The Weakest Link: A Psychological Perspective on Why Users Make Poor Security Decisions

Abstract

The goal of this chapter is to raise awareness of cognitive and human factors issues that influence user behavior when interacting with systems and making decisions with security consequences. This chapter is organized around case studies of computer security incidents and known threats. For each case study, we provide an analysis of the human factors involved based on a system model approach composed of three parts: the user, the technology, and the environment. Each analysis discusses how the user interacted with the technology within the context of the environment to actively contribute to the incident. Using this approach, we introduce key concepts from human factors research and discuss them within the context of computer security. With a fundamental understanding of the causes that lead users to make poor security decisions and take risky actions, we hope designers of security systems are better equipped to mitigate those risks.