The Next Threat To Cybersecurity: Consumer Fatigue

"Security fatigue" is emerging as a dangerous threat to effective cybersecurity programs. A new study by National Institute of Standards and Technology (NIST) found that the well-intended drumbeat of cyber security alerts and warnings has led to burnout and a sense of fatalism among ordinary people, including the employees that firms look to as their first line of cyber defense.

Businesses need to take affirmative steps to ensure that a culture of cyber security weariness in our society does not lead to cyber security sloppiness on the job.

Cybercrime gambits like phishing, spear phishing, business email compromise and social engineering all rely on innocent but unwary employees being led to do the cyber criminal's dirty work. For this reason, cyber security experts recognize that the greatest vulnerability in most organizations comes from their own people.

The new NIST research shows that limiting employee-based vulnerabilities may be more difficult than anticipated precisely because cyber vulnerabilities are receiving such a high level of attention. "We weren't even looking for fatigue in our interviews, but we got this overwhelming feeling of weariness throughout all of the data," said study co-author Mary Theofanos.

Effective employee cyber security awareness programs must overcome apathy, motivate changed behavior, and generate clarity out of a barrage of confusing messages...