[Paper Review] Cyber Security Awareness Campaigns: Why do they fail to change behaviour?

Maria Bada, Angela Sasse+1 more|arXiv (Cornell University)|Jan 9, 2019

Behavioral Health and Interventions25 references197 citations

TL;DR

The paper analyzes why cyber security awareness campaigns often fail to change users’ behaviour, drawing on psychology to identify factors that influence perception of risk, motivation, and the application of advice.

ABSTRACT

The present paper focuses on Cyber Security Awareness Campaigns, and aims to identify key factors regarding security which may lead them to failing to appropriately change people's behaviour. Past and current efforts to improve information-security practices and promote a sustainable society have not had the desired impact. It is important therefore to critically reflect on the challenges involved in improving information-security behaviours for citizens, consumers and employees. In particular, our work considers these challenges from a Psychology perspective, as we believe that understanding how people perceive risks is critical to creating effective awareness campaigns. Changing behaviour requires more than providing information about risks and reactive behaviours - firstly, people must be able to understand and apply the advice, and secondly, they must be motivated and willing to do so - and the latter requires changes to attitudes and intentions. These antecedents of behaviour change are identified in several psychological models of behaviour. We review the suitability of persuasion techniques, including the widely used 'fear appeals'. From this range of literature, we extract essential components for an awareness campaign as well as factors which can lead to a campaign's success or failure. Finally, we present examples of existing awareness campaigns in different cultures (the UK and Africa) and reflect on these.

Motivation & Objective

• Identify key psychological factors that influence information-security behaviour change.
• Critically review how awareness campaigns address risk perception, motivation, and ability to apply advice.
• Extract essential components and potential failure factors for effective campaigns.
• Discuss examples of campaigns in different cultural contexts (UK and Africa) and their implications.

Proposed method

• Review of existing literature on psychology-based behaviour models relevant to security campaigns.
• Assessment of persuasion techniques and the use of fear appeals in campaigns.
• Extraction of essential components for effective awareness campaigns from the literature.
• Discussion of campaign examples across cultures to illustrate challenges and opportunities.

Experimental results

Research questions

• RQ1 What psychological factors determine whether people perceive cyber risks accurately and are motivated to change their behaviour?
• RQ2 Which elements of awareness campaigns are associated with successful behaviour change, and which lead to failure?
• RQ3 How do persuasion techniques, including fear appeals, influence the effectiveness of cyber security campaigns?
• RQ4 What lessons can be drawn from campaigns in different cultural contexts (e.g., UK and Africa) for designing better campaigns?

Key findings

• Campaign success depends on both understanding and applying advice, not just providing information about risks.
• Attitudes and intentions are precursors to behaviour change, influenced by psychological models of behaviour.
• Persuasion techniques and fear appeals have mixed effectiveness and must be tailored to context and audience.
• Essential components for effective campaigns include risk communication, relevance, motivation, and support for applying guidance.
• Cultural context affects campaign reception and effectiveness, with examples from the UK and Africa discussed.