Enhancing security behaviour by supporting the user

Furnell, Steven; Khern-am-nuai, Warut; Esmael, Rawan; Yang, Weining; Li, Ninghui

Abstract

© 2018 Elsevier Ltd Although the role of users in maintaining security is regularly emphasised, this is often not matched by an accompanying level of support. Indeed, users are frequently given insufficient guidance to enable effective security choices and decisions, which can lead to perceived bad behaviour as a consequence. This paper discusses the forms of support that are possible, and seeks to investigate the effect of doing so in practice. Specifically, it presents findings from two experimental studies that investigate how variations in password meter usage and feedback can positively affect the resulting password choices. The first experiment examines the difference between passwords selected by unguided users and those receiving guidance and alternative forms of feedback (ranging from a traditional password meter through to an emoji-based approach). The findings reveal a 30% drop in weak password choices between unguided and guided usage, with the varying meters then delivering up to 10% further improvement. The second experiment then considers variations in the form of feedback message that users may receive in addition to a meter-based rating. It is shown that by providing richer information (e.g. based upon the time required to crack a password, its relative ranking against other choices, or the probability of it being cracked), users are more motivated towards making strong choices and changing initially weak ones. While the specifics of the experimental findings were focused upon passwords, the discussion also considers the benefits that may be gained by applying the same principles of nudging and guidance to other areas of security in which users are often found to have weak behaviours.

Citation

Furnell, S., Khern-am-nuai, W., Esmael, R., Yang, W., & Li, N. (2018). Enhancing security behaviour by supporting the user. Computers and Security, 75, 1-9. https://doi.org/10.1016/j.cose.2018.01.016

• Journal Article Type: Article
• Acceptance Date: Jan 18, 2018
• Online Publication Date: Jan 31, 2018
• Publication Date: Jun 1, 2018
• Deposit Date: Sep 14, 2020
• Publicly Available Date: Sep 14, 2020
• Journal: Computers & Security
• Print ISSN: 0167-4048
• Electronic ISSN: 0167-4048
• Publisher: Elsevier
• Peer Reviewed: Peer Reviewed
• Volume: 75
• Pages: 1-9
• DOI: https://doi.org/10.1016/j.cose.2018.01.016
• Public URL: https://nottingham-repository.worktribe.com/output/4867999
• Publisher URL: https://www.sciencedirect.com/science/article/pii/S0167404818300385?via%3Dihub