Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and...
Transcript of Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and...
![Page 1: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/1.jpg)
SESSION ID:
#RSAC
Bikash Barai
Using Behavioral Psychology and Science of Habit to Change User Behavior
HUM-F03
Co-founder (Cigital India)@bikashbarai1
![Page 2: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/2.jpg)
#RSAC
Is Awareness Enough To Change Human Behavior?
2
![Page 3: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/3.jpg)
#RSAC
3
Credit: Abd Allah Foteih
![Page 4: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/4.jpg)
#RSAC
Awareness vs Change Of Behavior
4
Example: Continued security training beyond the baseline are unlikely to be effective -“Modifying Smartphone User Locking Behavior” – by Dirk et al (ACM – 2013)
Awareness
Ch
ange
in B
eh
avio
r
![Page 5: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/5.jpg)
#RSAC
What Else Do We Need?
5
![Page 6: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/6.jpg)
#RSAC
The Mystery of Eugene Pauly’s Brain ..
6
Dr. Lary R. SquireUniversity of California, San Diego
Image Source: http://whoville.ucsd.edu/about.html
![Page 7: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/7.jpg)
#RSAC
Goal Directed System (Pre-Frontal Cortex)
Responsible for new or infrequent behaviors
Guided by attitudes, goals, values, knowledge
Conscious and deliberate
Slow
Habit System (Basal Ganglia)
Very fast. Does not require thought or attention
Less conscious. More automatic
Goal Directed and Habit System
7
Credit: Neal et al – The Science of Habit…
![Page 8: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/8.jpg)
#RSAC
40% of our daily actions are driven without thinking
Examples of Habits in action
Changing gears
Getting out of elevator in wrong floor
Tying Shoe knots
Bad habits in action
Checking phone/blackberry during the middle of sleep
Clicking phishing links
Writing down passwords in open
Habits in Action..
8
![Page 9: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/9.jpg)
#RSAC
How To Build A New Habit?
9
![Page 10: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/10.jpg)
#RSAC
Story of Pepsodent ..
10
https://upload.wikimedia.org/wikipedia/en/8/88/Pepsodent-0179c.jpg
![Page 11: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/11.jpg)
#RSAC
Trigger – Routine – Reward ( & Craving )
11
Trigger:
Feel Tooth Film with tongue
Routine:Brushing Teeth
Reward:Great Smile
Crave for Tingling
Image Credit: Seth LemmonsImage Credit: Wikipediahttps://i.ytimg.com/vi/rf1Bs2XpwFI/maxresdefault.jpg
![Page 12: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/12.jpg)
#RSAC
Step 1: Find a Predictable and Recurring Trigger
Step 2: Devise the new Routine/Habit
Step 3: Find the Reward
Practice, Practice, Practice without exceptions
Steps for Building New Habits
12
![Page 13: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/13.jpg)
#RSAC
How To Change A Habit?
13
![Page 14: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/14.jpg)
#RSAC
14
Old Habits
Never Die
![Page 15: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/15.jpg)
#RSAC
Example – Changing A Habit
15
Trigger: Boredom
Routine:Have a Whisky
Reward:Feel Happy
Image Credit: Wiki
![Page 16: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/16.jpg)
#RSAC
Example – Changing A Habit
16
Trigger: Boredom
New Routine:Talk to a friend
Reward:Feel Happy
Image Credit: Wiki
![Page 17: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/17.jpg)
#RSAC
3 Steps for Changing Old Habits
Identify and Deconstruct the Habit
Find the Trigger
Find the “real hidden reward” – Experiment to discover
Find the Trigger-Routine-Reward-Craving model
Find an alternative routine to satisfy the “real hidden reward”
Practice. Practice. Practice.
![Page 18: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/18.jpg)
#RSAC
“Hard Thing” about “Easy Things”..
18
![Page 19: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/19.jpg)
#RSAC
Understanding Buffer Overflow - Easy
19
Finding A vulnerability - HardWriting A “Reliable” Exploit- Very Hard
![Page 20: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/20.jpg)
#RSAC
Coke, McDonalds campaigns..
What is hard about it?
Finding a “Reliable” trigger and reward
Creating craving and making it stick
Hard or Easy?
