Öryggiskröfu

Öryggiskröfu is a term used in Icelandic discussions of information security to describe the tension that arises when intensifying security measures creates user friction, which in turn can reduce overall protection. The concept is closely associated with usability and risk management, and it is often invoked in debates about consumer software, online services, and critical infrastructure.

Etymology and scope: The term combines öryggi, meaning security or safety, with kröfu, meaning demand or requirement. It originated in Nordic information security discourse in the late 2010s and is used to name a pattern in which stricter controls lead to weaker adoption, circumvention, or risky workarounds.

Mechanisms and consequences: Common manifestations include frequent password changes, mandatory multi-factor authentication prompts, device binding, and aggressive access controls. When these controls hamper usability, users may bypass protections, lose trust, or abandon services, thereby enabling vulnerabilities to persist or grow.

Mitigation and critique: Proponents advocate risk-based, user-centered approaches that balance protection with convenience, such as adaptive authentication, gradual policy rollout, and clear user education. Critics warn against overgeneralizing the effect or using the term to excuse sloppy security practices.

See also: Usability in security, security fatigue, risk compensation, human factors in information security.