Skip to main content
SpringerLink
Log in

A Quantitative Field Study of a Persuasive Security Technology in the Wild

  • Conference paper
  • First Online:
Social Informatics (SocInfo 2022)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 13618))

Included in the following conference series:

  • 995 Accesses

Abstract

Persuasive techniques and persuasive technologies have been suggested as a means to improve user cybersecurity behaviour, but there have been few quantitative studies in this area. In this paper, we present a large scale evaluation of persuasive messages designed to encourage University staff to complete security training. Persuasive messages were based on Cialdini’s principles of persuasion, randomly assigned, and transmitted by email. The training was real, and the messages sent constituted the real campaign to motivate users during the study period. We observed statistically significant variations, but with mild effect sizes, in participant responses to the persuasive messages. ‘Unity’ persuasive messages that had increased emphasis on the collaborative role of individual users as part of an organisation-wide team effort towards cybersecurity were more effective compared to ‘Authority’ messages that had increased emphasis on a mandatory obligation of users imposed by a hierarchical authority. Participant and organisational factors also appear to impact upon participant responses. The study suggests that the use of messages emphasising different principles of persuasion may have different levels of effectiveness in encouraging users to take particular security actions. In particular, it suggests that the use of social capital, in the form of increased emphasis of ‘unity’, may be more effective than increased emphasis of ‘authority’. These findings motivate further studies of how the use of Social capital may be beneficial for encouraging individuals to adopt similar positive security behaviours.

For open access, the author has applied a Creative Commons Attribution (CC BY) licence to any Author Accepted Manuscript version arising.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    Permission for using opt-out rather than opt-in consent was granted by the university ethics committee, and the emails made it very clear that participation in the study would not impact on work.

  2. 2.

    Grade refers to an ordered grouping of roles within the organisation.

  3. 3.

    This is after the exclusion of staff who opted-out, staff who were excluded as their anonymity could not be guaranteed, and cases where the data showed anomalies such as training being completed before the notifications were sent, e.g. IT staff testing access to the training.

References

  1. Acquisti, A.: Privacy in electronic commerce and the economics of immediate gratification. In: Proceedings of 5th ACM Conference on Electronic Commerce, pp. 21–29 (2004)

    Google Scholar 

  2. Acquisti, A.: Nudging privacy: the behavioral economics of personal information. IEEE Secur. Priv. 7(6), 82–85 (2009)

    Article  Google Scholar 

  3. Albrechtsen, E., Hovden, J.: Improving information security awareness and behaviour through dialogue, participation and collective reflection. an intervention study. Comput. Secur. 29(4), 432–445 (2010)

    Google Scholar 

  4. Anderson, R.J.: Security Engineering: A Guide to Building Dependable Distributed Systems. 2nd edn, Wiley, Hoboken (2008)

    Google Scholar 

  5. Ashenden, D., Lawrence, D.: Can we sell security like soap?: A new approach to behaviour change. In: Proceedings of 2013 New Security Paradigms Workshop, ACM (2013)

    Google Scholar 

  6. Atkins, B., Huang, W.: A study of social engineering in online frauds. Open J. Soc. Sci. 1(03), 23 (2013)

    Google Scholar 

  7. Atkins, L., et al.: A guide to using the theoretical domains framework of behaviour change to investigate implementation problems. Implementation Sci. 12(1), 77 (2017)

    Article  Google Scholar 

  8. Bada, M., Sasse, A., Nurse, J.R.: Cyber security awareness campaigns: why do they fail to change behaviour? In: international conference on Cyber Security for Sustainable Society (2015)

    Google Scholar 

  9. Balebako, R., et al.: Nuding users towards privacy on mobile phones. In: Procs of PINC2011: 2nd International Workshop on Persuasion, Influence, Nudge & Coercion through Mobile Devices, vol. 8 (2011)

