Leading Associations

 
We cannot change behavior, we can only modify behavior, and for cybersecurity experts this is critical, and it starts with naming.
 
Take this example and look at possible answers.

1. A __________ who hacks into a political opponent’s website to get private emails to embarrass them

 
Answers
…Cyberterrorist
…Human Rights Worker
 
What about this example

1. A ___________who hacks into a food processing plant to get information on the on-farm animals

 
Answers
…Cybercriminal
…PETA
 
 
As soon as you hear the term cyberterrorist or cybercriminal, what were your thoughts?
 
Compare cyberterrorist to a Human Rights Workers, even though the engaged in the same activity.
 
The two problems are:
1) Association
2) Leading
 
Leading, what you are looking for, or already know what the outcome will be, and association, we associate certain terms for people with certain activities.

 
For cybersecurity experts designing our protection systems, when we hear of an out of control automobile running over a few pedestrians - what are our initial thoughts? Terrorist?
 
(Let’s forget about autonomous driving cars for the moment – however, this is a label as well)
 
When we hear of a breach of a major retailer, do we think cybercriminal?  Do we have a mental image of what they may look like?
 
Unfortunately, students learning to drive have run over curbs, and yes, even little old grandmas have hacked into computer systems.
 
An issue then often arises, we made a judgment so bad that we eventually pull back the cybersecurity protections systems we installed.
 
People cannot work, too many mistakes made, too many complaints, etc.,  Or we have made a judgment so lax; violations are bound to occur, and when they do occur, no one notices till its too late.
 
A cybersecurity expert’s behavior should be straightforward, be aware that labels exist, and regardless of such, accomplish the task at hand.
 
Later it will be explored how our neural network associations make this an extremely difficult job – even when we realize this happens.
 

Tadda G.P., Salerno J.S. (2010) Overview of Cyber Situation Awareness. In: Jajodia S., Liu P., Swarup V., Wang C. (eds) Cyber Situational Awareness. Advances in Information Security, vol 46. Springer, Boston, MA
 
Pfleeger, S. L., & Caputo, D. D. (2012). Leveraging behavioral science to mitigate cyber security risk. Computers & Security, 31(4), 597–611