Cybersecurity training for employees: How to teach behaviorally-informed counter strategies

Part of why criminals shape their attacks following the above strategies is because when we aren’t aware of the following mental shortcuts and ways of reacting, our behavior becomes more predictable. 

What is bounded rationality?

Every day, we make decisions that are limited by the information we have on hand - at best, this data is incomplete and at worst, they’re false beliefs.  Even if we’re well-versed and well-educated on a subject, sifting through our knowledge of it to make an informed decision can be limited by our human processing power. These behaviors encapsulate the concept of bounded rationality.⁴

In the context of cybersecurity, this means that a user might intellectually know not to click a suspicious email, but they rely only on the judgment they have at the moment - perhaps they’ve been waiting for a stressful email from their child’s school, and let their anxiety overwhelm their better judgment. This reasoning, as shown in the graph below, is hindered in bounded rationality by cognitive limitations, time pressure or stress, and imperfect information. In this setting, an employee might be stressed about a looming deadline or an angry boss, and so seeing an email that looks like it’s their boss demanding credit card information then exploits their currently limited ability to make rational decisions.

FOMO: Not just for teens

First described in an op-ed by author Dan Hernan, the term FOMO, or Fear of Missing Out, has grown in popularity since his publishing in 2004.⁵ It describes the feeling of apprehension that one gets when they feel like they’re not looped into events, information, or experiences that they’d otherwise want to be involved in. When online, those who experience high levels of FOMO are likely to forgo cyber safety practices in order to join in on what they feel they’re missing out on.⁶

A hacker might make it seem like everyone else is doing something that you’re not: “82% of your colleagues have already signed up, why haven’t you?” It could also look like putting time pressure on a task, like “limited time offer - sign up now.”

More FOMO, more cybersecurity risk

FOMO has been linked to increased risk-taking behavior and heightened vulnerability while online.6 It also strongly predicted poor information security awareness (ISA), even when controlling for demographics and personality traits.⁷ Additionally, those with high self-reported scores of FOMO feel more negatively toward ISA, have poorer knowledge of it, and exhibit behaviors that could threaten their organization’s security.⁷

Even though it may seem like it’s impossible to target and reduce this fear, when you create training that focuses on awareness of how it plays a role in cybersecurity, you set your employees up to be more self-aware and less likely to exhibit FOMO or bounded rationality.

Typical cybersecurity training might look like asking an employee to watch a video on the 5 best ways to protect one’s passwords and then take a quiz after. They may become aware of the right thing to do, but they might not actually do it. This example illustrates the knowing and doing gap, which suggests that there are weak points between awareness, behavioral intention, and actual behavior.⁸ Awareness and training activities do increase knowledge, however that knowledge does not always translate into observable behavioral changes.⁸

The role of heuristics and habits in our defenses

A more promising approach is to create ongoing training initiatives that focus on boosting awareness of one's habits; this type of learning is also referred to as persuasion knowledge.⁹ In one study, awareness of how social engineering exploits our behavior led to a decreased susceptibility to hacks, improving organizational safety.¹⁰ There is a positive relationship between resistance to persuasion attempts and persuasion knowledge, and people who have been trained accordingly are better equipped to react when being exposed to a social engineering scam.¹¹

Training tailored toward self-awareness has also been shown to combat FOMO: when an employee learns why FOMO happens and how it’s triggered, they build resilience that helps them recognize their emotions before reacting.¹² Through increased recognition of how their cognitive tendencies are being exploited, they also build an understanding of the social and personal countermeasures that are available to them.¹²

Teaching counter strategies to prevent hacks

One way to implement this type of training is to teach relevant psychological principles and counter strategies.⁹ Drive these points home by incorporating short scenarios or practice exercises in order to showcase the behavioral principles in practice.⁹ A second strategy includes realistic role playing in which participants have to make a similar decision multiple times.⁹ While potentially more effective, this strategy is also more effortful and may be best limited to key personnel.⁹

A positive side effect of persuasion knowledge: Engaged employees

By focusing training on how social engineers hack our behavior, rather than putting the blame on the victim, you can also foster a culture of education and support rather than fear.¹³ This will help keep your staff engaged,¹³ which is protective against the type of negligence that leads to successful hacking attempts.¹⁴ As technology develops and hackers become more savvy, where traditional training might become outdated, behavioral-focused training will never go out of date as hackers will always try to exploit our human nature.

Not all organizations have an internal team with the behavioral knowledge to create such training programs. The Decision Lab, drawing on expertise in consulting and the social sciences, can help you create behaviorally-informed training programs that will strengthen your organization’s cybersecurity. 

While hackers using social engineering seem to have a sixth sense when it comes to knowing how to exploit our behaviors, thankfully there are ways to circumvent their efforts. One evidence-based strategy is learning more about our own reflexes and the reasons why we fall prey to hacks.

To keep up-to-date on how behavioral science applies to all facets of life, subscribe to The Decision Lab’s monthly newsletter. If you would like to find out more about cybersecurity preparedness and additional strategies, see Strengthen Your Strategy with Cybersecurity by The Decision Lab and Boston Consulting Group.

The Decision Lab is a behavioral consultancy that uses science to advance social good. In the digital age, cybercrime is a threat to all of us — and the root cause of most breaches is human error. We work with some of the most innovative minds in cybersecurity to help organizations navigate this risk by understanding & weeding out sources of bias. If you'd like to tackle this together, contact us.