    Google Scholar 

  10. Balebako, R., Marsh, A., Lin, J., Hong, J.I., Cranor, L.F.: The privacy and security behaviors of smartphone app developers. NDSS Symposium (2014)

    Google Scholar 

  11. Benson, V., McAlaney, J., Frumkin, L.A.: Emerging threats for the human element and countermeasures in current cyber security landscape. In: Psychological and Behavioral Examinations in Cyber Security, pp. 266–271. IGI Global (2018)

    Google Scholar 

  12. Blythe, J.: Cyber security in the workplace: understanding and promoting behaviour change. In: Bottoni, P., Matera, M. (eds.) Proceedings of the CHItaly 2013 Doctoral Consortium co-located with the 10th International Conference of the Italian SIGCHI Chapter (CHItaly 2013), Trento, Italy, 16 September 2013. CEUR Workshop Proceedings, vol. 1065, pp. 92–101. CEUR-WS.org (2013)

    Google Scholar 

  13. Blythe, J., Coventry, L., Little, L.: Unpacking security policy compliance: The motivators and barriers of employees’ security behaviors. In: S.O.U.P.S. 2015, pp. 103–122 (2015)

    Google Scholar 

  14. Blythe, J., Koppel, R., Smith, S.W.: Circumvention of security: good users do bad things. IEEE Secur. Priv. 11(5), 80–83 (2013)

    Article  Google Scholar 

  15. Briggs, P., Jeske, D., Coventry, L.: Behavior change interventions for cybersecurity. In: Behavior Change Research and Theory, pp. 115–136. Elsevier (2017)

    Google Scholar 

  16. Bulgurcu, B., Cavusoglu, H., Benbasat, I.: Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness. MIS quart. 34(3), 523–548 (2010)

    Article  Google Scholar 

  17. Button, M., Nicholls, C.M., Kerr, J., Owen, R.: Online frauds: learning from victims why they fall for these scams. Aust. NZ J. Criminol. 47(3), 391–408 (2014)

    Article  Google Scholar 

  18. Cartwright, N.: Evidence-based policy: what’s to be done about relevance? Philos. Stud. 143(1), 127–136 (2009)

    Article  Google Scholar 

  19. Chaiken, S., Trope, Y.: Dual-Process theories in Social Psychology. Guilford, New York (1999)

    Google Scholar 

  20. Chatterjee, S., Price, A.: Healthy living with persuasive technologies: framework, issues, and challenges. J. Am. Med. Inf. Assoc. 16(2), 171–178 (2009)

    Article  Google Scholar 

  21. Chenoweth, T., Minch, R., Gattiker, T.: Application of protection motivation theory to adoption of protective technologies. In: 2009 42nd Hawaii International Conference on System Sciences, pp. 1–10. IEEE (2009)

    Google Scholar 

  22. Chiasson, S., Stobert, E., Forget, A., Biddle, R., Van Oorschot, P.: Persuasive cued click-points: design, implementation, and evaluation of a knowledge-based authentication mechanism. IEEE Trans. Dependable Secure Comput. 9(2), 222–235 (2012)

    Article  Google Scholar 

  23. Choe, E.K., Jung, J., Lee, B., Fisher, K.: Nudging people away from privacy-invasive mobile apps through visual framing. In: Kotzé, P., Marsden, G., Lindgaard, G., Wesson, J., Winckler, M. (eds.) INTERACT 2013. LNCS, vol. 8119, pp. 74–91. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-40477-1_5

    Chapter  Google Scholar 

  24. Cialdini, R.: Pre-Suasion: A Revolutionary way to Influence and Persuade. Simon & Schuster, New York (2016)

    Google Scholar 

  25. Ciocarlan, A., Masthoff, J., Oren, N.: Kindness is contagious: study into exploring engagement and adapting persuasive games for wellbeing. In: Proceedings of 26th Conference on U.M.A.P, pp. 311–319. ACM (2018)

