CHAPTER 12

Differences in Opinion

Introduction

Predicting one’s actions and behaviors have taken large strides forward in their understandings. At the start of this book, it was mentioned that there are centuries of research to draw upon to try and identify why people behave the way they do. For a large cause of behaviors among people, it seems like we just don’t agree with each other, but is that really a surprise? Modern societies argue that if you do bad things you will be punished, but it has been shown that people still do bad things. Why exactly, perhaps they get joy, and that joy overshadows any negative consequences they may think they will face. Perhaps it’s fear, anger, frustration, destituteness, and the negative consequences they may experience that do not seem concerning at the moment and remember, it’s in the context, think out-of-control road rage. Behaviorists see personality, a product of conditioning, is something that can be conditioned and predicted. Psychoanalysis sees personality as past unconscious memories that will help to explain behavior and eventually used for future prediction. We have seen how rewarding someone with incentives sometimes works out, but sometimes it doesn’t and sometimes it just stops as there is no more motivation left. Parents can attest to this by paying kids for chores, but then after weeks, or months, the motivation for a momentary reward for a chore is not enticing as when first offered. Is it the environment, social connections, philosophical roots, genetic traits, or some disorder someone could be afflicted with? There is a whole body of literature on development psychology and our behaviors that come from our upbringings. Different researchers, different opinions: some of them are very good, some not so good, and others still being examined, but it is clear that no one branch of science can explain our behavior. All is unknown, and it is still a frontier, but like it was mentioned at the beginning of the book, we may not change that diet, but perhaps there are things we can do to eat better, and perhaps there are some commonalities across all sciences.

Feelings

Feelings help us interpret emotions. Frijda (2007) suggests we may be subconsciously unaware and make these decisions based on this unconscious process that in some event could be cause of our neural associations. Unfortunately, others cannot understand our feelings and have to fill in some blanks to understand the reasoning. Much like the example earlier in the book, where we see a speeding driver going over 100 mph, is he joy riding, or taking a sick relative to the hospital? Feelings are purely idiosyncratic, and as we say to each his own, they may lie somewhere between the biological and cognitive processes. Are they conscious or subconscious? For example, do we get really scared, and jump, right after we see the snake, or jump when seeing the snake, and then we get really scared? They also prepare us for action, flight or fight, or sometimes you say:

I have a gut feeling about this,

but feelings themselves cannot predict or dictate all behavior.

Intelligence

Intelligence is vast field and many researchers have tried to predict and to some extent measure intelligence. Some of the earliest research in intelligence and development of intelligence tests are over 100 years. One of these earliest was created by Binet (1905) who created the Binet Intelligence Scale, which tried to measure attention and memory. Binet’s intent was just to measure students who might need some extra attention. Unfortunately, others used the test to identify weak and feeble minds and it was espoused during the eugenics movement.

Guilford (1967) argued that a true measure of intelligence has two parts. The first part is problem solving, which is the nuts and bolts of solving a problem, and for the most part this has been accepted into the mainstream for measuring intelligence. Guilford argues however that intelligent tests are missing a very important second part, that of divergent thinking, the creative part; think back if you ever took a writing class in school called creative writing. It is this creative part of modern intelligence tests that is missing. To truly measure a person’s intelligence, Guilford states a test must measure both.

For example, think of the numbers: three, four, and 17. How many combinations can you make with these numbers using the four normal algebraic functions of add, subtract, multiply, and divide. Given some time, you would probably be able to account for all variations like three times four, 17 plus three, four times three plus 17 divided by three times four, and so on. But now think of a pentagon-shaped box, a wet suit that an underwater scuba diver would wear, a 56 Chevy Bel Air with a dual four-barrel carb with a 411 engine, and a can of soda. How many combinations can you come up with? This is the creative part. How many things can you imagine and create with these four items? So, Guilford’s position was that you needed both to measure intelligence. Arguing against Guilford’s position and as we have seen, that perhaps while intelligence is a good indicator of what a person might do in certain situations, we have learned that with the power of persuasion and stereotyping, even intelligence cannot predict or dictate all behavior. When looking at the intelligent scores of large populations, we notice many people fall on the intelligent side of the scale and the reason for that was that it was it was designed that way. The average is 100, and the intelligence curve is based on 100. It was designed that way and will stay that way, so perhaps depending on how we are feeling on any certain day:

We could be considered another Einstein or just dumb as a rock.

Cattell (1941) also suggested that intelligence is made up of two parts: (i) fluid intelligence, which is reason, thinking, abstract logic, and (ii) crystallized intelligence, which consists of facts and figures. He divided these two parts from the G concept, created earlier by Spearman (1904). Fluid intelligence is a genetic trait as it differs from one person to the next, whereas crystallized intelligence comes from our learning and past experiences, possible top-down processing. These two parts are independent of each other, but work together. Reasoning and higher level of fluid intelligence would lead to a subsequent higher level of crystallized intelligence, which would lead to a higher level of overall intelligence.

