms like reinforcement and punishment, often used in behavioral interventions, play a critical role here.

2. Sociological Perspective

• This perspective examines the social context in which behaviors occur, focusing on how social norms, roles, and group dynamics influence security behaviors. In an organizational setting, the concept of security culture, which encompasses the shared values, beliefs, and practices related to security, is crucial. Sociological insights help explain how security practices are adopted and maintained within groups, how new technologies and ideas are communicated and trusted, and how they impact the collective behavior of communities.

3. Economic Perspective

• Traditional Economics: This approach looks at how security tasks and decisions are influenced by factors like transaction costs and information asymmetries. For example, if a security measure is perceived as too time-consuming or difficult, employees may be less likely to adopt it. Information asymmetry, where different stakeholders (e.g., employees vs. management) have different levels of information and different motivations, can lead to misaligned security behaviors.
• Behavioral Economics: This subfield focuses on cognitive biases and heuristics in decision-making under risk and uncertainty. Behavioral economics explores how framing effects, like loss aversion, influence security-related decisions. For example, individuals may place more importance on avoiding potential security breaches (loss aversion) than on gaining equivalent security benefits. Behavioral economics also examines how social norms and peer behaviors (herding behaviors) influence individual security practices.

4. Human-Computer Interaction (HCI) Perspective

• HCI emphasizes usability and user experience design, focusing on creating systems and interfaces that are user-friendly, intuitive, and efficient. In cybersecurity, HCI plays a vital role in ensuring that security features are designed in a way that users can easily understand and use. Poorly designed interfaces can lead to user errors, while well-designed ones can facilitate better security practices through elements like feedback loops, error prevention, and clear navigation.

Interconnections Between Perspectives

• These disciplines are not isolated; they interconnect in shaping how we understand and influence security behaviors. For instance, the design of a user interface (HCI) can be informed by cognitive psychology (e.g., understanding how users process information) and behavioral economics (e.g., how to frame security prompts to encourage compliance). Similarly, security culture within an organization (sociological perspective) can be influenced by both the perceived costs and benefits of security actions (economics) and the reinforcement of positive behaviors (behavioral psychology).

Understanding these perspectives allows for a more comprehensive approach to studying and influencing security behaviors, helping organizations to design more effective security interventions that are informed by a broad range of theoretical foundations.

Suggested Reading:

• “The Psychology of Cybersecurity” by Thomas J. Holt & Adam M. Bossler: This book explores psychological theories and their application to cybersecurity behaviors.
• “The Human Factor of Cybercrime” edited by Rutger Leukfeldt & Thomas J. Holt: This text delves into the sociological and psychological factors that influence cybersecurity.
• “Behavioral Economics: A Very Short Introduction” by Michelle Baddeley: This book provides an accessible overview of behavioral economics, including its application to risk and decision-making.
• “Designing for User Engagement: Aesthetic and Attractive User Interfaces” by Alistair Sutcliffe: A comprehensive look at HCI and its relevance to creating effective security systems.