    Google Scholar 

  26. Coffey, J.W.: Ameliorating sources of human error in cybersecurity: technological and human-centered approaches. In: The 8th International Multi-Conference on Complexity, Informatics and Cybernetics, Pensacola, pp. 85–88 (2017)

    Google Scholar 

  27. Cohen, J.: Statistical power analysis. Curr. Dir. Psychol. Sci. 1(3), 98–101 (1992)

    Article  Google Scholar 

  28. Corradini, I.: Building a Cybersecurity Culture in Organizations. SSDC, vol. 284. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-43999-6

    Book  Google Scholar 

  29. Coventry, L., Briggs, P., Blythe, J., Tran, M.: Using behavioural insights to improve the public’s use of cyber security best practices (2014), uK GOV. Off. for Sci, Ref: GS/14/835

    Google Scholar 

  30. Coventry, L., Briggs, P., Jeske, D., van Moorsel, A.: SCENE: a structured means for creating and evaluating behavioral nudges in a cyber security environment. In: Marcus, A. (ed.) DUXU 2014. LNCS, vol. 8517, pp. 229–239. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-07668-3_23

    Chapter  Google Scholar 

  31. Craig, P., Dieppe, P., Macintyre, S., Michie, S., Nazareth, I., Petticrew, M.: Developing and evaluating complex interventions: the new medical research council guidance. Int. J. Nurs. Stud. 50(5), 587–592 (2013)

    Article  Google Scholar 

  32. Das, S., Kim, H., Dabbish, L., Hong, J.: The effect of social influence on security sensitivity. In: S.O.U.P.S. 2014. USENIX Association (2014)

    Google Scholar 

  33. Das, S., Kramer, A.D., Dabbish, L.A., Hong, J.I.: Increasing security sensitivity with social proof: a large-scale experimental confirmation. In: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pp. 739–749. ACM, New York (2014)

    Google Scholar 

  34. Dhillon, G., Backhouse, J.: Current directions in is security research: towards socio-organizational perspectives. I.S. J. 11(2), 127–153 (2001)

    Google Scholar 

  35. Dolan, P., Hallsworth, M., Halpern, D., King, D., Metcalfe, R., Vlaev, I.: Influencing behaviour: the mindspace way. J. Econ. Psychol. 33(1), 264–277 (2012)

    Article  Google Scholar 

  36. Douligers, C., Raghimi, O., Lourenco Barros, M., Marinos, L.: Enisa main incidents in the EU. Technical Report, European Union Agency for Cybersecurity (2020)

    Google Scholar 

  37. Dunn, O.J.: Multiple comparisons among means. J. Am. Stat. Assoc. 56(293), 52–64 (1961)

    Article  MathSciNet  MATH  Google Scholar 

  38. ENISA: cybersecurity culture guidelines: behavioural aspects of cybersecurity. Technical Report, European Union Agency for Network and Information Security (2019)

    Google Scholar 

  39. Evans, J.S.B.: Dual-processing accounts of reasoning, judgment, and social cognition. Annu. Rev. Psychol. 59, 255–278 (2008)

    Article  Google Scholar 

  40. Fogg, B.: Persuasive Technology: Using Computers to Change What We Think and Do. Morgan Kaufmann, Burlington (2003)

    Google Scholar 

  41. Fogg, B.J.: Creating persuasive technologies: an eight-step design process. In: Proceedings of the 4th International Conference on Persuasive Technology, p. 44. ACM (2009)

    Google Scholar 

  42. Forget, A., Chiasson, S., Biddle, R.: Persuasion as education for computer security. In: Bastiaens, T., Carliner, S. (eds.) Proceedings of E-Learn 2007-World Conference on E-Learning in Corporate, Government, Healthcare, and Higher Education, pp. 822–829 (2007)

