Three Dimensions of User Risk-Taking: Individual Differences in the TriRB

Abstract

Ben-Asher and Meyer (2018) developed a model of risk-related behavior in computer systems, named the Triad of Risk-related Behavior (TriRB). It identified three behaviors – the exposure to risk, the use of security features and the responses to security indications. Various factors affected the three behaviors differently. We report an experiment with 83 participants who performed the Tetris-game like task, designed for studying the TriRB. We also collected data on four measures of individual differences in risk-taking (BART, DOSPERT and questionnaires on assessing risk aversion in the utility functions). We computed the correlations between the behaviors in the TriRB and the risk measures. Different risk measures were correlated with the three behaviors, supporting the notion that these are indeed three different risk-related behaviors and not expressions of a general underlying tendency to take risks. We discuss some implications of these findings for cybersecurity research and praxis.

Get full access to this article

View all access options for this article.

References

Barsky

R. B.

, et al. (1997). Preference parameters and behavioral heterogeneity: An experimental approach in the health and retirement study. Quarterly Journal of Economics, 537-579.

Ben-Asher

Meyer

(2018).The Triad of Risk-related Behavior (TriRB): A three-dimensional model of cyber-risk taking. Human Factors, 60 (8), 1163-1178.

Holt

C. A.

Laury

S. K.

(2002). Risk aversion and incentive effects. American Economic Review, 92 (5), 1644-1655.

Lejuez

C. W.

, et al. (2002). Evaluation of a behavioral measure of risk taking: The Balloon Analogue Risk Task (BART). Journal of Experimental Psychology: Applied, 8 (2), 75-84.

Meyer

Bitan

(2002). Why better operators receive worse warnings. Human Factors, 44, 343-354.

Möller

Ben-Asher

Engelbrecht

K.-P.

Englert

Meyer

(2011). Modeling the behavior of users who are confronted with security mechanisms. Computers & Security, 30 (4), 242-256.

Proctor

R. W.

Chen

(2015). The role of human factors/ergonomics in the science of security: decision making and action selection in cyberspace. Human Factors, 57, 721-727.

Weber

E. U.

Blais

A.-R.

Betz

N. E.

(2002). A domain-specific risk-attitude scale: Measuring risk perceptions and risk behaviors. Journal of Behavioral Decision Making, 15 (4), 263-290.

Wiczorek

Zirk

(2018). Using warning systems with adaptable thresholds: Choice of security level, compliance and performance in a simulated computer security task. International Journal of Human-Computer Studies, 125, 32-40.