Shame in Cyber Security: Effective Behavior Modification Tool or Counterproductive Foil?

Renaud, K., Searle, R. and Dupuis, M. (2021) Shame in Cyber Security: Effective Behavior Modification Tool or Counterproductive Foil? In: New Security Paradigms Workshop (NSPW '21), 26-28 Oct 2021, pp. 70-87. ISBN 9781450385732 (doi: 10.1145/3498891.3498896)

Abstract

Organizations often respond to cyber security breaches by blaming and shaming the employees who were involved. There is an intuitive natural justice to using such strategies in the belief that the need to avoid repeated shaming occurrences will encourage them to exercise more care. However, psychology highlights significant short- and long-term impacts and harmful consequences of felt shame. To explore and investigate this in the cyber domain, we asked those who had inadvertently triggered an adverse cyber security incident to tell us about their responses and to recount the emotions they experienced when this occurred. We also examined the impact of the organization’s management of the incident on the “culprit’s” future behaviors and attitudes. We discovered that those who had caused a cyber security incident often felt guilt and shame, and their employers’ responses either exacerbated or ameliorated these negative emotions. In the case of the former, there were enduring unfavorable consequences, both in terms of employee well-being and damaged relationships. We conclude with a set of recommendations for employers, in terms of responding to adverse cyber security incidents. The aim is to ensure that negative emotions, such as shame, do not make the incident much more damaging than it needs to be.

• Item Type: Conference Proceedings
• Status: Published
• Refereed: Yes
• Glasgow Author(s) Enlighten ID: Renaud, Professor Karen and Searle, Professor Rosalind
• Authors: Renaud, K., Searle, R., and Dupuis, M.
• College/School: College of Science and Engineering > School of Computing Science; College of Social Sciences > Adam Smith Business School > Management
• Journal Name: New Security Paradigms Workshop
• Publisher: ACM
• ISBN: 9781450385732
• Published Online: 27 December 2021
• Copyright Holders: Copyright © 2021 Association for Computing Machinery
• First Published: First published in New Security Paradigms Workshop (NSPW '21): 70-87
• Publisher Policy: Reproduced in accordance with the publisher copyright policy

Related URLs

• Organisation