Nudge Application Methods for Enhancing Information Security Countermeasures

As information security threats become more diverse, it is important for users to take security countermeasures themselves and through the system to prevent such damage. However, the rate of security implementation in Japan is low, and there is a lack of interest in and awareness of security. These facts suggest that in order to improve security, it is necessary to introduce measures that change people's security awareness and behavior, in addition to technical security countermeasures. This study proposes a new security countermeasure using the concept of "nudges" proposed by Richard H. Thaler et al. to promote information security countermeasures from an intrinsic perspective, which is a finding of behavioral economics. For the top five threats in the IPA's "10 Major Threats to Information Security 2023", we propose a total of 30 security prevention countermeasures using the six principles of nudges. Specifically, we suggest offering incentives such as paid leave to employees who are not infected with malware, establishing a unified security policy for the entire supplier, and prioritizing countermeasures against cyber-attacks, etc. We qualitatively assessed the effectiveness of these security prevention countermeasures. These results suggest that the proposed method can contribute to the enhancement of information security countermeasures.