Shame in Cyber Security: Effective Behavior Modification Tool or Counterproductive Foil?

Renaud, K., Searle, R. and Dupuis, M. (2021) Shame in Cyber Security: Effective Behavior Modification Tool or Counterproductive Foil? In: New Security Paradigms Workshop (NSPW '21), 26-28 Oct 2021, pp. 70-87. ISBN 9781450385732 (doi: 10.1145/3498891.3498896)

[img] Text
262034.pdf - Accepted Version



Organizations often respond to cyber security breaches by blaming and shaming the employees who were involved. There is an intuitive natural justice to using such strategies in the belief that the need to avoid repeated shaming occurrences will encourage them to exercise more care. However, psychology highlights significant short- and long-term impacts and harmful consequences of felt shame. To explore and investigate this in the cyber domain, we asked those who had inadvertently triggered an adverse cyber security incident to tell us about their responses and to recount the emotions they experienced when this occurred. We also examined the impact of the organization’s management of the incident on the “culprit’s” future behaviors and attitudes. We discovered that those who had caused a cyber security incident often felt guilt and shame, and their employers’ responses either exacerbated or ameliorated these negative emotions. In the case of the former, there were enduring unfavorable consequences, both in terms of employee well-being and damaged relationships. We conclude with a set of recommendations for employers, in terms of responding to adverse cyber security incidents. The aim is to ensure that negative emotions, such as shame, do not make the incident much more damaging than it needs to be.

Item Type:Conference Proceedings
Glasgow Author(s) Enlighten ID:Renaud, Professor Karen and Searle, Professor Rosalind
Authors: Renaud, K., Searle, R., and Dupuis, M.
College/School:College of Science and Engineering > School of Computing Science
College of Social Sciences > Adam Smith Business School > Management
Journal Name:New Security Paradigms Workshop
Published Online:27 December 2021
Copyright Holders:Copyright © 2021 Association for Computing Machinery
First Published:First published in New Security Paradigms Workshop (NSPW '21): 70-87
Publisher Policy:Reproduced in accordance with the publisher copyright policy
Related URLs:

University Staff: Request a correction | Enlighten Editors: Update this record