CyberSecPsych

Positive Behavior Support (PBS) is a philosophy for helping individuals whose problem behaviors are barriers to reaching their goals. It is based on the well-researched science of Applied Behavior Analysis (ABA). A key component is understanding that behaviors occur for a reason and can be predicted by knowing what happens before and after those behaviors.

PBS interventions are designed both to reduce problem behaviors and increase adaptive, socially appropriate behaviors. These outcomes are achieved through teaching new skills and changing environments that might trigger problem behavior. Prevention of problem behaviors is the focus, rather than waiting to respond after a behavior occurs.

Problem behavior: End users clicking on phishing links

Step 1: Structural and functional behavioral assessment to identify the environmental triggers that predict when those behaviors will and will not happen

• Determine:
  • When do end users click on phishing links
  • Where do end users click on phishing links
  • Why end users click on phishing links
• When: Fast-paced work, off-hours, executives on vacation, holiday season, tax season
• Where: Workplace, home office, PC, mobile, USB, email-attachments
• Why: Lack of knowledge of malicious intent, higher priorities, social engineering factors, quick wins, false-trust relationship

Step 2: Develop treatments that match the reason that the end user is using the problem behaviors

• strategies to replace problem behaviors with appropriate behavior.

Reasons end user is using problem behavior:

1. Lack of training on more appropriate behaviors
2. Lack of accountability to the organization
3. Helplessness
4. Responsibility for security belongs to Management or Technology

Strategies:

1. Conduct monthly phishing trainings on latest techniques to continuously educate employees and bolster security culture.
2. Increase accountability with bi-monthly meetings for those who continue to click to increase peer group conformity.
3. Decrees helplessness by educating employees on specific industry vectors techniques used in phishing emails.
4. Increase responsibility by giving power to those who have demonstrated safe online behaviors.

Step 3: Key people in the individual’s life such as family, friends and co-workers learn how to implement PBS treatments to change the environment to support the individual.

The workplace will be the starting point for phishing cessation as the cost to an organization is much higher than personal loss. In time, the habit of slowing down work and taking the time to check links thoroughly will become routine. Until that time, however, Managers will share the responsibility of educating their employees and creating a community-based security culture where employees and management can share their experiences. As a result, corporations can become a breeding ground for more secure practices to be lead into the home front.

Benefits of PBS treatment:

• It causes positive changes. Through environmental changes and reinforcement of adaptive behaviors, individuals can reduce problem behaviors. Coping mechanisms such as relaxation can take the place of the problem behaviors. PBS minimizes the need for punishment or restrictiveness such as restraint, seclusion, or removal of privileges.
• It is outcome-focused. PBS places an emphasis on outcomes important to the individual and to society. These behavioral outcomes, such as fewer aggressive incidents, have the ability to make homes, communities, hospitals, and schools safer.
• It provides collaborative support. PBS involves collaboration with those who support an individual, including coworkers and team leaders. This collaborative process keeps everyone involved in the individual’s treatment and allows for new behaviors and skills to be supported in all settings.
• It is person-centered. Using a person-centered approach, PBS addresses the individual and respects his or her dignity. This includes listening to the individual, recognizing the individual’s skills, strengths, and goals, and the belief that the individual can accomplish his or her goals. Treatments are developed to fit the specific individual rather than a “cookbook” approach.