Increasing Cybersecurity Through Emotional Engagement

Cyberpsychology, Behavior, and Social NetworkingVol. 24, No. 9 EditorialFree AccessIncreasing Cybersecurity Through Emotional EngagementBrenda K. WiederholdBrenda K. WiederholdBrenda K. Wiederhold, Editor-in-Chief Search for more papers by this authorPublished Online:15 Sep 2021https://doi.org/10.1089/cyber.2021.29224.editorialAboutSectionsPDF/EPUB ToolsAdd to favoritesDownload CitationsTrack CitationsPermissions Back To Publication ShareShare onFacebookTwitterLinked InRedditEmail According to the National Initiative for Cybersecurity Careers and Studies, cybersecurity is defined as “the activity or process, ability, or capability or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorised use or modification, or exploitation.”1 In other words, cybersecurity is the measures we take to protect our technology, and thus our information, against theft and misuse. While cybersecurity today is about so much more than putting a sticky note over your laptop's camera when not in use, who has the time or energy to put into keeping personal and corporate information private? Well, we all should.The past year has seen a sharp increase in cybercrime, especially a form of cyberattacks—ransomware—in which hackers use malicious software to scramble and steal an organization's computer data. The FBI found that nearly 2,400 U.S. companies, local governments, health-care facilities, and schools were victims of ransomware attacks in the last year, and global Ransomware Task Force researchers confirmed that hundreds of major attacks took place around the world in that same time period, including incidents in the United Kingdom, Brazil, Germany, South Africa, India, Saudi Arabia, and Australia.2 Health-care organizations especially have been targeted by cyberattacks recently as cybercriminals take advantage of the COVID-19 pandemic to disrupt operations at hospitals globally.Yet, destabilization is not the only consequence of cybercrime. The financial fallout can be just as disastrous to individuals, companies, and even entire economies. Cybersecurity company Emsisoft estimates that the true global cost of ransomware attacks alone, including business interruption and ransom payments in 2020, was a minimum of $42bn and a maximum of nearly $170bn.3 The wide range here is due to the fact that cybercrime attacks, and in turn their consequences, are underreported due to corporations aiming to preserve their reputations and individuals feeling shame for falling victim to these crimes.Though much attention is paid to the exorbitant organizational and financial costs of cybercrime, the true impact goes beyond these measures. Researchers have found that cybercrime victims often experience symptoms similar to those of post-traumatic stress disorder, and there is also a high risk of secondary victimization among people close to victims.4 In short, victims of cybercrime experience much the same psychological fallout as victims of other crimes. Though the attacks may be virtual, their consequences are very real.Cybercrime is based on capitalizing on human weaknesses much more than technological ones. People are often not presented with enough information to make appropriate decisions when faced with privacy sensitive situations. Whether it is seeking immediate gratification, operating under the influence of optimism bias, falling victim to hyperbolic discounting, or assigning lower risk to privacy decisions, human error is responsible for the ultimate success of most cyberattacks.4 How we as humans interpret and prepare for threats is far more important than demographics such as our age or gender. How we think is the key to enhancing cybersecurity.While some victims are vulnerable due to lack of information or reasoning, there are other reasons too that we may fall victim to cybercrime. One in particular is that people are desensitized to the threat. Many people have simply given up on protecting themselves because they feel that a security breach is inevitable. And perhaps it is. When it comes to cyberattacks, cybersecurity professionals have gone from having to convince people “It's not if but when” to “It's not when but how often.”5 Cybercrime has become so ubiquitous that it is no longer about persuading the general public that the threat is real. It's about getting each person to act to do something about it.So, what can we—as individuals or as corporations—do to protect ourselves from the imminent threat of a security breach? One popular option is to invest in outside technology. In fact, worldwide spending on security-related services is expected to reach $150 billion in 2021—up 12% from a year ago.6 Though recent global cyberattacks have taken