Nudge, nudge, block no more...
Why do people try to circumvent security controls -- for example to access an unapproved SaaS application or cloud service?
New research from Nudge Security suggests it may simply be down to poor user experience of the security process. "We now have evidence to suggest that improving the employee experience of security can actually lead to better security outcomes," says Russell Spitler, CEO and co-founder of Nudge Security.
The research put 900 participants through a common scenario: needing to access a SaaS application for work. Participants were randomly assigned to one of three 'security interventions' that either blocked access to the application, revoked access punitively, or nudged participants to justify access.
Participants were then asked to rate how reasonable they found the intervention, how positively or negatively they felt about it, and how likely they were to comply with it. Overall, the study finds participants' attitudes and emotions strongly correlate with their likelihood of compliance. 67 percent of participants say they would not comply with the blocking intervention but would instead look for a workaround.
Participants see nudging as the most positive and reasonable form of intervention. They are three times more likely to feel negatively about blocking and punitive interventions. 78 percent of participants say they would comply with a nudge, twice the compliance rate of blocking.
Dr. Aaron Kay, PhD, J Rex Fuqua Professor of Management and professor of psychology and neuroscience at Duke University and Nudge Security advisor, consulted on the development of the research and says, "This research underscores basic tenets of human psychology and demonstrates that, even in cybersecurity, attitudes and emotions are strong predictors of behavior. Security leaders are setting themselves up for failure when they implement security controls with the assumption that employees will comply mechanically, regardless of their own self interests."
The full report is available from the Nudge site and there will be a webinar to discuss the findings on November 3rd at 3pm ET.
Image credit: lisafx/depositphotos.com