We identify three risk-related behaviors in coping with cyber threats—the exposure to risk a person chooses, use of security features, and responses to security indications. The combinations of behaviors that users choose determine how well they cope with threats and the severity of adverse events they experience.
Background:
End users’ coping with risks is a major factor in cybersecurity. This behavior results from a combination of risk-related behaviors rather than from a single risk-taking tendency.
Method:
In two experiments, participants played a Tetris-like game, attempting to maximize their gains, while exogenous occasional attacks could diminish earnings. An alerting system provided indications about possible attacks, and participants could take protective actions to limit the losses from attacks.
Results:
Variables such as the costs of protective actions, reliability of the alerting system, and attack severity affected the three behaviors differently. Also, users dynamically adjusted each of the three risk-related behaviors after gaining experience with the system.
Conclusion:
The results demonstrate that users’ risk taking is the complex combination of three behaviors rather than the expression of a general risk-taking tendency. The use of security features, exposure to risk, and responses to security indications reflect long-term strategy, short-term tactical decisions, and immediate maneuvering in coping with risks in dynamic environments.
Application:
The results have implications for the analysis of cybersecurity-related decisions and actions as well as for the evaluation and design of systems and targeted interventions in other domains.
AlbrechtsenE. (2007). A qualitative study of users’ view on information security. Computers & Security, 26, 276–289.
3.
BahrG. S.FordR. A. (2011). How and why pop-ups don’t work: Pop-up prompted eye movements, user affect and decision making. Computers in Human Behavior, 27(2), 776–783.
4.
Ben-AsherN.GonzalezC. (2015). Effects of cyber security knowledge on attack detection. Computers in Human Behavior, 48, 51–61.
5.
Ben-AsherN.MeyerJ.ParmetY.MoellerS.EnglerR. (2010). An experimental microworld for evaluating the tradeoffs between usability and security. Usable Security Experiment Reports (USER) Workshop in the Symposium on Usable Privacy and Security (SOUPS). New York, NY: ACM SIGCHI.
6.
BlissJ.GilsonR.DeatonJ. (1995). Human probability matching behaviour in response to alarms of varying reliability. Ergonomics, 38, 2300–2312.
7.
BotzerA.MeyerJ.BakP.ParmetY. (2010). User settings of cue thresholds for binary categorization decisions. Journal of Experimental Psychology: Applied, 16, 1–15.
8.
Bravo-LilloC.CranorL. F.DownsJ.KomanduriS. (2011). Bridging the gap in computer security warnings: A mental model approach. IEEE Security & Privacy, 9(2), 18–26.
9.
BromileyP.CurleyS. (1992). Individual differences in risk taking. In YatesJ. F. (Ed.), Risk taking behavior (pp. 87–132). New York, NY: John Wiley.
10.
BuchananL.D′AmicoA.KirkpatrickD. (2016, October). Mixed method approach to identify analytic questions to be visualized for military cyber incident handlers. Paper presented at the 2016 IEEE Symposium on Visualization for Cyber Security (VizSec), Baltimore, MD.
11.
CanfieldC. I.FischoffB.DavisA. (2016). Quantifying phishing susceptibility for detection and behavior decisions. Human Factors, 58, 1158–1172.
12.
CranorL. (2008). A framework for reasoning about the human in the loop. In Proceedings of the 1st Conference on Usability, Psychology and Security (pp. 1–15). Berkeley, CA: USENIX Association.
13.
DixonS. R.WickensC. D.McCarleyJ. S. (2007). On the independence of compliance and reliance: Are automation false alarms worse than misses?Human Factors, 49, 564–572.
14.
EgelmanS.CranorL.HongJ. (2008). You’ve been warned: An empirical study of the effectiveness of web browser phishing warnings. In Proceeding of the 26th Annual ACM SIGCHI Conference on Human Factors in Computing Systems—CHI 2008 (pp. 1065–1074). New York, NY: ACM.
15.
GreenD.SwetsJ. (1966). Signal detection theory and psychophysics. New York, NY: Wiley.
16.
HerleyC. (2009). So long, and no thanks for the externalities: The rational rejection of security advice by users. In Proceedings of the 2009 ACM Workshop on New Security Paradigms (pp. 133–144). New York, NY: ACM SIGCHI.
17.
HerreroJ.UrueñaA.TorresA.HidalgoA. (2016). My computer is infected: The role of users’ sensation seeking and domain-specific risk perceptions and risk attitudes on computer harm. Journal of Risk Research, 20, 1466–1479. doi: 10.1080/13669877.2016.1153504
18.
HoJ.DearmanD.TruongK. (2010). Improving users’ security choices on home wireless networks. In Proceedings of the Sixth ACM Symposium on Usable Privacy and Security (pp. 1–12). New York, NY: ACM SIGCHI.
