The neuroscience of cognitive overload and security behavior
These thoughts are my own, from sixteen years on the offensive side of security. I use AI to help edit and to find the research.
In the last article, I wrote about somatic cues, the ways our body tells us it’s feeling less than optimal. This one is about why those cues matter. Stress, lack of sleep, distraction, and physical discomfort all wear down the things we need most when a suspicious message shows up: executive function, impulse control, and attention.
Stress
When we’re stressed, we shift toward fight or flight. Daniel Kahneman would call this System 1 thinking: fast, emotional, and impulsive. We decide in the moment, and the logical part of our brain isn’t fully engaged.
The logical part is the prefrontal cortex, and it’s the part of the brain most sensitive to stress. When stress hits, the amygdala, our emotional alarm system, gets stronger while the prefrontal cortex gets weaker. Yale neuroscientist Amy Arnsten describes it as the brain switching from slow, thoughtful control by the prefrontal cortex to the fast, reflexive emotional responses of the amygdala (Arnsten, 2009).
That’s what makes a rash decision so hard to catch while we’re making it.
Lack of sleep
Lack of sleep does the same thing. When we’re tired, we likely spend more of our time in System 1.
In one study from Harvard and UC Berkeley, people kept awake for about 35 hours had emotional brain centers more than 60% more reactive than people who had slept, and a weaker connection to the prefrontal cortex that normally keeps those reactions in check (Yoo et al., 2007). It’s also hard to notice from the inside. In a University of Pennsylvania study, people who slept four or six hours a night for two weeks kept getting worse on attention tests, while their sense of how sleepy they were leveled off after a few days (Van Dongen et al., 2003). They kept getting worse and stopped feeling it.
That’s exactly where an attacker wants you. Their goal is to get you into System 1, or keep you there, so you don’t think critically about what they’re asking or question the urgency or authority they’re pretending to have.
Distraction
When we’re only partly engaged, we aren’t using System 2. Maybe it’s a good song on your phone, a chat with a neighbor, or any of the other things we think we can do while working on something important. Each one pulls focus from what’s in front of us, and when an attack comes through, we might just wave it through.
Psychologists call this inattentional blindness. In the well-known “invisible gorilla” study, many people counting basketball passes in a video never noticed a person in a gorilla suit walking through the middle of it (Simons and Chabris, 1999).
Some distractions are worse than others when we’re reading, and reading is most of what checking email is. Researchers at Cardiff Metropolitan University found that songs with lyrics hurt reading comprehension whether people liked the song or not, while instrumental music didn’t (Perham and Currie, 2014). The words in the song compete with the words on the screen. Conversation does the same thing: in a driving-simulator study, people on a phone call, even hands-free, missed twice as many traffic signals (Strayer and Johnston, 2001).
I’ve done this myself, more than once. My son asked me about an email he’d received, and I told him, more or less, “Oh, that’s fine. It sounds normal.” He almost lost money because I wasn’t paying attention to what he was asking.
And that’s a cybersecurity professional talking.
Ergonomic irritation
Physical discomfort at your desk belongs on this list too.
Do you sit by a window where, at a certain time of day, the sun makes you irritable or makes it hard to focus? Is your chair comfortable? Is your monitor at the right height? Are you taking enough breaks during the day to keep headaches at bay?
Pain is built to interrupt us. Researchers describe it as something that “interrupts and demands attention” (Eccleston and Crombez, 1999), and a headache from glare is a small version of that. Breaks help too. In a University of Illinois study, briefly stepping away from a long task kept people’s focus from sliding (Ariga and Lleras, 2011).
The fewer of those pain points we have, the easier it is to focus, and to stay in System 2 or get back to it.
Up to the task
The main lesson here is that we need to take care of ourselves: rest well, eat well, and exercise.
Taking care of our bodies does two things. First, it helps us feel better. Second, it lets us show up as our whole selves at work and keep things secure, because we’re up to the task.
References
- Ariga, A., & Lleras, A. (2011). Brief and rare mental “breaks” keep you focused: Deactivation and reactivation of task goals preempt vigilance decrements. Cognition, 118(3), 439–443. doi.org/10.1016/j.cognition.2010.12.007
- Arnsten, A. F. T. (2009). Stress signalling pathways that impair prefrontal cortex structure and function. Nature Reviews Neuroscience, 10, 410–422. doi.org/10.1038/nrn2648
- Arnsten, A. F. T., Mazure, C. M., & Sinha, R. (2012, April). This is your brain in meltdown. Scientific American, 306(4), 48–53. doi.org/10.1038/scientificamerican0412-48
- Eccleston, C., & Crombez, G. (1999). Pain demands attention: A cognitive-affective model of the interruptive function of pain. Psychological Bulletin, 125(3), 356–366. doi.org/10.1037/0033-2909.125.3.356
- Kahneman, D. (2011). Thinking, Fast and Slow. Farrar, Straus and Giroux.
- Perham, N., & Currie, H. (2014). Does listening to preferred music improve reading comprehension performance? Applied Cognitive Psychology, 28(2), 279–284. doi.org/10.1002/acp.2994
- Simons, D. J., & Chabris, C. F. (1999). Gorillas in our midst: Sustained inattentional blindness for dynamic events. Perception, 28(9), 1059–1074. doi.org/10.1068/p281059
- Strayer, D. L., & Johnston, W. A. (2001). Driven to distraction: Dual-task studies of simulated driving and conversing on a cellular telephone. Psychological Science, 12(6), 462–466. doi.org/10.1111/1467-9280.00386
- Van Dongen, H. P. A., Maislin, G., Mullington, J. M., & Dinges, D. F. (2003). The cumulative cost of additional wakefulness: Dose-response effects on neurobehavioral functions and sleep physiology from chronic sleep restriction and total sleep deprivation. Sleep, 26(2), 117–126. doi.org/10.1093/sleep/26.2.117
- Yoo, S.-S., Gujar, N., Hu, P., Jolesz, F. A., & Walker, M. P. (2007). The human emotional brain without sleep: A prefrontal amygdala disconnect. Current Biology, 17(20), R877–R878. doi.org/10.1016/j.cub.2007.08.007
Related: The Mindful Defender: How Presence Sharpens Our Security Awareness
