{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/nudging","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/nudging/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/nudging/"},"term":{"en":"Nudging","da":"Nudging"},"aka":{"en":["nudge","security nudge"],"da":["nudge","adfærdsdesign"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","era":2008,"summary":{"en":"Small, gentle prompts that make the safe choice the easy one, without forbidding anything.","da":"Små, venlige skub, der gør det sikre valg til det lette valg, uden at forbyde noget."},"body":{"formal":{"en":"Shaping the setting in which people make choices - reminders, sensible default settings, well-timed messages - so the secure option becomes the natural one, while every option stays open.","da":"At forme de rammer, folk træffer valg i - påmindelser, fornuftige standardindstillinger, beskeder på det rigtige tidspunkt - så den sikre mulighed bliver den naturlige, mens alle muligheder stadig står åbne."},"plain":{"en":"Like painting footsteps on the floor leading to the stairs - nobody is forced, but most people follow them.","da":"Som at male fodspor på gulvet hen mod trappen - ingen tvinges, men de fleste følger dem."},"inPractice":{"en":"In a municipal job centre, a sticker on every screen reads “Leaving? Windows key + L”, and the mail system shows a yellow banner at the top of every message from outside.","da":"I et jobcenter står der på et klistermærke på hver skærm “Går du? Windows-tast + L”, og mailsystemet viser et gult banner øverst i alle mails udefra."},"whyItMatters":{"en":"Training is easily forgotten at the moment of choice; a nudge appears right at that moment, so habits change at low cost and without the resistance that new rules meet.","da":"Træning er let at glemme i det øjeblik, valget skal træffes; et nudge dukker op netop dér, så vaner ændres billigt og uden den modstand, nye regler møder."}},"deepDive":{"en":"The term comes from Richard Thaler and Cass Sunstein's Nudge (2008), which defines a nudge as any aspect of the choice architecture that alters behaviour in a predictable way without forbidding options or significantly changing economic incentives. The philosophical label is libertarian paternalism: the designer steers, but the chooser keeps the freedom to opt out cheaply. The psychological basis is dual-process theory - most security decisions (clicking, approving, sharing) are made by fast, automatic System 1 processing, so interventions that act at the moment of choice outperform knowledge delivered weeks earlier. Practitioner frameworks such as the UK Behavioural Insights Team's EAST (make it Easy, Attractive, Social, Timely) and the earlier MINDSPACE checklist translate this into design rules.\n\nIn security the strongest nudge is the default. Pre-enabled MFA registration campaigns, secure-by-default configurations, auto-lock timeouts, sharing links that default to \"people in your organisation\" rather than \"anyone with the link\", and password managers that autofill only on the correct origin all rely on inertia working for security instead of against it. Salience nudges include external-sender banners, first-contact safety tips and lookalike-domain warnings; feedback nudges include password-strength meters, which Ur et al. (USENIX Security 2012) showed can push users toward stronger passwords when scoring is stringent. Social-norm nudges (\"87 percent of your colleagues have enabled MFA\") use descriptive norms, and commitment nudges ask people to confirm intent before a risky action.\n\nThe main failure mode is habituation. Repeated identical warnings are processed less and less; Akhawe and Felt's large field study of browser warnings (USENIX Security 2013) showed click-through rates differing sharply between browsers with different warning designs, and a banner on every external mail soon becomes invisible. Countermeasures are rarity (warn only on genuinely unusual events), polymorphic or context-specific wording and placing the warning where the decision happens. Nudges also have ceilings: they shift probabilities, they do not stop a determined or deceived user, so they complement rather than replace hard controls.