19.
KahnemanD.TverskyA. (1979). Prospect theory: An analysis of decision under risk. Econometrica: Journal of the Econometric Society, 47, 263–291.
20.
KaindaR.FlechaisI.RoscoeA. (2010, February). Security and usability: Analysis and evaluation. Paper presented at the 2010 International IEEE Conference on Availability, Reliability and Security, Krakow, Poland.
21.
KottA.ArnoldC. (2013). The promises and challenges of continuous monitoring and risk scoring. IEEE Security & Privacy, 11(1), 90–93.
22.
LangeM.KottA.Ben-AsherN.MeesW.BaykalN.ViduC. M.. . .MadaharB. (2017). Recommendations for model-driven paradigms for integrated approaches to cyber defense. arXiv preprint arXiv:1703.03306.
MeyerJ.LeeJ. D. (2013). Trust, reliance and compliance. In LeeJ. D.KirlikA. (Eds.), The Oxford handbook of cognitive engineering (pp. 109–124). Oxford, UK: Oxford University Press.
31.
MeyerJ.SheridanT. B. (2017). The intricacies of user adjustment of alerting thresholds. Human Factors, 59, 901–910.
32.
MeyerJ.WiczorekR.GünzlerT. (2014). Measures of reliance and compliance in aided visual scanning. Human Factors, 56, 840–849.
33.
ModicD.AndersonR. J. (2014). Reading this may harm your computer: The psychology of malware warnings. Computers in Human Behavior, 41, 71–79.
34.
MöllerS.Ben-AsherN.EngelbrechtK.-P.EnglertR.MeyerJ. (2011). Modeling the behavior of users who are confronted with security mechanisms. Computers & Security, 30, 242–256.
35.
MosierK.SkitkaL. (1996). Human decision makers and automated decision aids: Made for each other. In ParasuramanR.MoulouaM. (Eds.), Automation and human performance: Theory and applications (pp. 201–220). Mahwah, NJ: Lawrence Erlbaum.
36.
NgB.KankanhalliA.XuY. (2009). Studying users’ computer security behavior: A health belief perspective. Decision Support Systems, 46, 815–825.
ParasuramanR. (2000). Designing automation for human use: Empirical studies and quantitative models. Ergonomics, 43, 931–951.
39.
ParasuramanR.ManzeyD. (2010). Complacency and bias in human use of automation: An attentional integration. Human Factors, 52, 381–410.
40.
PfleegerS. L.SasseM. A.FurnhamA. (2014). From weakest link to security hero: Transforming staff security behavior. Journal of Homeland Security and Emergency Management, 11(4), 489–510.
41.
ProctorR. W.ChenJ. (2015). The role of Human Factors/Ergonomics in the science of security: Decision making and action selection in cyberspace. Human Factors, 57, 721–727.
42.
SasseA.BrostoffS.WeirichD. (2001). Transforming the “weakest link”—A human/computer interaction approach to usable and effective security. BT Technology Journal, 19, 122–131.
43.
SchechterS.DhamijaR.OzmentA.FischerI. (2007). The emperor’s new security indicators: An evaluation of website authentication and the effect of role playing on usability studies. In Proceedings of the 2007 IEEE Symposium on Security and Privacy (pp. 51–65). Piscataway, NJ: IEEE.
SunshineJ.EgelmanS.AlmuhimediH.AtriN.CranorL. (2009). Crying wolf: An empirical study of SSL warning effectiveness. In Proceedings of the 18th Conference on USENIX Security Symposium (pp. 399–416). Berkeley, CA: USENIX Association.
46.
VanceA.AndersonB. B.KirwanC. B.EargleD. (2014). Using measures of risk perception to predict information security behavior: Insights from electroencephalography (EEG). Journal of the Association for Information Systems, 15, 679–722.
47.
VashitzG.MeyerJ.ParmetY.PelegR.GoldfarbD.PorathA.GilutzH. (2009). Defining and measuring physicians’ responses to clinical reminders. Journal of Biomedical Informatics, 42, 317–326.
48.
WhitmanM.MattordH. (2011). Principles of information security. Boston, MA: Cengage Learning.
49.
WildeG. (1982). The theory of risk homeostasis: Implications for safety and health. Risk Analysis, 2, 209–225.
50.
WogalterM. S. (2006). Handbook of warnings. Mahwah, NJ: Lawrence Erlbaum.
51.
WorkmanM.BommerW.StraubD. (2008). Security lapses and the omission of information security measures: A threat control model and empirical test. Computers in Human Behavior, 24, 2799–2816.
52.
YueW. T.ÇakanyıldırımM. (2010). A cost-based analysis of intrusion detection system configuration under active or passive response. Decision Support Systems, 50, 21–31.
