{"id":7439,"date":"2017-04-25T07:10:23","date_gmt":"2017-04-25T15:10:23","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/04\/25\/news-1230\/"},"modified":"2017-04-25T07:10:23","modified_gmt":"2017-04-25T15:10:23","slug":"news-1230","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/04\/25\/news-1230\/","title":{"rendered":"How to fight security fatigue"},"content":{"rendered":"

Credit to Author: Wendy Zamora| Date: Tue, 25 Apr 2017 14:00:55 +0000<\/strong><\/p>\n

We live in the age of the 24-hour news cycle. Each day, whether it\u2019s from TV news, phone notifications, online browsing, social media, or even the good old fashioned paper, we hear stories of the increasing dangers of cybercrime.<\/p>\n

Cyberthreats are growing more serious!<\/a><\/p>\n

Russian hacker starts his own ransomware service!<\/a><\/p>\n

Experts say tech support scams are picking up!<\/a><\/p>\n

Feeling overwhelmed yet? You\u2019re not alone. A recent study published by the National Institute of Standards in Technology (NIST) says that \u201csecurity fatigue\u201d is a real phenomenon affecting 63 percent of its participants. So what, exactly, is security fatigue? And why is it a dangerous, though understandable, phenomenon?<\/p>\n

What is security fatigue?<\/strong><\/h3>\n

Over and over again, people are bombarded with articles about criminals lurking on the Internet, security breaches in businesses and government, and the need to be constantly vigilant online. Our Malwarebytes researchers are asked by the press to comment on their discoveries of new forms of malware or the latest security breach on a nearly daily basis. And while the media are reporting on legitimate dangers, their fever pitch can leave readers and viewers frozen in a combined state of panic and helplessness.<\/p>\n

Users are encouraged to update passwords constantly, run antivirus programs, participate in two-factor authentication, read unwieldly EULAs carefully\u2014often without a clear understanding of why. According to the NIST report:<\/p>\n

\u201cPeople are told they need to be constantly on alert, constantly \u2018doing something,\u2019 but they are not even sure what that something is or what might happen if they do or do not do it.\u201d<\/p>\n

The volume of messaging, combined with an unclear understanding of how to move forward, is what leads to security fatigue, which NIST researchers define as \u201ca threshold at which it simply becomes too hard or burdensome for users to maintain security.\u201d In plain English, people are hearing so much about cybersecurity now that they\u2019re becoming desensitized to the dangers and cybersecurity best practices.<\/p>\n

\n

\u201cI think I am desensitized to it\u2014I know bad things can happen. You get this warning that some virus is going to attack your computer, and you get a bunch of emails that say don\u2019t open any emails, blah, blah, blah. I think I don\u2019t pay any attention to those things anymore because it\u2019s in the past.\u201d<\/em> \u00a0\u2013Participant 101<\/p>\n<\/blockquote>\n

What happens when you\u2019ve got security fatigue?<\/strong><\/h3>\n

Security fatigue manifests itself in much the same way as what psychologists call decision fatigue<\/a>. People reach a limit with how much information they can process, leaving them weary and unable to make a rational decision moving forward. Security fatigue impacts decision-making in the following ways. People might:<\/p>\n