The Contagious Smell of Fear in Information Security

Be afraid. Be very afraid. That’s the takeaway from the many stories written about the data breaches attributed to hacktivism, personal data or Advanced Persistent Threat, which have been dominating the security headlines in the recent years. Sales pitches of security products emphasize this, too. And people are becoming more worried. After all, anxiety is contagious, especially when the smell of fear is in the air.

Choice Fatigue, Sleep-Deprivation, Infectious Anxiety

As I read various research regarding how people perceive security risks, I am amazed by the number of physiological and neurological factors might seem irrelevant, yet have an enormous effect on our decisions. For instance:

We rarely account for these extraneous factors when assessing what elements influenced a decision related to security risks. Smell might be another component that we rarely consider.

The Smell of Fear is Contagious

In experiments conducted at Rice University, researchers established that the smell of “fearful sweat biases women toward interpreting ambiguous expressions as more fearful.” They confirmed that “chemosignals generated by the body of people experiencing anxiety and fear produce a significant albeit subtle effect on implicit perception and cognitive performance.” In other words, women who smelled the scent of scared people were more likely to experience fear themselves.

This finding is consistent with earlier University of Vienna research of the scent of fear:

“Female subjects wore under-arm axiliary pads while watching a terrifying film… the axiliary pads were presented to female subjects in a triple forced choice test. Results show that subjects were able to discriminate between fear and non-fear axilliary pads, suggesting that women are indeed able to detect ‘the scent of fear’.”

These studies suggest that the feeling of fear may be able to spread to others through scent. This is another reminder that fear may be contagious.

What’s the Point?

First, we need to recognize that people’s decisions related to security risk aren’t based purely on rational analysis of factual data. We’re affected by external factors, such as tiredness and anxiety. Second, we need to be careful when using fear to capture the attention of readers or customers. Fear can be contagious, which might lead to the state of group anxiety that will be removed from reality. Moreover, excessive anxiety can scare people into inaction.

Related:

Updated

About the Author

Lenny Zeltser is a seasoned business and technology leader with extensive information security experience. He presently oversees the financial success and expansion of infosec services and SaaS products at NCR. He also trains incident response and digital forensics professionals at SANS Institute. Lenny frequently speaks at industry events, writes articles and has co-authored books. He has earned the prestigious GIAC Security Expert designation, has an MBA from MIT Sloan and a Computer Science degree from the University of Pennsylvania.

Learn more