\n\nEthically, nudges must be transparent and aligned with the user's own interest. The inverse - designs that exploit the same biases against the user - are dark patterns, and the EU Digital Services Act Art. 25 prohibits online platforms from using interface designs that deceive or manipulate users. \"Sludge\" describes friction that makes the good choice harder. Unlike a security policy, a nudge carries no sanction and needs no enforcement, which makes it cheap but also means compliance cannot be demanded or audited in the same way.","da":"Begrebet stammer fra Richard Thaler og Cass Sunsteins bog Nudge (2008), der definerer et nudge som ethvert element i valgarkitekturen, der ændrer adfærd på en forudsigelig måde uden at forbyde muligheder eller ændre de økonomiske incitamenter væsentligt. Den filosofiske betegnelse er libertær paternalisme: Designeren styrer, men den, der vælger, kan billigt vælge fra. Det psykologiske grundlag er teorien om to tankesystemer - de fleste sikkerhedsbeslutninger (klikke, godkende, dele) træffes af det hurtige, automatiske System 1, så indgreb, der virker i selve valgøjeblikket, slår viden, der blev formidlet uger forinden. Rammeværk fra praksis som det britiske Behavioural Insights Teams EAST (gør det Easy, Attractive, Social, Timely) og den tidligere MINDSPACE-tjekliste omsætter det til designregler.\n\nI sikkerhed er standardvalget det stærkeste nudge. Kampagner, der på forhånd sætter MFA-registrering i gang, sikre standardindstillinger, automatisk skærmlås, delingslinks, der som standard gælder \"personer i din organisation\" frem for \"alle med linket\", og password managers, der kun udfylder automatisk på det rigtige domæne, udnytter alle, at inerti arbejder for sikkerheden i stedet for imod den. Synlighedsnudges omfatter bannere om ekstern afsender, advarsler ved første kontakt og advarsler om lookalike-domæner; feedbacknudges omfatter styrkemålere til adgangskoder, som Ur m.fl. (USENIX Security 2012) viste kan skubbe brugere mod stærkere adgangskoder, når vurderingen er streng. Nudges baseret på sociale normer (\"87 procent af dine kolleger har slået MFA til\") bruger beskrivende normer, og forpligtelsesnudges beder folk bekræfte deres hensigt før en risikabel handling.\n\nDen vigtigste faldgrube er tilvænning. Gentagne, ens advarsler bearbejdes mindre og mindre; Akhawe og Felts store feltstudie af browseradvarsler (USENIX Security 2013) viste markant forskellige click-through-rater mellem browsere med forskelligt advarselsdesign, og et banner på hver eneste eksterne mail bliver hurtigt usynligt. Modtrækkene er sjældenhed (advar kun ved reelt usædvanlige hændelser), varierende eller kontekstspecifik formulering og placering af advarslen dér, hvor beslutningen træffes. Nudges har også et loft: De flytter sandsynligheder, men stopper ikke en målrettet eller narret bruger, så de supplerer hårde kontroller i stedet for at erstatte dem.\n\nEtisk skal nudges være gennemsigtige og i brugerens egen interesse. Det omvendte - design, der udnytter de samme bias mod brugeren - er dark patterns, og EU's forordning om digitale tjenester (DSA) art. 25 forbyder onlineplatforme at bruge grænseflader, der vildleder eller manipulerer brugerne. \"Sludge\" betegner friktion, der gør det gode valg sværere. Til forskel fra en sikkerhedspolitik indebærer et nudge ingen sanktion og kræver ingen håndhævelse, hvilket gør det billigt, men også betyder, at efterlevelse ikke kan kræves eller revideres på samme måde."},"edges":[{"type":"implements","to":"security/control","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/security-policy","why":{"en":"A policy sets rules that must be followed; a nudge steers behaviour without any rule or penalty.","da":"En politik fastsætter regler, der skal følges; et nudge styrer adfærd uden regler eller sanktioner."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-awareness","why":{"en":"Training explains why; nudges remind people at the moment it counts.","da":"Træning forklarer hvorfor; nudges minder folk om det i det øjeblik, det gælder."},"confidence":"high","strength":"primary"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"Nudge - Improving Decisions About Health, Wealth, and Happiness (Thaler & Sunstein)","tier":"textbook","publisher":"Yale University Press"}],"draft":true}