    Google Scholar 

  43. Gallegos-Segovia, P.L., Bravo-Torres, J.F., Larios-Rosillo, V.M., Vintimilla-Tapia, P.E., Yuquilima-Albarado, I.F., Jara-Saltos, J.D.: Social engineering as an attack vector for ransomware. In: 2017 CHILEAN Conference on Electrical, Electronics Engineering, Information and Communication Technologies (CHILECON), pp. 1–6. IEEE (2017)

    Google Scholar 

  44. Gordon, S., Ford, R.: On the definition and classification of cybercrime. J. Comput. Virol. 2(1), 13–20 (2006)

    Article  Google Scholar 

  45. Greitzer, F.L., Strozer, J.R., Cohen, S., Moore, A.P., Mundie, D., Cowley, J.: Analysis of unintentional insider threats deriving from social engineering exploits. In: Security and Privacy Workshops (SPW), 2014 IEEE, pp. 236–250. IEEE (2014)

    Google Scholar 

  46. Grüne-Yanoff, T.: Why behavioural policy needs mechanistic evidence. Econ. Philos. 32(3), 463–483 (2016)

    Article  Google Scholar 

  47. Guo, K.H., Yuan, Y., Archer, N.P., Connelly, C.E.: Understanding nonmalicious security violations in the workplace: a composite behavior model. J. Manag. I.S. 28(2), 203–236 (2011)

    Google Scholar 

  48. Hamari, J., Koivisto, J., Pakkanen, T.: Do persuasive technologies persuade? - A review of empirical studies. In: Spagnolli, A., Chittaro, L., Gamberini, L. (eds.) PERSUASIVE 2014. LNCS, vol. 8462, pp. 118–136. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-07127-5_11

    Chapter  Google Scholar 

  49. Herath, T., Rao, H.R.: Encouraging information security behaviors in organizations: role of penalties, pressures and perceived effectiveness. Decis. Support Syst. 47(2), 154–165 (2009)

    Article  Google Scholar 

  50. Herath, T., Rao, H.R.: Protection motivation and deterrence: a framework for security policy compliance in organisations. Eur. J. I.S. 18(2), 106–125 (2009)

    Google Scholar 

  51. Hu, Q., Xu, Z., Dinev, T., Ling, H.: Does deterrence work in reducing information security policy abuse by employees? Comm. ACM 54(6), 54–60 (2011)

    Article  Google Scholar 

  52. Ifinedo, P.: Understanding information systems security policy compliance: an integration of the theory of planned behavior and the protection motivation theory. Comput. Secur. 31(1), 83–95 (2012)

    Article  Google Scholar 

  53. Ifinedo, P.: Information systems security policy compliance: an empirical study of the effects of socialisation, influence, and cognition. Inf. Manage. 51(1), 69–79 (2014)

    Article  Google Scholar 

  54. Jeong, J., Mihelcic, J., Oliver, G., Rudolph, C.: Towards an improved understanding of human factors in cybersecurity. In: 2019 IEEE 5th International Conference on Collaboration and Internet Computing (CIC), pp. 338–345. IEEE (2019)

    Google Scholar 

  55. Kankane, S., DiRusso, C., Buckley, C.: Can we nudge users toward better password management?: An initial study. In: Extended Abstracts of the 2018 CHI Conf. on Human Factors in Computing Systems, p. LBW593. ACM (2018)

    Google Scholar 

  56. Kirlappos, I., Beautement, A., Sasse, M.A.: “Comply or Die’’ is dead: long live security-aware principal agents. In: Adams, A.A., Brenner, M., Smith, M. (eds.) FC 2013. LNCS, vol. 7862, pp. 70–82. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-41320-9_5

    Chapter  Google Scholar 

  57. Kirlappos, I., Parkin, S., Sasse, M.A.: Learning from "shadow security": why understanding non-compliance provides the basis for effective security. In: Workshop on Usable Security (2014)

    Google Scholar 

  58. Kirlappos, I., Sasse, M.A.: Fixing security together: leveraging trust relationships to improve security in organizations. In: Proceedings of the NDSS Symposium 2015. Internet Society (2015)

