Exam section A - Question 3

Question 1

Hyperbolic discounting

Answer 1

refers to the tendency for people to increasingly choose a smaller-sooner reward over a larger-later reward as the delay occurs sooner rather than later in time.

Question 2

Optimism bias

Answer 2

(also known as unrealistic or comparative optimism) is a cognitive bias that causes a person to believe that they are at a lesser risk of experiencing a negative event compared to others.

Question 3

Psychologists can introduce cultural/behavioural shifts toward higher security on individual/collective levels in what 5 ways?

Answer 3

1. Exploring perceptions of risk and reward
2. Identifying patterns of criminal/malicious activity
3. Advising legislators/steering groups on social impact of cyber-crime
4. Raising public awareness of cybersecurity risks
5. Understand impact of cyber-crime on victims behaviour through the stages of victimisation

Question 4

Point 1 - Exploring perceptions of risk and reward

Answer 4

Identify social situations in which individuals have a higher tendency to discount risk of sharing private information - social media/casual conversation

Question 5

Point 2 - Identifying patterns of criminal/malicious activity

Answer 5

Interacting with tech providers to develop security systems capable of detecting such activities

Question 6

Point 3 - Advising legislators/steering groups on social impact of cyber-crime

Answer 6

To increase legislation to a comparable level to non-virtual crimes, and encourage uniform legislation between countries, as unequal legislation is a major factor in hinderance of the fight on cyber-crime

Question 7

Point 4 - Raising public awareness of cybersecurity risks

Answer 7

Through mainstream media/social networks (as opposed to journal articles) so that people adjust their behaviour toward privacy

Question 8

Point 5 - Understand impact of cyber-crime on victims behaviour through the stages of victimisation

Answer 8

Focus on the symptoms and outputs of the Preliminal (separation), liminal (transitional), and post-liminal (incorporation) stages of victimisation

Question 9

Accidental insider

Answer 9

No malicious intent

Transgress through misjudgement, ignorance, lack of knowledge

Question 10

3 causes of accidental insider cyber-security breaches

Answer 10

Lack of understanding about the importance of data, software, and systems

Ignorance about level of risk attached to assets for which they have direct responsibility

Lack of understanding how their behaviour could be putting the same asset at risk

Question 11

Insider threat: Malicious intent (4) (PNEUMONIC: LENS)

Answer 11

Lack of social skills and isolation
Ethical flexibility
Negative life experiences
Sense of entitlement

Question 12

Insider threat: Personality traits (9) (PNEUMONIC: MAIL LEERS)

Answer 12

Manipulative
Amoral and unethical
Immaturity
Lacks conscientiousness

Low self-esteem
Emotionally unstable
Evidence of underlying psychopathy or personality disorder
Restless & Impulsive
Superficial

Question 13

Insider threat can also be as a result of environmental factors such as (2)

Answer 13

Lifestyle changes

Circumstantial vulnerabilities

Question 14

Insider threat: psychological factors (5) (PNEUMONIC: PEERS)

Answer 14

Poor work attitude
Exploitable/vulnerable lifestyle
Exploitable/vulnerable work profile
Recent negative life events
Signs of stress

Question 15

Accidental/unintentional insider: Threat as a result of

Answer 15

Human failure/limitations of human performance

Question 16

Mistakes can occur for the accidental insider through what 4 things:

Answer 16

Pressure of the job
Task difficulty
Lack of knowledge
Cognitive factors: Inattention

Question 17

4 examples of unintentional insider threat

Answer 17

Disclosure of sensitive information
Devolving of log-in details
Improper disposal of physical records
Loss of information through misplacement of portable devices

Question 18

Underlying human factors which could influence cyber-security

Answer 18

1 - Social/peer pressure - adherence to policies
2 - Positive cyber-security of peers/superiors leading to increased cyber-security posture of other organisation members
3 - Self-efficacy, as lack of awareness of security policies means people cannot align to them, thus making errors (example don’t know how to encrypt files)

Question 19

5 tests:

Answer 19

Domain-specific risk-taking scale
General decision-making style
Need for cognition
Barratt impulsiveness scale
Consideration for future consequences

Question 20

5 x Personality traits which would make a person more likely to positively engage in effective cybersecurity

Answer 20

Conscientiousness
Agreeableness
Openness
Risk - adverse
Rational