Encouraging Employee Engagement With Cybersecurity: How to Tackle Cyber Fatigue

Abstract

Cybersecurity fatigue is a form of work disengagement specific to cybersecurity. It manifests as a weariness or aversion to cybersecurity-related workplace behaviors or advice and occurs as a result of prior overexposure to cybersecurity-related work demands or training. While some previous theoretical conceptualizations of cybersecurity fatigue are available, this article is the first to capture all dimensions of the phenomenon in a four-component model. The model holds that cybersecurity fatigue can result from overexposure to workplace cybersecurity advice (e.g., training) or cybersecurity actions (e.g., forced password updates). Similarly, we argue that there can be two types of cybersecurity fatigue: attitudinal (e.g., a belief that cybersecurity is not important) and cognitive (e.g., habituated bad behaviors). We present a multidisciplinary review, which draws on research from management, psychology, and information systems. Practitioners can use the four-component model to identify the type of cybersecurity fatigue that may be occurring in employees and adapt workplace processes accordingly to improve behavior. In addition, we present three illustrative case studies, adapted from employee experiences, to demonstrate the application of the four-component model to an organizational context. The review presents a framework for coordinating the existing approaches to cybersecurity fatigue in the current literature.

Loneliness, life satisfaction, problematic internet use and security behaviours: re-examining the relationships when working from home during COVID-19

“…While further analysing these themes and their direct relation to CSB is beyond the scope of our research, they are consistent with emerging literature which suggests that employees experiencing stress from adapting to new technologies may be less productive and less receptive to cybersecurity-related workplace behaviours (Reeves, Delfabbro, and Calic 2021).…”

A Survey on Cybersecurity Challenges, Detection, and Mitigation Techniques for the Smart Grid

“…The results show that autoencoder-based prediction model performance was better than long short-term memory (LSTM), random forest, naïve Bayes, decision tree, k-nearest neighbor, and LSVM. Employees in an organization can be categorized as attitudinal (employees who do not think that cybersecurity is an important factor to consider) and cognitive (employees who understand the importance but do not embrace it because they think its too much work) [58] therefore, regular employees training can be helpful in combatting cyberattacks.…”

“…Cognitive-type fatigue can lead to employees setting weak passwords [58]; thus, enforcing strong passwords and strength policy can be helpful.…”

“…As per [58], some employees find it difficult to remember all the of different and complex passwords.…”

Risk Assessment Methods for Cybersecurity in Nuclear Facilities: Compliance to Regulatory Requirements

“…Cybersecurity procedures include strategies, security principles, security guarantees, guidelines, and risk management approaches [20]. Human resources relate to personnel that has to be equipped with skills and knowledge that are up-to-date and are continuously refreshed through training [21] (otherwise, the personnel can also turn into a threat [22]). Communication integrates all of the aspects mentioned earlier in cybersecurity systems.…”