[论文解读] Cyber Security Awareness Campaigns: Why do they fail to change behaviour?

Maria Bada, Angela Sasse+1 more|arXiv (Cornell University)|Jan 9, 2019

Behavioral Health and Interventions参考文献 25被引用 197

一句话总结

本论文分析为什么网络安全意识宣传活动常未能改变用户行为，借助心理学识别影响风险认知、动机以及接纳建议的因素。

ABSTRACT

The present paper focuses on Cyber Security Awareness Campaigns, and aims to identify key factors regarding security which may lead them to failing to appropriately change people's behaviour. Past and current efforts to improve information-security practices and promote a sustainable society have not had the desired impact. It is important therefore to critically reflect on the challenges involved in improving information-security behaviours for citizens, consumers and employees. In particular, our work considers these challenges from a Psychology perspective, as we believe that understanding how people perceive risks is critical to creating effective awareness campaigns. Changing behaviour requires more than providing information about risks and reactive behaviours - firstly, people must be able to understand and apply the advice, and secondly, they must be motivated and willing to do so - and the latter requires changes to attitudes and intentions. These antecedents of behaviour change are identified in several psychological models of behaviour. We review the suitability of persuasion techniques, including the widely used 'fear appeals'. From this range of literature, we extract essential components for an awareness campaign as well as factors which can lead to a campaign's success or failure. Finally, we present examples of existing awareness campaigns in different cultures (the UK and Africa) and reflect on these.

研究动机与目标

• 确定影响信息安全行为改变的关键心理因素。
• 批判性评估意识宣传如何处理风险感知、动机以及落实建议的能力。
• 提炼有效宣传的关键组成部分与潜在失败因素。
• 讨论不同文化背景下的宣传案例（英国与非洲）的相关意义。

提出的方法

• 对与安全宣传相关的基于心理学的行为模型的现有文献进行评审。
• 评估劝说技巧及宣传中的恐惧诉求的使用。
• 从文献中提炼出有效意识宣传的关键组成部分。
• 讨论跨文化的宣传案例以说明挑战与机遇。

实验结果

研究问题

• RQ1 哪些心理因素决定人们是否能准确感知网络风险并被激励去改变行为？
• RQ2 意识宣传的哪些要素与成功的行为改变相关，哪些导致失败？
• RQ3 说服技巧（包括恐惧诉求）如何影响网络安全宣传的效果？
• RQ4 从不同文化背景的宣传案例中可以得出哪些设计更好宣传的经验教训（如英国与非洲）？

主要发现

• 宣传成功取决于既要理解又要应用建议，而不仅仅是提供风险信息。
• 态度与意图是行为改变的前因，受行为心理模型影响。
• 劝说技巧和恐惧诉求的效果参差不齐，须针对情境和受众进行定制。
• 有有效宣传的核心要素包括风险沟通、相关性、动机，以及对执行指南的支持。
• 文化背景影响宣传的接受度与效果，本文讨论英国与非洲的案例。