The Art of Security Procrastination
I've recently read an excellent book called "Predictably Irrational" by Dan Ariely.
The thoughts in the book resonated with some recent thoughts I had about how most of us approach security.
There is a view that most people wait until they are pwned before they start taking action to protect themselves.
The relevant quote from Oscar Wilde would be: "I never put off until tomorrow what I can do the day after."
Is it because they perceive the risk of a compromise as low e.g. "this is not going to happen to me"?
Can this be directly correlated with a general tendency to procrastinate that many people have?
One of the examples Dan provides is doing all the required health exams ahead of time to avoid issues in the future.
Most of us understand that health is important, and that prevention is better than cure, right?
Yet getting to a health check requires additional effort, getting up in the morning, fasting, and so forth, so we procrastinate.
One approach could be to make health exams mandatory across the state. According to Dan, this would make us more likely to come to tests.
However, this would also limit our freedom of choice; does not seem like a good thing.
Another approach he examines is agreeing to pay a doctor a deposit of $100 for a test, and getting a refund only if we show up for a test.
According to his experiments, this works much better, at least based on scenarios with MIT students, who tend to procrastinate otherwise.
Can we make people commit to regular security checks by having them make a deposit of say $100 refundable only if they started using, say, LastPass, or another password manager to generate and manage their passwords?
Of course, one can say that health is everything, and information security probably has less of a direct impact on our lives.
Well, come to think of it, we are at a point where we increasingly see that there can be more to a security compromise than just getting a shell or stealing credit card information. Stuxnet, anyone?
Anyway, all psychobabble aside, I think the gist of it is that pain avoidance is a much stronger motivator for most people than pleasure. Would you agree?