Security on Autopilot

Abstract

Most current information systems security theories assume a rational actor making deliberate decisions, yet recent research in psychology suggests that such deliberate thinking is not as common as we would expect. Much of human behavior is controlled by nonconscious automatic cognition (called System 1 cognition). The deliberate rational cognition of System 2 is triggered when System 1 detects something that is not normal; otherwise we often operate on autopilot. When we do engage System 2 cognition, it is influenced by the System 1 cognition that preceded it. In this paper we present an alternative theoretical approach to information security that is based on the nonconscious automatic cognition of System 1. In a System 1 world, cognition is a sub-second process of pattern-matching a stimulus to an existing person-context heuristic. These person-context heuristics are influenced by personality characteristics and a lifetime of experiences in the context. Thus System 1 theories are closely tied to individuals and the specific security context of interest. Methods to improve security compliance take on a very new form; the traditional approaches to security education and training that provide guidelines and ways to think about security have no effect when behavior is controlled by System 1, because System 1 cognition is instant pattern matching not deliberative. Thus in a System 1 world, we improve security by changing the heuristics used by System 1's pattern matching and/or by changing what System 1 sees as "normal" so that it triggers the deliberate cognition of System 2. In this article, we examine System 1 and System 2 cognition, while calling for increased research to develop theories of System 1 cognition in the cybersecurity literature.

Choose your own training adventure: designing a gamified SETA artefact for improving information security and privacy through interactive storytelling

“…Behaviour is a complex construct as various factors affect one's behaviour simultaneously, such as past experience, current context, and other specific stimuli (Dennis & Minas, 2018). This complexity is heightened in the case of OSD (Acquisti et al, 2015) as users rely on technical (e.g., privacy controls and settings), behavioural (e.g., self-censorship) and mental (e.g., reciprocity of trusting others) strategies to manage their privacy on SNS (Cavusoglu et al, 2016).…”

Virtual lab coats: The effects of verified source information on social media post credibility

“…Second, it remains inconclusive whether the informed viewing yields a virtual lab coat effect. An explanation for this is the novelty of the design, which might have led participants to process the signature more elaborately (e.g., [ 103 ]).…”

Rushing for security: a document analysis on the sources and effects of time pressure on organizational cybersecurity

“…Under time pressure, decision-makers’ cognitive processes tend to shift away from careful and deliberate approaches (System 2 thinking) to a stronger reliance on emotional and faster decision strategies that follow heuristics (System 1 thinking; Johnson et al , 1993; Kahneman, 2003). Recent research increasingly emphasizes the important role of emotions and heuristics in CS decision-making (Dennis and Minas, 2018). In switching to simpler decision-making strategies using less cognitive effort (Johnston and Warkentin, 2010), people tend to process less information (Wright, 1974) and are less likely to resolve discrepancies or to account for uncertainty (Cowan, 1986).…”