The psychology of security: Why we make mistakes
summary
Human “error” results from attention limits, pressure, context and satisficing rather than malice: a benign cover-design site installs malware and attention on the design hides risk. Recommended fixes are concrete: create psychological safety and share go‑wrong stories and near‑misses, pair on risky tasks and run whole‑team threat modelling, change defaults so the secure choice is obvious and make dangerous actions harder. Organisations that keep security confined to a team detect breaches slowly (often cited ~200 days), so spread ownership and practice plans.
AI-written summary · about
chapters (27)
- 0:00Intro
- 3:01When was the last time you made a mistake?
- 4:37Did this change my behaviour?
- 5:02Behaviour changes after being involved in an incident
- 5:20Why did it happen? What do you think?
- 8:38Common mistake is accidental oversharing of information Email, development tools...
- 10:40Pressure affects our memory, decisions, senses and ability to act
- 13:00We deal with complexity by satisficing We don't take perfect actions, we take the first, good enough action
- 16:08Didn't know 2. Focussed on the main task, not on the consequences. Our brains just don't see everything 3. Pressure (time, knowledge, task) complexity 4. The context is complex 5. The perception of risk was low. The risk wasn't visible.
- 17:071. Create the right team culture
- 17:26Be careful using fear as a motivator Scary stories get attention, but can lead to inaction
- 18:32Listen to the small stuff
- 18:51Solve things together
- 20:01Have a diverse team
- 20:18Make it a natural part of everyone's role
- 20:48Co-design the solutions to try
- 21:14Don't assume something will work
- 21:41Remove pressure where you can so you can work in ways that supports your brain
- 22:03Pair on most tasks
- 22:54Take a moment
- 23:28Plan when things are calm When they go wrong, follow the plan
- 24:01Design for the danger
- 24:13Work together to make the risks visible
- 24:23Make the most dangerous action, the most difficult
- 24:56Make the most secure action, the easy action Usability matters
- 25:20Make it more dangerous to make it safer The safety paradox
- 26:27Mistakes' are part of being human. Expect them, learn from them and design for them.
related talks
53mOptimistic Security
28mSecurity Through Design - Making Security Better By Designing for People
40mThrough Your Mind’s Eye: What Biases Are Impacting Your Security Posture?
48mHow to build a security mindset
40mOptimistic Security
42mImperfect Security: Doing Less to Achieve Better Security
48mLevel Up Your Security Mindset
50mYou’re Doing It Wrong! Common Security Anti Patterns