A new survey by KnowBe4 and ITWeb has found that South African IT and security professionals are under a great deal of stress, and that stressed, distracted employees are a major cyber security risk.
Anna Collard, SVP of content strategy and evangelist at KnowBe4 Africa said during a webinar this week that multi-tasking is a myth, and that people attempting to do so would inevitably become more vulnerable to social engineering attacks.
She said that she herself had fallen to a phishing mail simulation while she was distracted. “It’s not a lack of training that’s the issue here, because I have been trained. It was because I was distracted and multitasking.”
A quick survey of her colleagues had then revealed that 53% of her colleagues who failed their phishing tests had also been multitasking when they failed, which aligns with global trends.
Collard noted that according to VMware, 51% of cyber security and technology professionals say they have felt extremely stressed and burnt out in recent months.
Following this finding, the KnowBe4 / ITWeb Cyber Stress & Cyber Wellness survey set out to assess how a changing environment is impacting IT professionals and corporate workers in South Africa, and whether stress and burnout is increasing their cyber risk.
Nearly half of survey respondents (47%) said they were under ‘high’ or ‘very high’ levels of stress, while a poll of webinar participants found 80% had very high levels of stress. And 52% of respondents attributed security mistakes to a lack of training, while 37% pointed to distraction, multi-tasking and cognitive overload, and 7% cited stress or feeling overworked or overwhelmed.
The KnowBe4 / ITWeb Cyber Stress & Cyber Wellness survey set out to assess how a changing environment is impacting IT professionals and corporate workers in South Africa.
“It is difficult to not feel stressed in life today. The amount of information we are bombarded with is something like nine times what it was 40 years ago,” Collard said.
"Multi-tasking is a myth. When we switch between tasks quickly, we end up confusing activity with productivity and our brains use up energy and our capacity to make decisions, which has a negative impact on our stress levels and working memory. Multi-tasking and decision overload changes the way our brains work. As a result, we make errors.”
She said multi-tasking was also a recipe for dopamine addiction. “Dopamine likes it when you scratch things off your task list. You end up in a dopamine addiction feedback loop, resulting in uncontrolled multi-tasking. This results in mistakes and falling for social engineering attacks.
Multi-tasking and decision overload changes the way our brains work. As a result, we make errors.
Anna Collard, KnowBe4 Africa.
“The way the prefrontal cortex and limbic system work together is still how we used to act in the past. If you saw a lion in the savannah you had to respond fast. Today we have threats that are more psychological in nature, but the way we react to them is the same as people did in the past. The amygdala takes over critical thinking and we react impulsively, and sometimes make stupid decisions – like overreacting and clicking on an e-mail. Social engineers are aware of this and deliberately send mails that trigger fear or anger”, she said.
“Even on good days, we spend most of our time on system 1 or heuristic thinking, which is efficient and fast, but also leads us to jump to conclusions that aren’t always right,” she said.
“There aren’t patches for these vulnerabilities, but we need to be aware of them and help people manage them,” Collard said, adding that mindfulness techniques might improve human security vulnerabilities.
Mindfulness for focus
“Mindfulness can help reduce human error and improve sustained attention to tasks, and may also reduce susceptibility to social engineering,” she said. “In our survey, we asked people what they believed could help improve security culture. 71% said more security training, 53% said in-the-moment training, and 49% said offering people mindfulness tools and training to be less distracted, with 49% also saying behaviour-based monitoring and interventions.”
Mindfulness techniques include becoming aware of being pulled to a distraction, observing one’s reaction before giving in to an impulse, and making an intentional choice about what to do next, she said.
Collard described emotions as built-in alarm systems. “If we can teach ourselves to see an emotion as a sign that something is wrong, we can stop and give ourselves time to react appropriately. Happier people are safer people.”
The survey found that respondents cope with the demands of work and stress with exercise (56%), prioritising rest and sleep (53%), connecting with family and friends (53%), spending time in nature (48%), setting up boundaries (37%) and mindfulness practices (25%).
Collard recommended using a ’90 second rule’ – waiting a minute and a half to allow the emotion to dissipate, and also labelling the feeling and carefully choosing a response. She also recommended breathing exercises, and focusing on one’s senses to calm the mood and concentrate better.
“Exercise improves people’s ability to cope with stress, while becoming an observer of your thoughts, naming and labelling the thoughts, can help activate executive functioning,” she said.
KnowBe4 is working on mindfulness content to help users with concentration and focus, Collard announced during the webinar.
Share