Even the most security-savvy people are extremely busy in their day-to-day jobs and can make security mistakes. American Poet, Nikki Giovanni, said it best "mistakes are a fact of life. It is the response to error that counts."
This is very true for the world of cyber security. When security mistakes are made, they often go unnoticed by both the employee and the organisation until they result in an incident.
But what if there was a way to automatically know when risky security behaviours occur, and employees are empowered to easily fix their own mistakes before they cause problems?
That's where cyber security nudges come in. These simple yet effective notifications are designed to empower employees to quickly mitigate risks they create, no matter their level of security awareness or technical knowledge. And the best part? They can drive instant behaviour change and provide quantifiable metrics showing the number of resolved risks.
Simply put, it's a relevant, timely security notification delivered to an employee via instant message, push notification or web browser.
It's designed to get employees to perform a desired security behaviour, such as updating their password or double-checking the recipient of an email before opening any links. By triggering security nudges the instant an employee performs a risky security behaviour, you can make them aware and empower them to fix any risk in a single click.
Imagine this: you've accidentally shared sensitive HR data with the world on Dropbox. You're panicking, wondering how you could have made such a careless mistake. But then a security nudge pops up on your screen, guiding you through the steps to immediately fix the permissions in just one click. That's proper employee-powered security, and it should be a crucial part of any organisation's human risk management plan.
Now, you might be thinking, "But we already provide security awareness training to our employees. Isn't that enough?" Unfortunately, traditional security awareness training has little to no impact on what behavioural scientists call system 1 behaviour.
System 1 behaviours are our brains' fast, automatic, unconscious, and emotional responses to situations and stimuli. These are our absentminded thoughts, such as tying your shoelaces or clicking send on an email (even if it's got the wrong recipient!).
System 2 is the mind's slow, analytical mode, where reason dominates. This activity is activated when we do something that doesn't come naturally and requires some mental exertion; this could be drawing a picture or setting a password.
This raises the question of cognitive process in how the employee thinks when they make security decisions - do they act unconsciously (system 1) or consciously (System 2)?
The human brain is optimised for efficiency, making unconscious, automated decisions. This greatly affects how employees react to phishing emails, MFA notifications, sharing information, and many more security behaviours while they go about their day-to-day job. Nudges immediately combat risky system 1 decisions, helping employees instantly fix any risks they create.
Data loss prevention (DLP) tools are great at handling cases of employees making mistakes that could put data at risk, but only when false positive rates are low.
High false positive rates can block employees from doing their job (Perhaps they need to post that personally identifiable information legitimately as part of their job!) and leave them frustrated.
Security nudges can be used as well as, or in some cases instead of, DLP tools to help employees stay secure without blocking their productivity. It's a win-win situation.
CultureAI has been at the forefront of reducing insider risk with nudges for the past year now.
We have learnt a lot in that time about how to reduce insider risk with nudges.
We’d love to share that knowledge with you and how these simple yet effective notifications have transformed security culture and reduced risks.
We will be hosting a 30-minute lightning webinar on March 1st to share with you the five core lessons we’ve learnt and how you can apply that knowledge to your organisation.
We will cover the following:
You can also read more about CultureAI's thoughts on cyber security behaviour change, if this has got you interested.
