Cybersecurity behavior change: A conceptualization of ethical principles for behavioral interventions

Mersinas, Konstantinos; Bada, Maria; Furnell, Steven

Abstract

The importance of changing behaviors is gradually being acknowledged in cybersecurity, and the reason is the realization that a notable portion of security incidents have a human-related component. Thus, enhancing behaviors at individual level, can bring a significant reduction in security breaches overall. Behavior change refers to any modification of human behavior through some type of intervention. Interventions from behavioral economics and psychology are being increasingly introduced in the field, however, the ethics surrounding such interventions are largely neglected. In this paper, we raise the ethical issues associated with behavioral intervention approaches. We draw on the traditionally more mature field of biomedical ethics and propose six clusters of ethical principles suitable for cybersecurity behavior change. We conducted a survey (N = 141) to identify individuals’ perceptions on the proposed ethical principles and validate their perceived usefulness. We analyze an existing intervention in the light of our six-principle conceptualization to showcase how it can be used as a practical apparatus. Our set of ethical principles are aimed for cybersecurity professionals, policy makers, and behavioral intervention designers, and can serve as a starting point for best-practice development in cybersecurity behavior change ethics.

Citation

Mersinas, K., Bada, M., & Furnell, S. (2025). Cybersecurity behavior change: A conceptualization of ethical principles for behavioral interventions. Computers and Security, 148, Article 104025. https://doi.org/10.1016/j.cose.2024.104025

• Journal Article Type: Article
• Acceptance Date: Jul 25, 2024
• Online Publication Date: Aug 14, 2024
• Publication Date: Jan 1, 2025
• Deposit Date: Jul 26, 2024
• Publicly Available Date: Aug 15, 2026
• Journal: Computers and Security
• Print ISSN: 0167-4048
• Electronic ISSN: 0167-4048
• Publisher: Elsevier
• Peer Reviewed: Peer Reviewed
• Volume: 148
• Article Number: 104025
• DOI: https://doi.org/10.1016/j.cose.2024.104025
• Keywords: Cybersecurity behavior change; behavioral interventions; ethics; autonomy; justice; nonmaleficence; beneficence; transparency; privacy
• Public URL: https://nottingham-repository.worktribe.com/output/37603084
• Additional Information: This article is maintained by: Elsevier; Article Title: Cybersecurity Behavior Change: A conceptualization of Ethical Principles for Behavioral Interventions; Journal Title: Computers & Security; CrossRef DOI link to publisher maintained version: https://doi.org/10.1016/j.cose.2024.104025; Content Type: article; Copyright: © 2024 The Authors. Published by Elsevier Ltd.