Thinking About Thinking: Exploring Bias in Cybersecurity

Forcepoint has championed the concept of the unbound enterprise – the ability for businesses and people to work unconstrained by traditional network infrastructures and physical workspaces – for some time. However, deliberate well-planned changes to work practices are different from forced, rapid changes that are accompanied by additional stressors such as health concerns and increased household responsibilities.

As a leader in user and data protection, Forcepoint knows that understanding users’ behavior is critical for protecting against emerging cybersecurity risks. This research explores the impact of remote work on technology use, as well as on more personal experiences such as stress levels and home environments. In particular, we asked respondents about Shadow IT use, work practices, personal stressors, and organizational engagement. The results identified meaningful differences in behaviors across age groups, gender, and increased caretaking responsibilities at home. 

"A surprising finding in this study was the consistent and disproportionate negative impact that remote working had on certain demographic groups."

A surprising finding in this study was the consistent, and disproportionate, negative impact that working from home had on certain demographic groups. Younger employees as well as people caring for children or other family members reported more negative experiences and also reported engaging in riskier behavior when compared to older respondents or those with no caretaking responsibilities. We also saw significant differences between men and women, where men undertook significantly more risky behaviors, and women felt more pressure and stress while home working.

These results exposed key areas of opportunity for business leaders and cybersecurity professionals to better address the needs of a changing workforce:  firstly, leaders must recognize and accept the pervasive use of Shadow IT that exposes organizations to increased cybersecurity risk. Secondly, leaders must proactively help employees deal with increased and prolonged levels of stress and anxiety, paired with additional interruptions. Burnout is not only a risk for individual employees, but also impacts organizational resilience and personnel resource management needs.

This blog in two parts presents the findings of the study, and identifies positive interventions from business leaders that can support and guide people struggling with work-from-home mandates. These direct interventions can help direct people away from engaging in risky behaviors, foster a connected and flexible organizational culture, and help prevent burnout.

Different Demographics, Different Expectations and Behaviors

We hadn’t expected the study to reveal so clearly a picture of demographic disparities. The biggest finding of the study reveals that younger people (under the age of 30) and caregivers experience far greater negative impacts when working from home than others. We also saw some clear differences in behaviors between the genders.

Generational Differences

While both older (aged 53+) and younger employees received some organisational support their personal and emotional experiences along with their use of technology was markedly different. 

Support Offered by Employers

Over two thirds (70%) of younger employees say that their stress level makes it difficult to focus, compared to 29% of older workers, and 77% stated they feel the pressure to be available outside of normal working hours, compared to less than half (46%) of older workers. Over three quarters (78%) of younger employees also reported that they feel stressed out by competing demands from their personal and professional lives, compared to 40% of older employees.

Younger employees also revealed significant stress and anxieties about their job security compared to other age groups with 77% stating they are worried about their job performance and ability to do their job well, compared to 39% in the older age group. Exactly half (50%) of younger staff also say they struggle to understand their professional goals compared to 20% of those aged 53 or over.

When it comes to the impact of this stress, we also explored this group of office workers’ behavior during lockdown. Of the younger group, 55% reported making more mistakes when working from home, such as copying in the wrong people into emails. This is in stark difference to the older group, where only 17% reported such mistakes. Nearly two-thirds of the younger group (63%) stated that distractions whilst working from home negatively impact decision making, compared to 26% of older people. Shadow IT use also reflected the same pattern, as 67% of the younger said they used shadow IT to help them to perform certain tasks more easily, compared to 27% of older workers.

Consistently, the responses reflect that the younger respondents experienced greater negative impacts from the transition to working from home when compared to the older respondents. While it is not possible to establish a causal relationship, higher stress levels, time pressures, and issues maintaining work life balance may be contributing to the tendency of younger employees engaging in risky behaviors to get their jobs done.  Differences in behaviors may in part reflect natural age-related tendencies in risk taking, but the level of disparity between the two groups is both consistent and extreme.  This could indicate that natural risk-taking tendencies are exacerbated by prolonged periods of stress and a challenging work climate.

Other factors that fall outside of the scope of this survey, but that may be influencing the differences between older and younger respondents, could be related to each group being in different phases of life.  For instance, older workers may be more established in their careers with many years of experience, and an extensive professional network. They may also be more financially stable, be less likely to have short-term living arrangements, and they may also have more space to dedicate to home offices.  Younger workers who are at an earlier stage in their careers, may tend to be less stable in both their personal and professional lives for similar reasons. 

Differences in shadow IT use may also reflect factors that were not considered in this survey, such as day-to-day personal use of various technologies and services.  It is possible that the younger group uses a wider range and greater number of technology solutions in their daily lives than the older group, such as backing up or sharing data using personal cloud accounts.

We discuss later what business leaders can do to support all age groups, and reduce exposure to increased cybersecurity risks caused by some of these behaviors. 

Impact on Caregivers

Caregivers are also feeling the pressure of working from home. The combination of stress of maintaining a work/life balance, caring for others and concerns over job security, may be contributing to engaging in riskier behaviors when compared to those who do not have caretaking responsibilities at home.

The research reveals almost three quarters (74%) of caregivers feel stressed out by competing demands from their personal and professional life compared to 62% of those who do not care for others.  Additionally, 73% of caretakers state they feel the pressure to be available outside of normal working hours compared to 61% of those who do not care for others at home. When considering day-to-day professional decisions, caregivers again report higher rates of difficulty (56%) than their non-caretaking counterparts (46%). 

Job performance is another area of concern for caregivers.  They report that caring for others negatively impacts their job performance (63%), they are worried about doing their job well (69%), and they are also concerned with the stability of their job status (70%).  Those who do not care for others at home also reported quite a great deal of concern in this area, though markedly less than caregivers.  Of this group of respondents, 59% reported being worried about doing their job well, and 60% were concerned with job stability; only caregivers responded to the job performance question so there is no direct point of comparison for this group.

Caregivers also report a higher level of risky behaviors, or behaviors associated with human error.  Minor mistakes (52%) and distractions that impact decision making (56%) impacted over half of this demographic group.  Caregivers also reported that they need shadow IT to get their jobs done (48%). In every case, caregivers report higher levels of stress, error making and shadow IT usage.

Without additional support from employers, young people and caregivers could continue to deviate further from pre-set and learned IT security rules, exposing their companies to further increased security risk.

Lockdown has been a stressful time for everyone, and while employers have admirably supported remote working with technology and connectivity, the human factor must not be overlooked. Interruptions, distractions, and split attention can be physically and emotionally draining and as such it’s unsurprising that decision fatigue and motivated reasoning continues to grow.

In the second part of our blog, we’ll explore the usage of shadow IT, and cover off actions and positive interventions from business leaders that can support and guide people struggling with work-from-home mandates.

Full Survey Data including country split is available on request.