1. The Psychology of Security
By: Ryan West

2. Increase in Research of Security Psychology
Over the last decade, there has been a tremendous increase in the awareness and research in user interaction with security mechanisms
It is important to understand how users evaluate and make decisions regarding security

3. When Risk is not a Risk
Non-acceptance of security tools is a major problem facing the information security world

4. Why? Users do not think they are at risk
People believe they are less vulnerable than others
“That will never happen to me.”
Risk homeostasis
Applied to security, as users increase security measures, they are likely to increase risky behavior as well
Users aren’t stupid, they’re unmotivated
Humans favor quick solutions
Accounts for why users do not read all of the text in a security display or consider the consequences of their decisions

5. Why? Safety is an abstract concept
Outcomes that are abstract are less enticing
Pro-security choice has no visible outcome
Not satisfying to user
Feedback and learning from security-related decisions
No instant reinforcer in shaping behavior
User makes pro-security decisions and the reinforcement is that bad things are less likely to happen

6. Why? Evaluating the security/cost trade-off
Users evaluate the possible gain (security) against the possibility that nothing bad would happen
Making trade-off between risk, losses, and gains
Users are more likely to gamble for a loss than accept a guaranteed loss

7. Why? Security as a secondary task
Users focus one losses that will affect their immediate goal
Pro-security decisions is least likely to be made when occupied with something else
Losses perceived disproportionately to gains
User must perceive greater amount of gain than loss
Cost of security may be minimal, the but the loss could be considered worse than the gain in safety

8. Improving Security Compliance
Reward pro-security behavior
Example: Antivirus or antispyware products find and remove malicious codes
Improve awareness of risk
Issue with security systems: messages and alerts
They don’t stand out from other computer messages

9. Improving Security Compliance
Catch corporate security policy violators
Systems with good auditing systems could “catch” individuals who make poor security decisions
Receive notifications
Reduce the cost of implementing security
Employ secure default setting
Most users do not change these settings

10. Conclusion Increase compliance with security systems
Working with psychological principles that guide behavior
Security only becomes a priority when a user has a problem
Education needs to be increased

11. Relation to Computer Ethics Code
1.2 Avoid harm to others
2.1 Strive to achieve the highest quality, effectiveness and dignity in both the process and products of professional work
2.2 Acquire and maintain professional competence
2.5 Give comprehensive and thorough evaluations of computer systems and their impacts, including analysis of possible risks
2.7 Improve public understanding of computing and its consequences

12. My Opinion Article was very interesting
Makes me rethink just exiting out of the pop-ups from firewall
I should stop and actually read the security pop-ups and see if any action is needed
It is good practice to keep security system updated and follow its recommendations regarding websites and opening attachments

13. Questions
What is a major problem facing the information security world?
Give an example of how to reward pro-security behavior.
What is one issue with security systems?
What is risk homeostasis?

14. Case Study
John has been commissioned by a private organization to create software that encrypts and protects their client’s personal information such as their social security numbers and medical history. John is stumped on how to start the project. He begins researching similar programs and how they were developed. He finds one that meets the private company’s needs and standards, so he uses it as a means to start his own program without receiving consent from the programmer. When John later publishes an article about his software, he does not cite the original software he used as a reference. What are the ethical implications of John’s actions? Are there any negative implications of his decision?

15. Answer to Case Study 1.2 Avoid harm to others
1.3 Be honest and trustworthy
1.5 Honor property rights including copyrights and patent
1.6 Give proper credit for intellectual property
2.3 Know and respect existing laws pertaining to professional work
4.1 Uphold and promote the principles of this Code