

‘No, I absolutely do not wish to change my password, thanks.’ Shutterstock/




Advice unfit for the real world





WhatsApp introduced encrypted chats in April 2016. Shutterstock/Kaspars Grinvalds


It’s for this reason that prominent bank marketing is aimed at making customers feel safe, while security advice is buried in places banks know customers don’t read. Despite complaints from consumer groups like Which? to the Payment Systems Regulator, so far banks have got away with this.

Out of your hands

Giving good security advice is hard because very often individuals have little or no effective control over their security. For example, the extent to which a customer is at risk of being defrauded largely depends on how good their bank’s security is, something customers cannot know.


Keeping your computer or smartphone software up-to-date is good advice, but is only any use if the device’s manufacturer provides security updates and ensures that they’re tested and don’t cause more problems than they solve.

It is precisely because security is so often out of the hands of individuals that the new UK National Cyber Security Centre (NCSC) has focused its advice on helping companies improve security, without placing an undue burden on the customer (or even requiring them to read the advice). Its passwords guidance shows how companies can remain secure even when most of their customers choose fairly simple passwords. This advice was developed in collaboration with the Research Institute in Science of Cyber Security (RISCS) which promotes evidence-based research.

NCSC chief executive Ciaran Martin promoted this guidance at an event in February, and at the CyberUK event in Liverpool last month. And in March, NCSC launched a video explaining that “If security does not work for people, it doesn’t work”. This workable security advice, based on RISCS research, is having an effect: the government no longer recommends regularly changing passwords, because doing so has been shown to have a harmful effect on security. However, Cyber Aware, another government website, still offers advice to consumers that is out-of-date and counterproductive.

Customers do want to protect themselves, and there is a clear demand for good security advice. But this advice needs to be realistic, needs to consider that different individuals have different circumstances that require different approaches, and put the interests of the customer first. Companies that develop security systems are in the best position to improve security, and they must take responsibility for doing so by learning from the research that reveals how individuals really use, understand, and misunderstand security technology.