In October 2018, the U.S. Government Accountability Office (GAO) released a frightening reportopens in new window that found that the nation’s weapons systems are extremely vulnerable to hackers. The risk, the GAO reported, is not only due to supergenius hackers. Instead, much of the fault lies with Department of Defense (DOD) staff who fail to follow through with basic safeguards, like changing the default passwords that come with their software. In one test, the government’s faux hackers were able to guess an administrator password in just nine seconds.
The missiles and bombs of the DOD certainly need better cyberprotection, but defense staff aren’t alone in their cybersecurity failures. Industry surveys by LogMeIn in 2018opens in new window and Keeper in 2017opens in new window suggest that at least half of people make bumbling security moves such as re using the same passwords over and over. It’s a problem that’s only likely to deepen as technology becomes even more intertwined in daily life. Today, computers aren’t just located on office desks, but in pockets, thermostats, refrigerators, doorbells and the family sedan, says Peter Hancock, DSc, PhD, a psychologist and human factors researcher at the University of Central Florida (UCF).
“We’re in this changeover stage where we’re going from pure human control to basically a shared form of control,” Hancock says.
In that stage, whether it’s in cars or in Wi-Fi-controlled homes, humans can become confused, complacent or both. Their resulting security shortcuts open people up to hacking, identity theft and other cybercrimes. For psychologists studying how humans interact with computers, the landscape of gadgets is dizzying, but the driving question is the same: How can behavioral science help keep people safe in a world where they interact with technology at almost every moment?
'Users are not the enemy'
Throughout the 1980s and 1990s, as computers gradually became familiar tools for most people, designers tended to think of end users as “monkeys you can train,” says Angela Sasse, PhD, a professor in the computer science department at Ruhr University Bochum in Germany.
“They basically just said, ‘You’ve got to behave this way’ and wrote a policy and sometimes enforced that through some technical mechanism,” Sasse says. Rarely did designers pause to ask whether people were actually capable of carrying out the policy, she says.
In 1999, Sasse and her colleague Anne Adams, PhD, both at University College London at the time, wrote a provocative paper titled “Users Are Not the Enemy,” which is still cited as a key work explaining why software and security design have to take human psychology into consideration ( Communications of the ACM opens in new window, Vol. 42, No. 12, 1999). By surveying workers in various industries, Sasse and Adams found that people don’t make bad security choices out of stupidity. In some cases, their subjects just hadn’t been informed of why their choices mattered. In others, they were juggling the pressure to be productive with challenges like remembering multiple passwords that had to be changed frequently. Unable to do it all, they resorted to less-than-ideal shortcuts, including writing passwords down where they might be discovered or picking simple, single-word passwords that are easy for hackers to crack.
Since then, Sasse says, technicians have realized that security systems need to take human cognition into account. At the same time, the number of passwords people have to juggle has skyrocketed, creating an impossible memory task for users.
And hacked passwords aren’t the only threat: Opportunities for email scams, phishing attacks and malicious apps are now more prevalent than ever. The people who craft these attacks have a “certain amount of psychological skill,” Sasse says. That’s why as attackers become more sophisticated, the approach to security has to evolve, too.
Improving how people approach their own security often involves fundamental psychological research, says Robert Proctor, PhD, a cognitive psychologist at Purdue University in West Lafayette, Indiana. Basic principles of memory, decision-making and information-framing can inform how security systems are set up.
“We try as much as possible to link up to the basic knowledge of psychology,” Proctor says.
Password protection
Passwords are a good example. Most people have heard that passwords should be unique. But the factors that make a password strong tend to fly in the face of what works for memory retention. The common psychological shortcuts for remembering a task, such as making a list, are big no-nos for security because they make it easier for other people to access private information, says psychologist Naomi Woods, PhD, an assistant professor of information security at the University of Jyväskylä in Finland.
“We have all these memory techniques and we can’t even use them,” Woods says.