20
![Page 21: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/21.jpg)
#RSAC
Applying The Science Of Habit
21
In Information Security & Life..
![Page 22: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/22.jpg)
#RSACExample 1: Create Habit of Locking Computer Screen..
Goal: Locking system while leaving desk
Trigger – Getting up from chair/Leaving the system
Routine – Lock your computer
Reward – Feeling of security
Rehearse or Repeat at least 20 times
If you forget then go back to seat and repeat the routine
![Page 23: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/23.jpg)
#RSACExample 2: Change the Habit of Writing Down Password in Open Areas
Goal: Stop the habit of writing down password areas
Trigger – New password setting request
Old Routine – write down the password
New Routine – “write down the clue” or “Use a Scheme to generate new passwords”
Reward – Feeling of security
Rehearse or Repeat
![Page 24: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/24.jpg)
#RSAC
Example 3: Preventing Phishing
Old Habit
Trigger: Legitimate entity asks for personal details
Routine: Share the details
New Desired Habit
Trigger: Legitimate entity asks for personal details
New Routine: Validate the legitimacy of the entity
Practice. Practice. Practice
24
![Page 25: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/25.jpg)
#RSAC
Example 4: Create Secure Coding Behavior
Goal – Ensuring coders use secure coding functions
Trigger – Typing a function
Old Routine – Type insecure function
New Routine – Use intervention method to prompt secure function
Enough practice
Automatic use of secure function
![Page 26: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/26.jpg)
#RSAC
Habits in Day to Day Life..
Playing/Exercise everyday
Controlling anger outbursts..
![Page 27: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/27.jpg)
#RSAC
Driving organizational change
27
![Page 28: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/28.jpg)
#RSAC
7 Learning for Driving Organizational Change
Augment Awareness with a Habit Strategy
Utilize “Keystone Habit”
Certainty of negative incentive and not Severity has high impact
Group sharing has positive impact
Reduce friction or Create friction based on goals
Leverage a disaster
Start with a why
![Page 29: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/29.jpg)
#RSAC
Current State of Research
29
![Page 30: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/30.jpg)
#RSAC
Research on Habits and Beyond..
Research on Habits
Significant studies in the field of psychology, marketing, sports etc
Little or No research in areas related to IT security
30
![Page 31: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/31.jpg)
#RSAC
References and Other Studies ..
Balleine et al – Goal directed instrumental action: contingency and incentive learning and their cortical substrates
Kahneman – Thinking fast and slow
Duhigg- The power of habit
Neal et al – The pull of the past when do habits persist despite conflict with motives?
Rothman et al- Reflective and automotive processes in the initiation and maintenance of dietary change
Sheeran et al – Implementation intentions and repeated behavior..
Wood et al – A new look at habits and habit- goal interface
Wood et al- The habitual consumer
Wood et al- Habits in everyday life: thought emotion and action
31
![Page 32: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/32.jpg)
#RSAC
Apply What You Learned..
32
![Page 33: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/33.jpg)
#RSAC
Apply What You Learned
Next Week
Choose 1 habit that you want to change or build
Identify a small group for experiment
Experiment
First 3 months
Find the most important habits to change in your organization
Create an organization wide plan for habit change drills
Make people practice at least 20 to 30 times in a short time frame. (Group activities, Simulation exercise, Wargames etc)
Measure the success of the program
![Page 34: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/34.jpg)
#RSAC
After 6 months
Assess the success of the program based on the metrics defined
Reassess the risky and secure behavior and create a new program
34
![Page 35: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/35.jpg)
#RSAC
Awareness Is Not Enough
35
Invest In Forming Lasting Habits
![Page 36: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/36.jpg)
#RSAC
Practice Does Not Make Perfect
36
“Perfect Practice” Makes Perfect
![Page 37: Using Behavioral Psychology and Science of Habit to · PDF fileUsing Behavioral Psychology and Science of Habit to Change User Behavior HUM-F03 Co-founder (Cigital India) @bikashbarai1.](https://reader031.fdocuments.us/reader031/viewer/2022030509/5ab967037f8b9ad13d8da507/html5/thumbnails/37.jpg)
#RSAC
Want To Engineer A Habit?
37
Let’s Meet At The Bar ..