Behavioral change and one (of many) techniques to achieve it

About behavior change

We often hear about “user awareness“, but what is it really?Much has already been said about users being the weakest link in an organization. This is the case when these users have not gone through a proper awareness process. Awareness means including the users of an organization in its security strategy, and achieving a change in their behavior through the development of secure habits.

In this way, the user becomes an ally for the organization’s information security and a new and very important layer of security is developed for the organization.In any case, many times an Awareness plan is undertaken only to comply with an organization’s internal policy or standard, so that the plans (and the investment to carry them out) become a check mark on an auditor’s checklist and a false appearance of security.

This approach of raising awareness only to comply is due to the fact that the techniques and tools used to carry out Awareness plans are not usually the appropriate ones. This generates a prejudice around the change of habits in end users, where it is believed that it is either very difficult to achieve, or even impossible. So, “the best thing to do” is to educate to comply, and try to patch the big security hole that remains with technological controls that, although they do their best, do not manage to stop all attacks directed at users.

In short: Awareness is important, as the user is continuously targeted by cybercriminals, and technological solutions alone are not enough to stop them. And very important: Awareness is possible.

That said, let’s take a look at one of the techniques (of many) that we should have in our portfolio when it comes to successfully changing the behavior of our organization’s users: Positive Reinforcement.

note: if you are thinking that raising awareness (for real, not just for compliance) is a process that requires a lot of techniques, tools and methodologies, you are right. But luckily for you, there are platforms that integrate best practices to make it a simple and effective task.

Correct with green pen

Positive reinforcement is a different way of approaching a process of habit change. Most of the time, during the teaching, the person in charge of the teaching focuses on highlighting mistakes, with the objective that these are recognized and avoided. This is also the case in most computer-assisted training.

If we put ourselves in the place of any person in our organization, with all the tasks, obligations and stress of the day, the last thing he or she will want is to be continually reminded of everything he or she does wrong, and the least he or she will want to redo a training session in which he or she did not achieve a certain grade, or get “stuck” for not finding the right solution .

This is where Positive Reinforcement comes into play. This technique consists of focusing attention on the positive and not just highlighting mistakes. It has its origin in Psychology, as it could not be otherwise, specifically in “Reinforcement”.

Reinforcement: procedure by which the application of a stimulus (called a reinforcer) increases the probability that a behavior will be repeated in the future.

Positive Reinforcement then takes place when a response is followed by a reward or any other positive event, and increases the likelihood that it will occur again.

This change of approach brings with it a multitude of advantages:

Strengthens knowledge

Contributes to consolidate what is good or correct and to discard what is negative or incorrect.

Stimulates effort

By feeling that something he/she has done correctly is recognized, the person will value it and will feel more predisposed to continue with his/her training.

Encourages receptivity

If we limit ourselves to criticizing and highlighting failures, the person will end up losing interest and abandon the training. If it is compulsory, he will do it by force, but without assimilating any learning. On the other hand, by including positive comments and pointing out what he does well, we will help the person to be more receptive and assimilate the right path much better.

Motivates and creates behaviors

Through the recognition of their successes we offer the person a stimulus, we awaken their desire to act correctly and do things well.

The method of positive reinforcement will contribute to motivate the person in search of a prize or approval for his successes, but it will also create a behavior, a habit that will become part of his personality.

When a person is already under the control of positive reinforcement, he tends to act without a previous or antecedent motive or cause. Thus, he will perform the induced behaviors with “freedom”. And when there is a sense of freedom, there is no apparent control, which is positive because when there is control people get upset, try to run away, complain, complain, and exercise rebellion.

Improves self-esteem

We help the person to detect their strengths and improve their self-esteem, avoid discouragement and frustration and contribute to building a real and positive self-image. In addition, we ensure that the person has a good time during the training and their predisposition to this type of awareness campaigns is positive.

Conclusion

When developing a methodology to carry out an Awareness Plan, let’s take into account the concept of Positive Reinforcement. If we are going to use a tool to carry it out, then let’s select one that takes this concept into account.
This will be one of several elements that will help us create a real behavioral change in the users of our organization and consequently a very important layer of security for it. And, not least, it will make the security area be seen with friendly eyes, as an ally willing to help users and recognize their successes in a good way.

Behavioral change and one (of many) techniques to achieve it