To make matters worse, Woods and her colleagues have found that people often under- estimate their ability to remember passwords, which becomes a self-fulfilling prophecy. These misconceptions of ability, rather than an actual lack of memory, explain why passwords are easy to forget ( International Journal of Human-Computer Studies opens in new window, Vol. 111, 2018). That leads to anxiety, which then prompts the security sin of password reuse.
Surprisingly, though, reusing passwords may not be the best memory strategy. In research under review, Woods and her colleagues tested people’s memory for reused, modified and unique passwords and found that people remembered unique passwords best. It can actually be harder to recall modified passwords, Woods says, because the memory of one variation tends to interfere with the memory of other variations. Anyone who has sat puzzling over whether a particular password used a “1” or a letter “l”—or was it a “!”?—can probably relate.
Research points to a better memory strategy: mnemonics. In 2017, the National Institute of Standards and Technology (NIST) began to recommend passphrases rather than passwords because phrases are easier to recall and more difficult for hackers to guess ( NIST , 2017 opens in new window). One common strategy is to pick a sentence and use the first (or second or third) letter of each word to build the password, sometimes substituting numbers or symbols for letters.
But just telling people about mnemonic strategies isn’t enough. Systems designers must carefully think through how they present their instructions. If instructions are vague and use a generic example phrase like “Four score and seven years ago,“ users tend to pick generic password sentences. In one study, among 864 participants who were given generic instructions, 57 people chose a sentence that someone else had also chosen.
“To be or not to be, that is the question” was picked 22 times, for example ( Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security opens in new window). But of the 777 participants instructed to think of a personalized sentence that other people would be unlikely to choose, not one picked the same phrase. The study results show how sensitive human behavior is to small tweaks in design, says Proctor.
The phishing trap
Psychology-sensitive design also plays a role in efforts to keep people from falling prey to tech-based fraud. Phishing, or tricking people into giving out passwords or personal information by impersonating a trusted entity, is a huge security threat. It’s how hackers breached Sony’s computer networks in 2014, releasing a cavalcade of embarrassing emails and financial documents.
Phishing scams are often quite sophisticated, Sasse says, using visual clues like company logos to make email messages look legit, and often inducing some kind of time pressure that will make people act without thinking. “They really know how to push people’s buttons,” she says.
To fight back, browser designers create cues to a webpage’s security, like the little lock icon next to a URL that tells users the privacy level of the page they’re visiting. But research suggests that these cues don’t necessarily work. In one study led by Purdue computer scientist Ninghui Li, PhD, and co-authored by Proctor, researchers highlighted the URLs of both legitimate and phishing webpages to help people decide whether they were legitimate or not. (URLs are unique, so phishing sites must alter them slightly.) Eye-gaze monitoring showed that when people were told to look at the highlighted URLs, they followed instructions.
Unfortunately, that extra attention didn’t translate to better judgments about a website’s legitimacy ( Human Factors opens in new window, Vol. 59, No. 4, 2017). People may not understand the security cues developers put in address bars, the researchers concluded, so education may be the solution.
One controversial approach that some companies take to combat phishing involves conducting fake attacks to catch employees who might fall for real strikes. A real phishing attack might lure employees to a webpage that prompts them to enter a password that attackers could use to access private company information. A fake attack would mimic this approach to collect information on who fell for the fraudulent link.
But this approach can backfire, Sasse says. In one study that fake-phished employees at a real company, researchers set up phishing links to go to a training page that warned people they’d been tricked. Then, the researchers phished the same participants again. There was no difference in the rate of click-throughs after the training—and not only did the training fail, but qualitative interviews afterward revealed that many people felt their company had betrayed and shamed them by putting them through the test ( IEEE Security & Privacy opens in new window, Vol. 12, No. 1, 2014).
Some experts argue that it’s better to build trust with employees than to try to shock them with a lesson that may make them feel gullible. According to Sasse, security breaches thrive on secrecy and shame. “It’s very important to get people to talk about security and help each other,” she says.