The Dunning–Kruger (Kruger and Dunning 1999) effect really impacts this area. The Dunning–Kruger effect basically says, those who seem to have high IQs, measured over time, actually underestimate their own intelligence, whereas those usually measuring under 100 on the scale overestimate their intelligence. This by itself would not be an issue, but many of these on the lower end of the scale have a noted ability to persuade others just the opposite, and they hold a high IQ. So, Guilford could be somewhat correct as this persuasion factor is the creative intelligence part influencing others. While the Dunning–Kruger effect was coined in 1999, previous research led up to the phrase, and unfortunately it is still very real today. A study in 2019 by Fernbach et al. showed that those individuals who were the biggest opponents of genetically modified food knew the least about the subject. Additionally, they suggested that we do not think alone, in that, what others say have an impact on what we truly believe. Instead of having one individual incorrect, we can have whole societies incorrect. Indeed, as Bertrand Russell said in 1933:

The triumph of stupidity is upon us.

Ever notice you feel your intelligence changes from Monday to Friday, or from when you are full or hungry. Why does my intelligence change when I have nothing to worry about, to times you are worried about something? If you had to measure your intelligence with things in the background like my car payment is due, am I getting laid off, is my child sick, all these external factors would impact how you preform. How many times have you heard or said,

Quiet, I can’t hear myself think.

Humor on Intelligence

Are people with a good sense of humor more intelligent than people without one? There is a large body of research that suggests that is the case. A classic experience is when Albert Einstein was asked to pose for a picture, and the renowned scientist stuck out his tongue. Einstein often credited his child-like sense of humor for his intelligence. In what category are we assuming this laughter hypothesis? In Guilford’s argument, there are two parts to intelligence: the knowing, and the creativity part. It is the sum of both these parts that leads to a higher overall intelligence. Looking at some famous scientists who exhibited both, here are some of their famous quotes:

There are also different types of humor styles, and we discussed some of them earlier. Some seem to suggest that it’s the dark sense of humor more associated with intelligence. Dry jokes, morbid jokes, and so on, and this agrees with Sigmund Freud’s position back in 1905 proposing humor as an outlet. Dark humor is often associated with pain, aggression, and death. But in safe environments, researchers have noted that those who employ dark humor were typically better educated, had lower aggression levels, and less mood disturbances. Dark humor, with its more aggressive tendencies, is enjoyed by those with less aggressive tendencies. Perhaps it’s the opposite thing of attraction. I am so opposed to aggression, and it somehow attracts me. Some researchers suggest it’s more of an outlet; at times the majority of us will experience pent-up frustration, and perhaps dark humor serves as a release outlet. It is a very interesting viewpoint that dark humor is associated with stable personality, high self-esteem, emotional ability, and even to enhance relationships. Dark humor, however, is not negative humor, such as those who engage in putdowns of others, sarcasm, and some self-defeating humor is not negative. These types seem to alienate people and cause increased depressions and aggression in those who engage in negative humor traits.

You may notice that in this book I make many attempts at humor, so then I must be intelligent, but that would be open for debate. My children are very much into social media like any teenager, so I asked them to set up a social media account for me and make it look professional. For my profile picture, they used a picture of a Niagara Stealth. Do a search for a Niagara Stealth, and you will know why I was not very intelligent to trust them. Niagara Stealth is a fantastic piece of technology; it’s just not me. I do believe in neural network associations, and if a particular humorous example or story increases neural network associations and improves recall, then it is something that should be practiced.

Personality

Personality is formed from our multiple traits. This is not that we have multiple personalities, just that all our individual traits make up our own unique personality. Allport (1961) believed that we all have at least a set of common traits that are common among the majority of people. Some common traits include things like honesty, caring, anger, and so on. Then we have the secondary traits that we exhibit at different times (e.g., we may get nervous if asked to speak to a group of people or some people giggle in certain situations). Fleeson (2001) termed the phrase density distributions, in that personality traits don’t change, but they fluctuate throughout the day, and that people are more tuned to exhibit multiple types of traits the more they are accustomed to repeating these patterns of modifying traits.

There are the cardinal traits. These traits are often unique and often times referred to an individual that is symbolic to these traits: Einstein, genius; Hitler, evil; Machiavelli, ruthlessness; George Washington, founding father of America. Allport like other researchers believed that these traits are often reflected even in our language. Allport took the English language that was current in his lifetime and identified 18,000 unique words to describe personality. He narrowed this down to about 4,500 words, and out of these, narrowed those further into categories. Then divided these into two main groups: (i) genotypes, the internal forces that help us relate to the world, and (ii) phenotypes, those external forces placed upon us and how we accept these forces that may guide our behavior. Allport was trying to examine if traits can be connected to behavior and was a sort after goal. Allport used as an example, the fictional tale of Robinson Crusoe. Robinson had some very strict traits, but after saving and teaching Friday, his other traits surfaced due to their relationship and time.

