Security Messages: Or, How I Learned to Stop Disregarding and Heed the Warning

Attacks on information security continue to be reported in the media, and result in large losses for organizations. While some attacks are the result of sophisticated threats, others can be traced to failures by organizational insiders to observe basic security policies such as using caution when opening unsolicited email attachments. Faced with the challenges and time demands of everyday stressors, security policy compliance can be costly for individuals; security actions require time and distract attention from other primary tasks. This costliness can lead individuals to ignore prompts to perform security updates, scan their computers for threats, or reboot their computers to apply security updates. This dissertation contains three studies that address the following overarching research question: How can end-user adherence to security messages be better understood and improved, and how can theory inform security-message design? First, two complementary studies are presented that examine the integration of media naturalness theory into a security message context using field study and fMRI designs. Study 1, the field study, unobtrusively captures objective measures of attention from Amazon Mechanical Turk users (N=510) as they perform a between-subjects deception protocol. Study 2, the fMRI study, examines neural activations from a within-subjects participant design (N=23) in response to different security message designs with integrated emotive human facial expressions. Data from studies 1 and 2 show that warnings with integrated facial expressions of threat (fear, disgust) generally elicited greater adherence rates and higher evidence of cognition and elaboration than did warnings with integrated neutral facial expressions or than did warnings with no integrated facial expressions, supporting our hypotheses. Study 3 explores the pattern of risk taking and analysis that users engage in when interacting with interruptive security messages. The corroboration of multiple behavioral dependent variables suggests that users predominantly use a bimodal risk tradeoff paradigm when interacting with interruptive security messages. All three studies address the overarching research question of understanding and improving end user adherence to security messages

Microsatellite data set

Database of individual by individual sampling locations and microsatellite

Size-Frequency by Site.

<p>Size-frequency distributions of <i>M</i>. <i>cavernosa</i> on a logarithmic scale represented as the number of individuals within each log transformed size class for colonies from each survey location (Rita/XL, Coopers, Tuckers, Spittal, Devonshire, Hungry Bay) at 10m (gray bars) and 45m (black bars) depths. Sites that differed significantly from a normal distribution are indicated with an asterisk (*; α<0.05).</p

Distribution Parameters.

<p><i>M</i>. <i>cavernosa</i> population distribution parameters including site name, depth (m), geometric mean surface area (μ; cm²), skewness (g₁), kurtosis (g₂), standard deviation (SD), maximum colony surface area (95%; cm²), the probability that the populations is from a normal distribution (Pnorm), and the sample size (n) for each site surveyed and for all shallow sites and all mesophotic sites combined.</p

Survey Locations.

<p>Details of site locations surveyed including site map label (<a href="http://www.plosone.org/article/info:doi/10.1371/journal.pone.0142427#pone.0142427.g001" target="_blank">Fig 1</a>), corresponding site name, depth (m), date surveyed, and GPS location (latitude and longitude).</p

Survey Map.

<p>Survey locations on the south shore of Bermuda at shallow (10m; gray markers) and mesophotic (45m; black markers) sites. S1: Rita, 10m; D1: XL, 45m; S2: Coopers, 10m; D2: Coopers, 45m; S3: Tuckers, 10m; D3: Tuckers, 45m; S4: Spittal, 10m; D4: Spittal, 45m; S5: Devonshire, 10m; D5: Devonshire, 45m; S6: Hungry Bay, 10m; D6: Hungry Bay, 45m.</p

Correlation Coefficients.

<p>Spearman rank correlation coefficient values for comparisons of size-frequency distributions of <i>M</i>. <i>cavernosa</i> between sites. Values above the staggered line are comparisons among shallow sites; values below the staggered line are comparisons among mesophotic sites; values between the staggered lines are between adjacent shallow and mesophotic sites. Significant correlations (statistically similar; α = 0.05) are indicated in bold.</p

Distribution Parameters by Depth.

<p>Mean standard deviation, skewness, and kurtosis (± SE) of <i>M</i>. <i>cavernosa</i> population size-frequency distributions from measured colonies at shallow (10m; gray squares) and mesophotic (45m; black triangles) sites (Rita/XL, Coopers, Tuckers, Spittal, Devonshire, Hungry Bay).</p

Colony Abundance, Surface Area, and Percent Cover by Depth.

<p>(a) mean number of <i>M</i>. <i>cavernosa</i> colonies per 60m² ± SE at shallow (10m; gray bars) versus mesophotic (45m; black bars) sites (Rita/XL, Coopers, Tuckers, Spittal, Devonshire, Hungry Bay); (b) mean <i>M</i>. <i>cavernosa</i> colony surface area (cm²) ± SE at shallow (10m; gray bars) versus mesophotic (45m; black bars) sites; (c) mean percent cover ± SE of <i>M</i>. <i>cavernosa</i> at shallow (10m; gray bars) versus mesophotic (45m; black bars) sites (n = 6 per depth).</p

Nutrient Concentration and Temperature by Depth.

<p>(a) mean (±SD) concentration (μM) of nitrate (NO₃) + nitrite (NO₂) and silicate (SiO₄^-2) on shallow (10m; n = 4 per site) versus mesophotic sites (45m; n = 4 per site) from water samples collected September 5, 2015 (NO₃ + NO₂, p<0.0001, Tuckers, p = 0.019, Spittal; SiO₄^-2, p = 0.001, Tuckers, p = 0.058, Spittal; Student’s <i>t</i>-tests); (b) box blot of seawater temperature at shallow (10m) and mesophotic (45m) sites showing median values (solid horizontal line), 25^th and 75^th percentile values (box outline), and minimum and maximum values (whiskers) recorded between July 2014 and January 2015 from 6 paired shallow (10m) and mesophotic (45m) survey sites (2 dives per site); Rita/XL, Coopers, Tuckers, Spittal, Devonshire, and Hungry Bay (p<0.0001, Students <i>t</i>-test, n = 6).</p