Why IT Security Needs Therapy

Abstract

Over the past decade, researchers investigating IT security from a socio-technical perspective have identified the importance of trust and collaboration between different stakeholders in an organisation as the basis for successful defence. Yet, when employees do not follow security rules, many security practitioners attribute this to them being “weak” or “careless”; many employees in turn hide current practices or planned development because they see security as “killjoys” who “come and kill our baby”. Negative language and blaming others for problems are indicators of dysfunctional relationships. We collected a small set of statements from security experts’ about employees to gauge how widespread this blaming is. To understand how employees view IT security staff, we performed a prolific survey with 100 employees (n = 92) from the US & UK, asking them about their perceptions of, and emotions towards, IT security staff. Our findings indicate that security relationships are indeed often dysfunctional. Psychology offers frameworks for identifying relationship and communication flows that are dysfunctional, and a range of interventions for transforming them into functional ones. We present common examples of dysfunctionality, show how organisations can apply those interventions to rebuild trust and collaboration, and establish a positive approach to security in organisations that seizes human potential instead of blaming the human element. We propose Transactional Analysis (TA) and the OLaF questionnaire as measurement tools to assess how organisations deal with error, blame and guilt. We continue to consider possible interventions inspired by therapy such as conditions from individual and group therapy which can be implemented, for example, in security dialogues or the use of humour and clowns.

“Those things are written by lawyers, and programmers are reading that.” Mapping the Communication Gap Between Software Developers and Privacy Experts

“…Fostering a healthy relationship between privacy experts and developers. Different parties with different backgrounds perceive each other in a blocking manner has also been found in security research (e.g., [9,13,35,91]), such as end users seeing security experts and the measures they deploy within their company as a hindrance, resulting in a dysfunctional relationship between the two groups [51]. This may limit the interaction of the groups, hindering the establishment of a Personal Common Ground.…”

Impact of information security threats on small businesses during the Covid-19 pandemic

“…These information security breaches are caused by insiders and outsiders (Ncubukezi, 2022). Insider information threats are often caused by employee ignorance, poor decision making, lack of skills, poorly enforced security strategies, understaffing, poor security guidelines, and a technological knowledge gap (Kluge, Sasse & Verret, 2022;Singh & Singh, 2022).…”

Target Groups in German SMEs for Information Security Training: The Use and Limits of Job Profiles in Designing Training Units

“…The Verizon 2022 Data Breach Investigations Report emphasizes that 82 percent of the breaches that occurred were made possible by the decisions and/or active unconscious behavior of humans, involving phishing, the theft of credentials, misuse, and error [4]. However, Menges et al [5] point out that using negative language and blaming employees are indicators of dysfunctional relationships. Information security awareness (ISA) among employees is important but should not be seen as a panacea [5].…”

“…However, Menges et al [5] point out that using negative language and blaming employees are indicators of dysfunctional relationships. Information security awareness (ISA) among employees is important but should not be seen as a panacea [5]. It cannot resolve organizational and technical deficiencies, implement security protocols that go beyond staff capabilities, or manage conflicts with the productivity goals that companies expect of their employees.…”