Ever hear flattery will get you everywhere?

You may have heard this phrase, and indeed flattery does, and it can really impact what we believe our personality to be. Stagner (1958) conducted a research study asking managers to participate on a personality test. After the results, Stagner then shared the results with the managers. However, he did not give the managers the real results, but he gave them feedback based on horoscopes and other analysis. Then, he asked the managers if they agreed with the results and they all agreed. Forer (1949) conducted another study with psychology students. Similar to Stagner’s approach, he gave a test, scored the results, but did not share the real results, instead shared only positive results, like you have a good sense of humor, you care about security, you can be critical of yourself, and so on. Again, the psychology students agreed almost five out of five on the scale. Even the phrase you can be critical of yourself is not negative in nature, but a positive indication that you know you can be unbiased, when, in reality all these statements were biased and had nothing to do with the student’s answers. People will believe the positive and neglect the negative.

Temperament

Eysenck (1967) was trained as a biologist and looked at temperament as the physiological factor that contributed to one’s personality and could possibly explain behavior. He suggested that if someone were an over-inclusive thinker and had a very high IQ of more than 165, he or she could be considered a genius. However, if the same person who was an over-inclusive thinker had some psychotic symptoms, they could be insane.

Therefore, Eysenck’s conclusion is, are we all sane or insane; is there really any difference?

Earlier work by early Greek physician Galen (129 AD) divided temperament into four categories: (1) sanguine, (2) choleric, (3) phlegmatic, and (4) melancholic (Stelmack and Stalikas 1991) all relating to some ailment of physical proportions. Eysenck took these four categories and laid them out between two dimensions: (1) the scale of someone being an introvert to an extrovert, and (2) the scale of someone being a neurotic to having emotional stability. Within this circle, habits are reflected (e.g., someone who is an introvert and high on emotional stability could be characterized as being calm, or peaceful, whereas someone who is considered an extrovert and high on neuroticism could be considered impatient, fidgety, aggressive, etc.). He did a number of tests on this model, had some good results, and a lot of inconclusive results, but later he was ridiculed by his peers for this belief that empirical evidence leads one to believe in paranormal activity.

Well, who could have predicted that behavior?

Motivation

We discussed motivation earlier, and that there are some researchers who believe if you know what makes someone motivated, you will then be able to predict their behavior. And while motivation is a key component, as for example in job performance, McClelland (1987) suggested you cannot always rely on people to tell you what motivates them, since motivations are largely unconscious. He suggested there were three classifications of motivation: (1) achievements, (2) power, and (3) affiliation. Achievement is an internal drive for results, to excel, to improve, to reach a goal. Power is the power over others to influence and manage (but not in the sense of cruelty, although some may have that, it’s the power given by an organization) and affiliation, part of a group working toward the same goal. These three motivations are oftentimes unconscious. We may say what motivates us, but since motivations are subconscious, how can we trust what someone says. He developed the Thematic Apperception Test (TAT), which helps to reveal the subconscious and show true motivations. His test did not work in the business world, but his ideas of motivations are still important, but still not enough to predict behavior.

Mental Disorders

At first, this seemed to be an easy concept to understand for early researchers. Mental disorders are seen through the underlying symptoms someone exhibits. People’s behavior is the result of some earlier mental disorder and judged accordingly. However, Rosenhan (1973), in a series of experiments, showed this judgment can be wrong. He conducted a series of experiments in a psychiatric hospital, and derived results using the same group of people. Recording the judgment of others, on the first trial, people were judged insane, whereas in the second trial, they were judged sane. Therefore, mental disorders can be diagnosed through symptoms. His conclusion was that psychiatric diagnoses are not objective, and probably the worst place to see this is in an actual psychiatric hospital. If we cannot get the right diagnosis, even in a hospital with specialists designed to treat mental illnesses, how could we ever expect to predict future behavior. The above discussion shows some attempts over the years have been made to understand why people behave the way they do, and eventually can behavior be predicted, but the results are not promising.

As I am writing this book, I am eating a donut. However, it’s only the one donut that I had all week, so I didn’t change my diet, but I did modify my diet limiting to one donut. It’s one of those low-sugar donuts; it says so on the box, so I am persuaded to eat the donut, and I found a link for healthy banana donuts with chocolate glaze, and even a skinny donut at 60 calories (i.e., my confirmation bias), so perhaps I will have two then. Therefore, if we cannot predict whether I will have one or two donuts, we cannot predict behavior of an attacker. We could then have problems modifying our own behavior guarding against these cyber attacks. However, if we can understand why things get in the way of our thinking, and subsequent behaviors, then possibly at times (e.g., creating a cybersecurity solution), we can make better products and services, implement them better, and not worry about the attacker’s behavior, for now anyway.