    Google Scholar 

  59. Knapp, K.J., Marshall, T.E., Kelly Rainer, R., Nelson Ford, F.: Information security: management’s effect on culture and policy. Inf. Manage. Comput. Secur. 14(1), 24–36 (2006)

    Article  Google Scholar 

  60. LeFebvre, R.: The human element in cyber security: a study on student motivation to act. In: Proceedings of the 2012 Information Security Curriculum Development Conference, pp. 1–8. ACM (2012)

    Google Scholar 

  61. Love, L.F., Singh, P.: Workplace branding: leveraging human resources management practices for competitive advantage through “best employer” surveys. J. Bus. Psychol. 26(2), 175 (2011)

    Google Scholar 

  62. Maalem Lahcen, R.A., Caulkins, B., Mohapatra, R., Kumar, M.: Review and insight on the behavioral aspects of cybersecurity. Cybersecurity 3(1), 1–18 (2020). https://doi.org/10.1186/s42400-020-00050-w

    Article  Google Scholar 

  63. Malkin, N., Mathur, A., Harbach, M., Egelman, S.: Personalized security messaging: nudges for compliance with browser warnings. In: 2nd European Workshop on Usable Security. Internet Society (2017)

    Google Scholar 

  64. Masthoff, J., Grasso, F., Ham, J.: Preface to the special issue on personalization and behavior change. User Model. User-Adap. Inter. 24(5), 345–350 (2014). https://doi.org/10.1007/s11257-014-9151-1

    Article  Google Scholar 

  65. Michie, S., Atkins, L., West, R.: The Behaviour Change Wheel. A guide to Designing Interventions. 1st ed. Silverback, Great Britain (2014)

    Google Scholar 

  66. Michie, S., Johnston, M., Francis, J., Hardeman, W., Eccles, M.: From theory to intervention: mapping theoretically derived behavioural determinants to behaviour change techniques. Appl. Psychol. 57(4), 660–680 (2008)

    Article  Google Scholar 

  67. Michie, S., Van Stralen, M.M., West, R.: The behaviour change wheel: a new method for characterising and designing behaviour change interventions. Implementation Sci. 6(1), 42 (2011)

    Article  Google Scholar 

  68. Mitnick, K.D., Simon, W.L.: The Art of Intrusion: The Real Stories behind the Exploits of Hackers, Intruders and Deceivers. Wiley, Hoboken (2009)

    Google Scholar 

  69. Morisset, C., Groß, T., van Moorsel, A., Yevseyeva, I.: Nudging for quantitative access control systems. In: Tryfonas, T., Askoxylakis, I. (eds.) HAS 2014. LNCS, vol. 8533, pp. 340–351. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-07620-1_30

    Chapter  Google Scholar 

  70. Mouton, F., Leenen, L., Venter, H.S.: Social engineering attack examples, templates and scenarios. Comput. Secur. 59, 186–209 (2016)

    Article  Google Scholar 

  71. Ng, B.Y., Kankanhalli, A., Xu, Y.C.: Studying users’ computer security behavior: a health belief perspective. Decis. Support Syst. 46(4), 815–825 (2009)

    Article  Google Scholar 

  72. Oinas-Kukkonen, H., Harjumaa, M.: Persuasive systems design: key issues, process model and system features. In: Routledge Handbook of Policy Design, pp. 105–123. Routledge (2018)

    Google Scholar 

  73. Orji, R., Moffatt, K.: Persuasive technology for health and wellness: state-of-the-art and emerging trends. Health Inf. J. 24(1), 66–91 (2018)

    Article  Google Scholar 

  74. Pahnila, S., Siponen, M., Mahmood, A.: Employees’ behavior towards is security policy compliance. In: 40Th Annual Hawaii International Conference on System Sciences, HICSS 2007. pp. 156b–156b. IEEE (2007)