down operations and caused incredible financial losses for many, cybersecurity startups have found themselves flourishing. The money is particularly flooding into businesses that aim to take on hackers in innovative ways. So far this year, investors have funneled more than $12.2 billion into start-ups featuring security products and services such as cloud security, identity verification, and privacy protection. This tops the $10.4 billion invested in similar enterprises in all of 2020, and more than doubles the amount raised in 2016.6Of course, we can't all invest billions in startups. Instead, we need to sensitize ourselves effectively to risky situations and educate ourselves about methods of protection. The ability to do this lies in making cybersecurity training a palatable or even an enjoyable experience. We all know that most people will snooze through presentations or click through online modules, doing the bare minimum to receive credit for participating. Motivating people to take an active role in protecting their information is much more effective with participant buy-in, and this can be achieved by engaging them emotionally with the help of gamification and the use of engaging immersive technologies such as virtual reality (VR) and augmented reality (AR).7Making cybersecurity training experiential, immersive, and more realistic could help with improved emotional engagement, and by combining these with newer artificial intelligence technologies, it will be possible to personalize instruction further. This type of training can be available anytime anywhere for refresher courses or on-the-go learning.I would be remiss if I did not take a moment to acknowledge that advanced technologies such as AR and VR are also the frontier of cybersecurity needs. If these technologies will soon be fully integrated into our daily lives, we need to consider how to protect our information when using them. When people create accounts and use Web sites, they are often prompted to opt in and give permission for the company's uses of their personal data. To an extent, this is also true for desktop and mobile applications, though the opt-ins may not be quite as obvious, as they are typically wrapped in with downloading the app in the first place. But, with the desire for seamless integration, VR/AR is different, which is why the policies that surround them must advocate appropriate protections.In today's increasingly online world, cybercrime has never been so prevalent, making cybersecurity vital for protecting ourselves and our information online. Unfortunately, it is precisely cybercrime's pervasiveness that has led to desensitization and a sense of futility in a vast majority of the population. Because human error is the leading contributor to successful security breaches, it is essential that we reverse this trend. Upping emotional engagement, by using tools such as AR and VR, is the key to doing so.References1. Cybersecurity Glossary. National Initiative for Cybersecurity Careers and Studies. https://niccs.cisa.gov/about-niccs/cybersecurity-glossary#C (accessed Aug. 4, 2021). Google Scholar2. Tidy J. (2021) The ransomware surge ruining lives. https://www.bbc.com/news/technology-56933733 (accessed Aug. 4, 2021). Google Scholar3. Emsisoft Blog (2020) Report: the cost of ransomware in 2020. A country-by-country analysis. https://blog.emsisoft.com/en/35583/report-the-cost-of-ransomware-in-2020-a-country-by-country-analysis/ (accessed Aug. 4, 2021). Google Scholar4. Wiederhold BK. The role of psychology in enhancing cybersecurity. Cyberpsychology, Behavior, & Social Networking 2014; 17:131–132. Link, Google Scholar5. La Huis T, Salihoglu M. (2019) The psychology of cybersecurity. https://www.crowe.com/cybersecurity-watch/psychology-of-cybersecurity (accessed Aug. 4, 2021). Google Scholar6. Woo E. (2021) As cyberattacks surge, security start-ups reap the rewards. https://www.nytimes.com/2021/07/26/technology/cyberattacks-security-investors.html (accessed Aug. 4, 2021). Google Scholar7. Mystakidis S, Berki E, Valtanen J. (2017) Toward successfully integrating mini learning games into social virtual reality environments—recommendations for improving open and distance learning. EDULEARN17 9th International Conference on Education and New Learning Technologies, Barcelona, Spain, July 3–5, 2017, pp. 968–977. Google ScholarFiguresReferencesRelatedDetails Volume 24Issue 9Sep 2021 InformationCopyright 2021, Mary Ann Liebert, Inc., publishersTo cite this article:Brenda K. Wiederhold.Cyberpsychology, Behavior, and Social Networking.Sep 2021.579-580.http://doi.org/10.1089/cyber.2021.29224.editorialPublished in Volume: 24 Issue 9: September 15, 2021Online Ahead of Print:September 2, 2021PDF download