How “What you think you know about cybersecurity” can help users make more secure decisions

2023 | Information & Management | Citations: 0

Authors: Fard Bahreini, Amir; Cavusoglu, Hasan; Cenfetelli, Ronald T.

Abstract: The increasing use of information technology artifacts in daily life makes secur ... Expand

Abstract: The increasing use of information technology artifacts in daily life makes security a shared responsibility of both users and companies. In recent years, increasing a user’s objective (i.e., actual) security knowledge and providing applications with more secure default settings appear among the most ubiquitous tools companies use to broaden their efforts to help users make more secure decisions. Examining both solutions matters because they are widely used, cost effective, and understood by many security practitioners. Additionally, default settings and users’ objective knowledge provide anchors for decision-making. However, human errors and insecure default settings are increasing and raising further questions about the efficacy of such efforts. Using the theory of bounded ra­ tionality, we investigated the role of objective, subjective (i.e., self-assessed) security knowledge, and default settings security level on the overall decision security. We found that objective security knowledge can lead to secure decisions when paired with high subjective security knowledge. In the absence of the latter, objective security knowledge is unable to lead to better security decisions. Furthermore, subjective security knowledge reduces the extent to which users fully accept default security settings, thereby mitigating bias toward insecure default settings. Collapse

Topics: mobile application data security decision making self efficacy mobile application market

Methods: survey descriptive statistic structural equation modeling literature study post-hoc analysis

Theories: theory of bounded rationality

Cybersecurity compliance behavior: Exploring the influences of individual decision style and other antecedents

2020 | International Journal of Information Management | Citations: 11

Authors: Donalds, Charlette; Osei-Bryson, Kweku-Muata

Abstract: Recent information and cybersecurity research have focused on improving individu ... Expand

Abstract: Recent information and cybersecurity research have focused on improving individuals’ security compliance behavior. However, improved security performance remains a challenge since individuals often fail to comply with security best practices. In this study, we investigate a new individual cybersecurity compliance behavior model proposed by Donalds and Osei-Bryson (2017). Specifically, we investigate the influence of individual decision styles on their cybersecurity compliance behavior and other antecedents of such behavior. To empirically validate the hypotheses in the Donalds & Osei-Bryson model, we used data collected from 248 individuals and then use multiple regression to examine the assertions of the model. Our findings confirm that individual’s decision styles, specifically, dominant orientation and dominant decision style, influence their individual cybersecurity compliance behavior and other antecedents of such behavior. Our research offers new dimensions for investigating individual cybersecurity compliance behavior and new insights into factors that may influence individual’s cybersecurity compliance behavior. Collapse

Topics: IT security self efficacy password decision making information system use

Methods: survey regression analysis method theory development decision tree classification data transformation

Theories: theory of abduction measurement theory

Refining Technology Threat Avoidance Theory

2019 | Communications of the Association for Information Systems | Citations: 4

Authors: Carpenter, Darrell; Young, Diana K.; Barrett, Paul; McLeod, Alexander J.

Abstract: Understanding individual threat avoidance motivation and behavior is a critical ... Expand

Abstract: Understanding individual threat avoidance motivation and behavior is a critical component in designing effective cyber security solutions for both users and organizations. Technology threat avoidance theory (TTAT) asserts that individuals’ perceptions regarding their susceptibility to and the resulting severity of technology threats influence their awareness of the threats, which, in turn, influences their motivation and behavior to avoid them. While TTAT provides cogently and logically explains individuals’ technology threat motivations and behaviors, empirical tests have produced equivocal results particularly in terms of the influence of susceptibility and severity on threat perceptions. Due to these inconsistencies in the threat calculus involving susceptibility, severity, and threat, we need more work to improve and understand individual threat motivations. Additionally, TTAT does not account for individual differences such as risk propensity, distrust propensity, and impulsivity that have been shown to affect cyber security behavior. To address these gaps, we present an empirical assessment of a refined TTAT model, which includes individual differences and models the influence of susceptibility on threat perceptions as partially mediated by severity. Results indicate that, while perceived susceptibility is a significant predictor of threat perceptions, severity perceptions partially mediates its effect. Our results also support the inclusion of risk propensity and distrust propensity in the TTAT model as personal characteristics that significantly affect overall threat perceptions. Collapse

Topics: self efficacy malware spyware IT security decision making

Methods: survey structural equation modeling statistical power analysis survey design partial least squares regression