    Google Scholar 

  75. Raja, F., Hawkey, K., Hsu, S., Wang, K.L.C., Beznosov, K.: A brick wall, a locked door, and a bandit: a physical security metaphor for firewall warnings. In: S.O.U.P.S. 2011, p. 1. ACM (2011)

    Google Scholar 

  76. Rangel, A., Camerer, C., Montague, P.R.: A framework for studying the neurobiology of value-based decision making. Nat. Rev. Neurosci. 9(7), 545 (2008)

    Article  Google Scholar 

  77. Renaud, K., Zimmerman, V.: Nudging folks towards stronger password choices: providing certainty is the key. Behav. Public Policy 3(2), 1–31 (2018)

    Google Scholar 

  78. Rhodes, K.: Operations security awareness: the mind has no firewall. Comput. Secur. J. 17(3), 1–12 (2001)

    MathSciNet  Google Scholar 

  79. Rogers, R.W., Prentice-Dunn, S.: Protection motivation theory. Handbook of Health Behaviour Research 1 : Personal and Social Determinants, pp. 113–132 (1997)

    Google Scholar 

  80. Rousseau, D.M.: Psychological and implied contracts in organizations. Empl. Responsibilities Rights J. 2(2), 121–139 (1989)

    Article  Google Scholar 

  81. Schneier, B.: Secrets & Lies: Digital Security in a Networked World, 1st edn. Wiley, New York (2000)

    Google Scholar 

  82. Shillair, R., Cotten, S.R., Tsai, H.Y.S., Alhabash, S., LaRose, R., Rifon, N.J.: Online safety begins with you and me: convincing internet users to protect themselves. Comput. Hum. Behav. 48, 199–207 (2015)

    Article  Google Scholar 

  83. Siegel, S., Castellan, N.J.: Nonparametric Statistics for the Behavioral Sciences, 2nd edn. McGraw-Hill, New York (1988)

    Google Scholar 

  84. Simons, H.W., Jones, J.: Persuasion in Society. Taylor & Francis, New York (2011)

    Google Scholar 

  85. Siponen, M., Willison, R.: Information security management standards: problems and solutions. Inf. Manage. 46(5), 267–270 (2009)

    Article  Google Scholar 

  86. Siponen, M.T.: Analysis of modern is security development approaches: towards the next generation of social and adaptable ISS methods. Inf. Organ. 15(4), 339–375 (2005)

    Article  Google Scholar 

  87. Son, J.Y.: Out of fear or desire? toward a better understanding of employees’ motivation to follow is security policies. Inf. Manage. 48(7), 296–302 (2011)

    Article  Google Scholar 

  88. Spears, J.L., Barki, H.: User participation in information systems security risk management. MIS Quart. 34, 503–522 (2010)

    Article  Google Scholar 

  89. Stanton, J.M., Stam, K.R., Mastrangelo, P., Jolton, J.: Analysis of end user security behaviors. Comput. Secur. 24(2), 124–133 (2005)

    Article  Google Scholar 

  90. Strack, F., Deutsch, R.: Reflective and impulsive determinants of social behavior. Pers. Soc Psychol. Rev. 8(3), 220–247 (2004)

    Article  Google Scholar 

  91. Josekutty Thomas, R., Masthoff, J., Oren, N.: Adapting healthy eating messages to personality. In: de Vries, P.W., Oinas-Kukkonen, H., Siemons, L., Beerlage-de Jong, N., van Gemert-Pijnen, L. (eds.) PERSUASIVE 2017. LNCS, vol. 10171, pp. 119–132. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-55134-0_10

    Chapter  Google Scholar 

  92. Turland, J., Coventry, L., Jeske, D., Briggs, P., van Moorsel, A.: Nudging towards security: developing an application for wireless network selection for android phones. In: Proceedings of 2015 British HCI Conference, pp. 193–201. ACM (2015)

