Believe it…flimsy financial firewalls permitted a huge breach of customers’ data. Firewalls don’t always prevent breaches. Layered security is important, and humans play a critical part The
Psychological safety refers to the perception held by members of a group, that individuals within that group can express their honest thoughts, ideas, and concerns without fear of negative consequences, such as ridicule, reprisal, or ostracism. Perceptions of psychological safety can be fragile and must be continually fostered and carefully protected.
Psychological safety is directly informed by:
In social conditions that prioritise psychological safety, individuals feel more comfortable taking interpersonal risks, sharing diverse perspectives, and contributing openly to discussions.
The psychological contract refers to the unwritten expectations, beliefs, and perceptions that individuals hold regarding the reciprocal obligations between themselves and a power group they are involved with, such as an employer. In many cases it operates in parallel to written contracts and legal obligations but specifically refers to the phenomena which operates at the socio-behavioural level. Thus, whilst this includes many fundamental social rules that range from expectations to be protected from physical harm and undue psychological distress to general politeness, civility, and inclusivity, it also includes expectations attached to overt contractual obligations such as expectation of timely pay, sanctity of leave, and respect for work/life balance.
Wherein the terms of this unwritten contract are breached, psychological safety sharply declines and negative sentiment increases. This results in:
Finally, it is essential to note that the interwoven nature of psychological safety and the state of the psychological contract is compounded by social influence. It is well known that a single member of staff who has experienced a psychological contract breach can have wide reaching influence on other member of staff. Those who are exposed second-hand now have a prototype of how their own breaches might occur, which in itself can result in second order deviance and avoidance. It is worth nothing however that this is typically less extreme that those who are directly involved.
Cybersecurity has historically been presented to staff as a set of rules to abide by. Failure to comply results in staff being conceptualised as ‘offenders’. It also establishes a mindset amongst those who are responsible for security outcomes that the only way to achieve socio-behavioural security is to attempt to keep their staff under control, often leading to coercion and punishment-based controls. In many cases staff experience these controls and admonishments as unfair. Therefore, while each instance appears to be an effective step towards enhanced security among security professionals, it represents a small breach of the psychological contract from the perspective of staff, often worsening psychological safety and resulting in deviant behaviours and avoidance.
The most significant version of this is observable within phishing tests, wherein staff are deceptively exposed to an inert malicious email. Staff are expected to identify the deception and report in accordance with organisational policies. This has become the prevailing method for determining staff cyber-security efficacy, normally underpinned by statistics which cite that phishing remains the most common method employed by genuine malicious actors. Those staff who report the phish are understood to have complied with the standard and have achieved the minimum expected behaviour whereas those who fail to report, or those who fall victim to the deception, have failed and are often exposed to some form of remedial training as a result. When understood through the lens of psychological response, it is self-evident that such a process falls clearly within the scope of a psychological contract breach. Deception without a consent framework is exceedingly likely to be interpreted as such. Therefore, whilst staff may appear to comply with organisational phishing tests, the psychological outcomes can be frustration towards the activity itself including vocal dissent, deviant behaviour such as conscious link-clicking to adversely impact statistics, or a deliberately liberal approach to labelling emails as suspicious. Worse, it can breed avoidance at the conceptual level for security practices. Symptomatically, staff may report that “security is not their job”, or that they “aren’t good with technology”. They may delay or fail to complete annual security training. These, and other indicators, can be subtle cues of general avoidance. Simply put, someone who psychologically avoids security, is more likely to make mistakes and thus more likely to expose themselves and their employer to security vulnerabilities.
A significant body of research across numerous contexts strongly supports the case that degradation in psychological safety, whether through psychological contract breach or deformed and unhelpful social constructs, significantly reduces the likelihood that staff will communicate concerns. In the context of security, this means that staff are unlikely to report incidents. Given that each person has the potential to identify anomalous system behaviour, strange phone calls, or even unusual connections through social media, accessing this level of situational awareness could be the biggest tactical advantage when responding to threats. It therefore stands to reason that increasing propensity to report should be one of the most important objectives of cyber-security behavioural change, and that doing so without paying close attention to psychological safety is unlikely to attain optimal results.
The collective impact of both psychological safety and the psychological contract cannot be overstated. Those who fail to effectively account for even minor breaches and losses of trust can find a rapidly growing number of people who avoid security tasks, act in ways that seem contrary to security outcomes, and demonstrate lost trust through fewer and fewer reports. However, the social impact is relevant in both directions. Those organisations that champion psychological safety and take steps to effectively operate with attention to the psychological contract find that they will initially develop a small number of staff who role-model ideal security behaviours. These individuals have a profound influence on those around them and through this mechanism, it is possible to sow the seeds of an autonomous security culture.
Given the potential for impact if uncontrolled and potential benefits for enhanced security if mobilised, Recyber have made these themes foundational in the creation of not only the Republic technology, but also in all of the Recyber service offerings.
Alongside the methodological and technical controls build into the Republic platform, which have been meticulously designed to safeguard the psychological contract and foster a sense of psychological safety, we also interpret ourselves as a provider of psychologically–orientated services rather than as an educator or corporate services offering. As a result, we take every step possible to align to the code of ethics as defined by the British Psychological Society. This means that we opt to treat those people who use our technology with the same ethical underpinnings of a provider of therapeutic services.
Aside from the moral obligation to our service users, this approach helps to ensure an effective trust relationship which makes the terms of the psychological contract held between us and our users as transparent as possible. This in turn feeds into the individual psychological safety of our users, and thus helps encourage secure decision-making.
