Rewind

While past work has examined password usage on a specific computer, web site, or organization, there is little work examining overall password usage in daily life. Through a diary study, we examine all usage of passwords, and offer some new findings based on...

This paper reports findings from a multi-method set of four studies that investigate why we continue to fall for phish. Current security advice suggests poor spelling and grammar in emails can be signs of phish. But a content analysis of a phishing archive indicates...

What is it that makes people fall for email scams? This analysis concluded that scammers are most concerned about building solidarity with their victims and playing to a mark’s egocentrism, which both ultimately prevent victims from making well-informed decisions....

Phishers are fraudsters that mimic legitimate websites to steal user’s credential information and exploit that information for identity theft and other criminal activities. Various anti-phishing techniques attempt to mitigate such attacks. Domain highlighting is one...

Interventions and policies to change behaviour can be usefully characterised by means of a BCW comprising: a 'behaviour system' at the hub, encircled by intervention functions and then by policy categories. Research is needed to establish how far the BCW can lead to...

Computer security warnings are intended to protect users and their computers. However, research suggests that users frequently ignore these warnings. The authors describe a study designed to gain insight into how users perceive and respond to computer alerts.  

Effective user security awareness campaign can greatly enhance the information assurance posture of an organization. Information security includes organizational aspects, legal aspects, institutionalization and applications of best practices in addition to security...

This study evaluated the digital skills of 25,000 European internet users aged 9-16 by examining their online activities, skills, and self-efficacy. It was found that the range of digital skills is linked to the variety of online activities. However, many children in...

Deterrence theory is one of the most widely applied theories in information systems (IS) security research, particularly within behavioral IS security studies. Based on the rational choice view of human behavior, the theory predicts that illicit behavior can be...

The primary purpose of this research was to examine the adoption of computer security software in the home computer environment. The use of the Health Belief Model as a framework to design a model to examine home user adoption of computer security provided the basis...

We examine the cost for an attacker to pay users to execute arbitrary code—potentially malware. We asked users at home to download and run an executable we wrote without being told what it did and without any way of knowing it was harmless. Each week, we increased the...

Traditional typologies of consumer privacy concern suggest that consumers fall into three distinct groups: One-fourth of consumers are not concerned about privacy, one-fourth are highly concerned, and half are pragmatic, in that their concerns about privacy depend on...

This paper measured leadership and need for cognition alongside decision making, concluding both need for cognition and leadership moderate susceptibility to decision-making biases.  

A study of 425 people suggested perceived severity of security threats has no significant influence on security attitudes, and that more technically literate users resist manditory security implementations moreso than less technically literate users.  

This paper's authors argue self-deception is an evolved trait with the evolutionary advantage of helping deceive others without severe cognitive strain. They suggest self-decpetion – which should in theory be paradoxical – is actually achieved through dissociations of...

This report provides an overview international cyber-security awareness raising and educational initiatives.    

We congratulate Ernesa¨ter et al. on their study of incident reporting in nurse-led telephone triage in Sweden. The reporting of errors is crucial to the process of error management. If adverse incidents are to be minimised, organisations must learn from their...

The purpose of this paper is to examine why mainstream information security awareness techniques have failed to evolve at the same rate as automated technical security controls and to suggest improvements based on psychology and safety science.

We propose a training program based on two theories: the universal constructive instructional theory and the elaboration likelihood model. We then validate the training program for IS security policy compliance training through an action research project. The action...