    Google Scholar 

  93. Valentine, J.A.: Enhancing the employee security awareness model. Comput. Fraud Secur. 2006(6), 17–19 (2006)

    Article  Google Scholar 

  94. Van Bruggen, D., Liu, S., Kajzer, M., Striegel, A., Crowell, C.R., D’Arcy, J.: Modifying smartphone user locking behavior. In: S.O.U.P.S. 2013, p. 10. ACM (2013)

    Google Scholar 

  95. Van Steen, T., Norris, E., Atha, K., Joinson, A.: What (if any) behaviour change techniques do government-led cybersecurity awareness campaigns use? J. Cybersecurity 6(1), tyaa019 (2020)

    Google Scholar 

  96. Vance, A., Siponen, M., Pahnila, S.: Motivating is security compliance: insights from habit and protection motivation theory. Inf. Manage. 49(3–4), 190–198 (2012)

    Article  Google Scholar 

  97. Vargheese, J.P., Sripada, S., Masthoff, J., Oren, N., Dennis, M.: A dynamic persuasive dialogue model for encouraging social interaction for older adults. In: I.V.A, pp. 464–465. Springer (2013)

    Google Scholar 

  98. Villarroel, R., Fernández-Medina, E., Piattini, M.: Secure information systems development-a survey and comparison. Comput. Secur. 24(4), 308–321 (2005)

    Article  Google Scholar 

  99. Wang, Y., Leon, P.G., Scott, K., Chen, X., Acquisti, A., Cranor, L.F.: Privacy nudges for social media: an exploratory Facebook study. In: Proceedings of the 22nd International Conference on World Wide Web, pp. 763–770. ACM (2013)

    Google Scholar 

  100. Weirich, D., Sasse, M.A.: Pretty good persuasion: a first step towards effective password security in the real world. In: Proceedings of 2001 Workshop on New Security Paradigms, pp. 137–143 (2001)

    Google Scholar 

  101. Williams, E.J., Beardmore, A., Joinson, A.N.: Individual differences in susceptibility to online influence: a theoretical review. Comput. Hum. Beh. 72, 412–421 (2017)

    Article  Google Scholar 

  102. Zimmermann, V., Renaud, K.: Moving from a “human-as-problem’’ to a “human-as-solution’’ cybersecurity mindset. Int. J. Hum.-Comput. Stud. 131, 169–187 (2019)

    Article  Google Scholar 

Download references

Acknowledgements

This research was supported by the UKRI EPSRC award: EP/P011829/1.

Author information

Authors and Affiliations

  1. Edinburgh Napier University, Edinburgh, UK

    John Paul Vargheese

  2. University of Aberdeen, Aberdeen, UK

    Matthew Collinson

  3. Utrecht University, Utrecht, The Netherlands

    Judith Masthoff

Authors
  1. John Paul Vargheese
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Matthew Collinson
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Judith Masthoff
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to John Paul Vargheese .

Editor information

Editors and Affiliations

  1. Universität Koblenz-Landau, Koblenz, Germany

    Frank Hopfgartner

  2. National University of Singapore, Singapore, Singapore

    Kokil Jaidka

  3. GESIS – Leibniz-Institut für Sozialwissenschaften, Cologne, Germany

    Philipp Mayr

  4. University of Glasgow, Glasgow, UK

    Joemon Jose

  5. University of Glasgow, Glasgow, UK

    Jan Breitsohl

Exploratory Analysis

Exploratory Analysis

This section reports results from an exploratory analysis of participant and organisational factors captured during the study. The aim of this analysis was to discover whether there are significant variations in the distribution of response categories for each factor. Our research questions and hypothesis are:

  • RQ2 Is the distribution of participant responses the same for all participant and organisational factors?

  • \(H^0\) There is no significant variation in the distribution of response categories for all participant and organisational factors.

