Hacking the Human: The Prevalence Paradox in Cybersecurity. (August 2018)

• Record Type: Journal Article
• Authors: Sawyer, Ben D.; Hancock, Peter A.
• Is Part Of: Human factors. Volume 60:Number 5(2018)
• Page Start: 597
• Page End: 609
• Publication Date: 2018-08
• Subjects: human-computer interaction -- internet -- information security -- messages -- signal detection -- vigilance -- risk -- antivirus -- virus -- antimalware -- malware -- design; Human engineering -- Periodicals; 620.82
• DOI: 10.1177/0018720818780472
• Languages: English
• ISSNs: 0018-7208

Abstract

Objective: This work assesses the efficacy of the "prevalence effect" as a form of cyberattack in human-automation teaming, using an email task. Background: Under the prevalence effect, rare signals are more difficult to detect, even when taking into account their proportionally low occurrence. This decline represents diminished human capability to both detect and respond. As signal probability (SP) approaches zero, accuracy exhibits logarithmic decay. Cybersecurity, a context in which the environment is entirely artificial, provides an opportunity to manufacture conditions enhancing or degrading human performance, such as prevalence effects. Email cybersecurity prevalence effects have not previously been demonstrated, nor intentionally manipulated. Method: The Email Testbed (ET) provides a simulation of a clerical email work involving messages containing sensitive personal information. Using the ET, participants were presented with 300 email interactions and received cyberattacks at rates of either 1%, 5%, or 20%. Results: Results demonstrated the existence and power of prevalence effects in email cybersecurity. Attacks delivered at a rate of 1% were significantly more likely to succeed, and the overall pattern of accuracy across declining SP exhibited logarithmic decay. Application: These findings suggest a "prevalence paradox" within human-machine teams. As automation reduces attack SP, the human operator becomes increasingly likely to fail in detecting and reporting attacks that remain. In the cyber realm, the potential to artificially inflict this state on adversaries, hacking the human operator rather than algorithmic defense, is considered. Specific and general information security design countermeasures are offered.