User ‘security fatigue’ named a critical concern by NIST
In the health IT battle to keep data safe and secure, the National Institute of Standards and Technology (NIST) is encouraging network administrators and managers to take a hard look at user fatigue as an entryway for lax in-house security practices. After interviewing users and putting together a comprehensive study, they say that the repetitiveness of password inputs throughout the day, for example, can lead users to risky computing behavior at work and in their personal lives.
The study, published in October in IEEE’s IT Professional, draws on data from a qualitative study on computer users’ perception and beliefs about cybersecurity and online privacy. The subjects ranged in age from their 20s to their 60s, hailed from urban, suburban, and rural areas, and held a variety of jobs.
The multidisciplinary team from NIST learned that the majority of their average computer users felt overwhelmed and bombarded, and they got tired of being on constant alert, adopting safe behavior, and trying to understand the nuances of online security issues.
When asked to make more computer security decisions than they are able to manage, they experience decision fatigue, which leads to security fatigue.
Researchers found that the result of weariness leads to feelings of resignation and loss of control. These reactions can lead to avoiding decisions, choosing the easiest option among alternatives, making decisions influenced by immediate motivations, behaving impulsively, and failing to follow security rules.
Comments among those who expressed feelings of security fatigue included:
- “I get tired of remembering my username and passwords.”
- “I never remember the PIN numbers; there are too many things for me to remember. It is frustrating to have to remember this useless information.
- “It also bothers me when I have to go through more additional security measures to access my things, or get locked out of my own account because I forgot as I accidentally typed in my password incorrectly.”
Participants also wondered why they would be targeted in a cyberattack. The data showed that many interviewees did not feel important enough for anyone to want to take their information, nor did they know anyone who had ever been hacked.
Commenters also expressed the sentiment that safeguarding data is someone else’s responsibility, leaving computer security up to their bank, online store, or someone with more experience.
Individuals also questioned how they could effectively protect their data when large organizations frequently fall victim to cyberattacks.
The data provided evidence for three ways to ease security fatigue and help users maintain secure online habits and behavior. They are:
- Limit the number of security decisions users need to make;
- Make it simple for users to choose the right security action; and
- Design for consistent decision-making whenever possible.
Source: NIST