Theories: technology threat avoidance theory

The Tularosa Study: An Experimental Design and Implementation to Quantify the Effectiveness of Cyber Deception

2019 | HICSS | Citations: 0

Authors: Ferguson-Walter, Kimberly J; Shade, Temmie B; Rogers, Andrew V; Niedbala, Elizabeth M; Trumbo, Michael C; Nauer, Kevin; Divis, Kristin M; Jones, Aaron P; Combs, Angela; Abbott, Robert G

Abstract: The Tularosa study was designed to understand how defensive deception–including ... Expand

Abstract: The Tularosa study was designed to understand how defensive deception–including both cyber and psychological–affects cyber attackers. Over 130 red teamers participated in a network penetration task over two days in which we controlled both the presence of and explicit mention of deceptive defensive techniques. To our knowledge, this represents the largest study of its kind ever conducted on a professional red team population. The design was conducted with a battery of questionnaires (e.g., experience, personality, etc.) and cognitive tasks (e.g., fluid intelligence, working memory, etc.), allowing for the characterization of a “typical” red teamer, as well as physiological measures (e.g., galvanic skin response, heart rate, etc.) to be correlated with the cyber events. This paper focuses on the design, implementation, data, population characteristics, and begins to examine preliminary results. Collapse

Topics: Linux personality laptop computer decision making internet technology

Methods: experiment survey biometric measurement descriptive statistic experimental design

Freeware Downloads: An Empirical Investigation Into the Impact of Expert and User Reviews On Demand for Digital Goods

2007 | Americas Conference on Information Systems | Citations: 25

Authors: Amblee, Naveen; Bui, Tung

Abstract: Electronic word-of-mouth, or eWOM, on e-commerce platforms has become ubiquitous ... Expand

Abstract: Electronic word-of-mouth, or eWOM, on e-commerce platforms has become ubiquitous and has recently generated renewed interest among researchers to explore its impact in the e-marketplace. However, published research to date has yet to study the impact of expert reviews on digital goods and their combined impact with users’ reviews. In this paper, we conduct an empirical study of 143 freeware to measure the impact of two distinct types of eWOM, those produced by experts (professional reviewers) and those offered by users (consumers) on the number of downloads. Despite the fundamental difference in motivations of posting a review, our findings suggest that the impacts of both types of eWOM are nearly identical in significance and importance. While we found that the existence of either or both types of reviews impacts consumption (software download), the review valence does not matter. The findings of this research could help e-commerce operators – intermediaries and direct sellers alike – integrate eWOM in the formulation of their e-business models. Collapse

Topics: digital good word of mouth online word of mouth electronic commerce price management

Methods: descriptive statistic parametric test Student's t-test linear regression analysis

An Empirical Investigation of Herding on the Internet: The Case of Software Downloading

2005 | International Conference on Information Systems | Citations: 0

Authors: Duan, Wenjing; Gu, Bin; Whinston, Andrew

Abstract: Online shopping often requires consumers to choose among multiple products witho ... Expand

Abstract: Online shopping often requires consumers to choose among multiple products without detailed information about the quality. Herding is common in such situations which require consumers to infer product quality from other consumers’ choices and incorporate that information into their own decision-making process. The Internet affects the herding phenomenon in two ways. On the one hand, it provides more information about other consumers’ choices, making herding more feasible. On the other hand, the Internet provides more details about product quality, thus making herding less desirable. In this paper, we empirically examine those two effects in the context of online software downloading. We collected data on daily software downloads and studied how the daily download market share is related to the cumulative number of downloads and to the professionals’ and users’ ratings. We find significant herd behavior in our analysis of customers’ software choices. Surprisingly, the provision of professional product reviews or user reviews does not have a significant influence on the herding phenomenon. Our results suggest that consumers are in favor of information inferred from others’ behavior, but choose to ignore other sources of information. Such results are consistent with the predictions of the informational cascades literature. Our results also indicate that the vast amount of information provided on the Internet may not have as great an impact on consumer decision-making as previously expected. This paper contributes to e-commerce and Internet marketing research by investigating and offering a more in-depth understanding of online consumer behavior. This paper also contributes to the emerging literature on the impact of virtual communities. Collapse

Topics: internet technology consumer behavior price management electronic commerce online review

Methods: longitudinal research product review descriptive statistic