A connected future
The increasing ubiquity of “smart” appliances is another worrisome security domain that demands a psychological approach. In 2013, hackers accessed over 100,000 smart TVs, refrigerators and routers to send out hundreds of thousands of spam emails. Researchers have reported that out-of-the-box Wi-Fi-enabled devices are extremely vulnerable to hacks; there are even reports of baby monitors being infiltrated (“Smart Card Research and Advanced Applications,” CARDIS 2017,
Lecture Notes in Computer Science
, Vol. 10728, 2018).
So far, designers of these devices haven’t been good about informing end users about the security risks of these devices. Users are often unaware of the level of identifying information collected by devices such as smart thermostats, which use sensors to detect when homeowners are at home, when they are away and even when they sleep, Proctor says. The marketing of these devices downplays security and privacy concerns, and there are few avenues for warning consumers when their devices might have been compromised. If there had been, Proctor and his colleagues wrote in the journal Ergonomics and Design, many users affected by the 2013 hack probably would have taken their smart appliances offline so they’d stop sending spam emails ( Ergonomics in Design opens in new window, online first publication, 2018).
“Presenting warnings and sharing information about any potential cyberthreats may allow users to jump back into the loop to make their own decisions about their safety,” Proctor and his colleagues wrote.
This sort of shared responsibility for smart devices—part technical, part human—extends to smart cars, says UCF’s Hancock. There, it isn’t just information security and personal identity at risk, but actual survival—a hacked vehicle, after all, could literally be used to kill someone. “Automated vehicles are going to be the first time we are physically embedded in that technology,” he says.
In fact, this future, ultraconnected world may require a whole new approach to security. Researchers in human-computer interaction are already exploring the possibilities. One emerging concept is graphical passwords, which are more difficult to hack than text-based passwords. One example, developed by Susan Wiedenbeck, PhD, a professor emerita and human-computer interaction researcher at Drexel University in Philadelphia, and colleagues is called PassPoints, in which users pick a series of points to click on an image or photograph. To log in, they must remember the click points and their order ( International Journal of Human-Computer Studies , Vol. 63, No. 1–2, 2005 opens in new window). These passwords are basically unguessable due to the number of possible points that could be used.
Other graphical systems involve choosing a group of images from a huge menu. To enter the password subsequent times, the user must pick those same images in the same order.
The idea behind graphical passwords is that people recognize images better than they recall words. But the devil is in the details as to how well graphical passwords work in the real world. One study of the choosing-from-a-menu type found that people struggled to remember multiple image passwords after a few weeks (2014 Twelfth Annual International Conference on Privacy, Security and Trustopens in new window), but another study found that these recognition-based systems were more memorable than the PassPoints-style point-and-click ones (Proceedings of the Ninth Symposium on Usable Privacy and Security, 2013opens in new window). Wiedenbeck and her colleagues found in their 2005 study that people remembered graphical passwords just as well as text-based ones but took longer to enter them.
Another strategy that required people to use a personal image to build a text password performed better. In one study, a user brought in a picture of a cat named Kali and told the experimenter she’d been known to stick her nose in candle flames and had been the subject of many pricey vet bills. The user came up with the password “G0d$$ofF!re” to combine her memories of the cat’s behavior with the cat’s name. Image-cued mnemonics worked better than word-based ones, the researchers found, and they were difficult to hack ( Computers in Human Behavior , Vol. 26, No. 4, 2010 opens in new window).
The future is also likely to bring new advances in security training, Sasse says. Since the 1990s, IT professionals have been gamifying security with exercises like “cyber security capture the flag.” These events divide people into teams that either attack or defend a computer system. Similar concepts now exist for non-experts. Carnegie Mellon University researchers developed a game called “Anti-Phishing Phil” that uses cartoon fish to teach users not to fall for phishing attacks; their research suggested that the game was an effective training tool ( Proceedings of the 3rd Symposium on Usable Privacy and Securityopens in new window , 2007opens in new window).
In 2018, the City of London Police started offering local companies cybersecurity training with a tabletop game involving Legos. And Texas A&M’s IT department has won awards with its campus-wide cybersecurity gamesopens in new window, which are set up like virtual board games and entice student participants with real-life prizes.
“It’s all part of promoting engagement with security rather than beating people with a stick,” Sasse says.
Now go change your passwords.