  • \(H^1\) There is a significant variation in the distribution of response categories for all participant and organisational factors.

We expanded RQ2 to RQ2a, RQ2b and RQ2c to account for gender, grade and School respectively.

1.1 Analysis of Gender and Participant Responses

Table 3. Distribution of response categories by gender
Full size table

Table 3 shows the distribution of response categories by gender. To discover whether there is a significant variation in the distribution of response categories by participant gender, we conducted a Mann-Whitney U test, which is suitable for identifying whether there is a significant variation in the distribution of an dependent variable (response categories) between two independent groups (male and female). Results from this test indicates that there is an overall significant difference between female and male participants \((\textit{U}\,(Female = 919, Male = 673) = 328527, twotailed, \textit{p} = .03, \textit{r} = .1)\). It appears that female participants completing the training earlier with fewer not completing the training compared to male participants. We therefore address RQ2a by concluding that there was an overall impact of gender on participant responses during the study. We note that despite discovering a significant variation in the distribution of response categories between female and male participants, the effect size is small [27].

1.2 Analysis of Grade and Participant Responses

Table 4 shows the distribution of response categories by participant grade. To discover whether was any significant variation in the distribution of response categories by grade, we conducted a Kruskal Wallis test as discussed in Sect. 4. Results from this test indicate that there is an overall significant variation in the distribution of response categories between grades \((\textit{H}(2) = 10, \textit{p} = 0.007\)). Following these results, we conducted a post-hoc Dunn’s test to discover whether there were any specific significant variations in response categories between grades. Pairwise comparisons using Bonferroni adjusted p -values reveal a significant difference between Grades 1 and 3 (\({p = .01, r = -.1})\) and between Grades 2 and 3 \((\textit{p} = .03, \textit{r} = -.1 )\). It appears that participants within lower grades completed the training earlier, with fewer participants not completing the training, with the greatest difference being between Grades 1 and 3 compared to between Grades 2 and 3, although we note that effect sizes for these observations are small [27]. We therefore address RQ2b by concluding that there was an overall impact of grade on participant responses during the study. Results from our post-hoc analysis suggests participants in lower grades completed the training earlier with fewer participants not completing the training, compared to those in higher grades.

Table 4. Distribution of response categories by grade
Full size table

1.3 Analysis of School and Participant Responses

Table 5. Distribution of response categories by School
Full size table

Table 5 shows the distribution of response categories by School. We repeat our approach for analysis grade in our analysis of School using a Kruskal Wallis test. Results indicate a significant variation in the distribution of response categories between Schools \((\textit{H}(12) = 64.1, \textit{p} < .01 )\). Table 6 lists all significant pairwise comparisons between Schools, with Bonferroni corrected p values.

Table 6. Post-hoc pairwise comparison of response categories by School with Bonferroni adjusted p values (non significant results have been excluded)
Full size table

For each significant comparison, it appears that participants in Schools 1, 4, 6 and 7 completed the training earlier, with fewer participants not completing the training, compared to Schools 3, 5 and 10, respectively for each comparison listed. Effect sizes for these observations are small. We address RQ2c by concluding that there was an overall impact of school on participant responses during the study. Due to the needs to preserve the anonymity of schools within the university, our conclusions as to the specific pairwise differences between schools are limited. Further studies are required to investigate what properties of the schools may lead to such results.

Rights and permissions

Reprints and permissions

Copyright information

© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Vargheese, J.P., Collinson, M., Masthoff, J. (2022). A Quantitative Field Study of a Persuasive Security Technology in the Wild. In: Hopfgartner, F., Jaidka, K., Mayr, P., Jose, J., Breitsohl, J. (eds) Social Informatics. SocInfo 2022. Lecture Notes in Computer Science, vol 13618. Springer, Cham. https://doi.org/10.1007/978-3-031-19097-1_13

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-19097-1_13

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-19096-4

  • Online ISBN: 978-3-031-19097-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation