# Getting Rid of the Usability/Security Trade-Off: A Behavioral Approach
## 5 Discussion and Conclusions  
The central point of our reflection is that security systems based on the token economy could be implemented by reinforcing secure behaviors, that is, offering usability as a back-up reinforcement for secure behaviors. In practice, this would be a behavior-based security model that exploits the usability/security trade-off instead of reducing the gap between these two needs, an attempt that thus far has not been satisfactorily achieved. The users would not be merely encouraged to adopt secure behaviors but reinforced for having put them in place. In this case, it is important to remember that a system needs to verify the user's credentials too often during an interaction cannot be defined as very usable. On the other hand, the redundancy of security measures is considered necessary to prevent unaware users from making mistakes. However, a user who provides continued evidence of awareness may \"score points\" and achieve a \"pro\" user status, and it may be possible to eliminate some restrictions to ensure greater usability. Would having access  
Figure 1: Performance of a subject discriminating between suspicious and non-suspicious email with (days 4 to 6) and without (days 1 to 3 and 7 to 9) reinforcement. to greater usability improve safety behaviors? No activity can be defined as reinforcing a priori; only the observation of its effects on behaviors can tell us if it is a reinforcer. Therefore, it is essential to test this hypothesis by imagining a research agenda that includes specific experimental activities to answer the following questions:  
* Will a reduction in the complexity of the interaction represent a reinforcer for the emission of secure behaviors? The answer to this question is not obvious; the reinforcing stimulus is not based on its intrinsic properties but on the modification of the future probability of emitting the behavior. Therefore, it can be defined only post hoc, based on the effect that the consequence has on the behavior. * Will the implementation of a token economy system be effective in achieving an increase in secure behavior, in the context of cybersecurity, where the individual's task is to detect suspicious activity during the normal use of technology? The token economy has been used successfully in several fields. There is no reason to rule out that it could show its beneficial effects in the cybersecurity context as well. Of course, this remains to be proven. * Will the possible beneficial effects of such a program be limited to obtaining tokens, or will they persist after a reinforcement program is completed? In educational contexts in which the token economy has been largely employed, the goal is the generalization of learned behaviors. It is critical to assess whether exposure to a reinforcement program needs follow-up activities to generalize safe behaviors. * What is the most effective reinforcement schedule to achieve immediate and long-lasting effects? Reinforcement schedules can be based on the amount of behavior produced or the interval required to achieve reinforcement. In addition, they can be fixed or variable. It would be unnecessarily complicated to deepen reinforcement schedules, but it is useful to point out that each type of schedule produces specific effects independently of the organism, the behavior, and the type of reinforcement. * Will response cost (i.e., punishing insecure behavior) add anything? Reinforcement is a very powerful mechanism, much more than punishment, but the combination of these two strategies is plausible for several practical reasons; encouraging safe driving does not detract from the need to impose fines on those who violate traffic laws. These questions are just a first set that is essential to answer, but many more could be formulated as knowledge in this area advances. Once the regularities in user behavior have been defined, the next step should be to move away from laboratory research to implement intervention strategies on real platforms.