When I Want Your Opinion, I’ll Give It to You

I think everyone has heard the above phrase:

Common synonyms: belief, conviction, eye, feeling, judgment, mind, notion, persuasion, sentiment, verdict, view. A view, judgment, formed about a matter, conviction, notion. Basically, anything can that be formed, changed, modified in a setting. So, we read about loss of millions of personal data from the US Federal Government’s Office of Personnel Management (OPM), Equifax, Target, Facebook, Yahoo, eBay, TJX, Capital One, Marriott Hotels, Adult Friend Finder, Uber, JP Morgan, Sony, and the countless others.

Then we see stories like:

I am often left to wonder after reviewing the root causes of hundreds of security attacks, employees are never mentioned in the actual attack itself. Some trusted relationship got compromised, an infected .dll was loaded during a patch upgrade, e-mail retention policies, and other items that employees would have no power to interact with anyway.

Therefore, whose opinion is it that the employees are always at fault?

We have to be careful here that we don’t fall into the illusion of control (Langer 1975). My opinion as a cybersecurity expert is better than that of an end-user employee, and certainly better than management. My expectancy of success in implementing security solutions is inappropriately higher than probability would dictate. Therefore, my prediction is better on any solution I implement since I have more control over that implementation. This illusion of control grows as my familiarity of the solution I am implementing, my choice of the solution, and my experiences. It’s the same way that I go to a store, see 50 different lotteries tickets, and I buy four tickets. I then rationalize I will have more success with the four that I choose, then just asking the clerk to give me four random tickets. So, on it goes, and end-employees will blame the security administrators, management will blame the end users, security administrators blame both, after all it’s

The Psychology of Blame—just working overtime.

Cybersecurity Implications and Conclusions

At the outset of writing this book, I assumed there would be more than enough literature to motivate what drives someone’s behavior.

To that end, there is a lot; it’s just that no one agrees.

What motivates our behavior? Well, it seems there are a lot of factors that motivate our behavior, and as in other research fields I am sure over time we will refine and rethink these knowledge areas, and hopefully being closer to predict behavior a little better. In cybersecurity, Iulia, Reeder, and Consolvo (2015) examined the differences in good cybersecurity practices from security experts and nonsecurity experts. As usual there were differences in any subject; if you walk into a room with 20 cybersecurity experts and ask them the best way to safeguard an organization, expect 20 answers; all good actually. If you want to get into a heated argument, attend an information technology conference. I attended a conference about a decade ago, and the topic was, “Should we call it information technology or information systems?” The argument got so heated I thought a fight was about to break out. Fast forward to the present, should we call it information security, information assurance, network security, operations security, cybersecurity? Get ready for the sparks to fly. In Iulia, Reeder, and Consolvo’s work, it wasn’t that the nonexpert practiced bad security habits, they just did not practice the same habits as security experts would recommend. For example, nonexperts practiced changing passwords, strong passwords, using antivirus software as best security practices, and security experts said using multifactor authentication was the best practice.

Were they both correct? Absolutely!

It’s just a difference of opinion whose is best—one set of neural networks tells one group something is best, while another set of neural networks tells a different group something else is better. Given their understanding of the concept of security and their perceptions of threats they faced, both groups applied the most appropriate security measures. One result that was suggested was that some nonexperts do not install updates due to the lack of awareness of how effective updates are, which was their perception. They also noted on additional responses that non-experts said they were not sure if always updating software is safe, and given that at times, updating patches something caused unexpected consequences, again, their perceptions could be influencing their behavior at both extremes. These results might give emphasis that cybersecurity experts should try to help those who do not understand or perceive threats accurately, as we have written about earlier, not in an authoritative way, but by building a relationship. This may motivate them to practice stronger security practices, away from well the company is forcing me to, and combined with the social learning we looked at earlier may encourage even more participation of stronger security practices. We have seen it’s almost impossible to predict behavior; the further out we go, how one behaves today will not be the same way they behave tomorrow, in a week, in a month, in a year, or in a decade. Therefore, we can’t change someone’s else’s behavior outright, but we can modify ours to help them modify theirs. I’ve pointed out in this book so many ways we harm ourselves, like the saying goes:

We are our own worst enemy.

It’s true that our own cognitive abilities, thinking, neural network associations, stereotypes, everything has an impact on our decisions, and ultimately our behavior. If we can spot these and understand why these things happen, then perhaps we can all make cybersecurity decisions, like the saying goes life does get in the way.