Getting Permission To Use HaveIBeenPwned From Your Legal Dept
The landing gear light indicated a problem. The captain, first officer and flight engineer of Eastern Air Lines Flight 401 tried to figure out what was wrong. They removed the light assembly and the flight engineer left his position to go to the avionics bay and investigate. They were so preoccupied with a burnt out light bulb that they didn’t notice the altitude alarm which started sounding at the flight engineer’s workstation. The autopilot had been accidentally disengaged and the Lockheed Tristar hit the ground at 229 miles an hour near Miami International Airport. The crash in December 1972 was one of the worst in US aviation history.
Pilots are trained to perform tasks concurrently but the problem of highly experienced aircrews suffering accidents caused by a preoccupation with a single issue has been noted since the Second World War. Ergonomics pioneers such as Alphonse Chapanis showed that training alone was not enough and that even the most experienced pilots could and would fail due to environmental factors. The attachment of a wheel to landing controls and a triangle to flaps controls to allow them to be easily distinguished by touch alone is part of Alphonse’s legacy that is still used in cockpits today.
Driver safety is another area where distractions are a significant cause of accidents. Some distractions such as phoning or texting while driving are well known. Other distractions such as overloading the driver with street signage are only just starting to be appreciated. New signage has been introduced without reference to existing signage. The result is too much information for a driver to absorb and a reduction in competency for the core task being performed. In effect, the signage is a distraction that prevents drivers from focusing on the risks in front of them. For example, signage saying watch out for the zebra crossing may reduce the level of attention paid to the actual zebra crossing. Shared Space is a new approach to urban street design that seeks to reduce instructional inputs to drivers by removing street signs, road markings and distinctions for pedestrian space. Paradoxically, drivers tend to respond by increasing their situational awareness and reducing their speed due to a sense of uncertainty over their right of way. Basically, they can’t drive by autopilot and are forced to concentrate.
There is a very real possibility that users of computing systems are also suffering from information overload when it comes to warnings and advice. What could we learn from aircraft safety and driver education? Firstly, the best way to help computer users might be to simplify and reduce the number of risk warnings. This seems counterintuitive since our mission as security educators is taken by some to mean communicating as much advice to as many as possible. However, the sheer number of advisories makes it difficult to differentiate between the peripheral (the burnt out light bulb) and the critical (the rate of descent). The vast majority of public safety messages are mono-thematic and rarely try to influence more than one behavioural response at a time. Public safety messages tend to run longer than information security messages which are usually rotated on a monthly basis. Is it possible that 12 security messages a year is too much? Why are security messages changed every month? Who decided that a lunar cycle was the optimal way to influence behavioural compliance?
Secondly, advice needs to take into account existing sensory inputs. What other advice have people been given and how does it relate? How are people going to contextualise the new advice? What tasks are people trying to achieve and how does the advice relate to those tasks? If the addition of more advice is going to cause sensory overload then it’s definitely time to simplify.
To succeed in behavioural compliance we need to keep things simple and focus our efforts rather than dissipate them according to an arbitrary schedule. In business, we usually try to do more with less. Maybe to be successful in the information security awareness field we need to do less with more.
Related posts
