TC:Small: A Formal Inter-Disciplinary Study of the Impact of Security Awareness Efforts on User Behavior

鉴于计算机安全的多样性和复杂性，学术界和工业界的自然反应是研究如何创造技术解决方案来解决这个问题。尽管各种问题的技术解决方案可能相当有效，但许多解决方案的基本前提是用户知情地意识到避免危险行为的重要性。虽然在评估各种技术方法的效力方面进行了相当严格的工作，但计算机安全的人的方面得到的关注相对较少，主要是粗略/坊间的评估。这种缺乏严格科学数据的不幸结果是，使用了资金不足和临时提高安全意识的举措，这些举措对企业的安全带来的好处有限。这项工作将利用大学环境的独特方面来进行一套关于安全感知技术有效性的多尺度(时间、观察组、数据粒度)正式实验。此外，跨学科的努力将应用正式的实验，以探索从现有犯罪学、心理学和信息系统文献的理论考虑中提取的消极、积极和有针对性的沟通干预的使用。换言之，组织将大量财力和人力资源投入信息安全意识项目，旨在提高用户对安全计算实践和信息安全风险的知识。不幸的是，尽管许多组织在提高认识方面投入了大量资源，但组织几乎没有任何指导或科学证据来制定有效的战略。战略应该侧重于积极战略还是消极战略？明信片、走廊海报或培训班更有效吗？提高认识活动的效果是暂时的还是长期的？这项工作的重点将是通过探索在野外的感知技术如何有效地提供严格的科学基础。大学环境，不受正常网络安全控制的阻碍。这项工作的一个关键的更广泛的影响将是为建设安全意识方案制定基本指导方针。最终结果将大大提高安全意识技术的成本效率，从而显著改善国家网络安全基础设施。

Given the diverse and complex nature of computer security, a natural response of the academic and industrial community has been to study how one can create technical solutions to the problem. Although the technical solutions to various problems can be quite effective, the underlying premise of many of the solutions is predicated upon an informed awareness of the user of the importance of avoiding risky behavior. While there has been considerable rigor undertaken with regards to the evaluation of the efficacy of the various technical approaches, the human aspect of computer security has received relatively minor attention with largely cursory / anecdotal evaluation. The unfortunate result of this lack of rigorous scientific data is the use of under-funded and ad hoc awareness security awareness initiatives that offer limited benefit to the security of the enterprise. This work will leverage the unique aspects of the university-environment to conduct a multi-scale (time, observation group, data granularity) formal set of experiments regarding the efficacy of security awareness techniques. Moreover, the inter-disciplinary effort will bring to bear the application of formal experiments to explore the usage of negative, positive, and targeted communication interventions drawn from theoretical considerations of existing criminology, psychology, and information system literature.Stated in an alternative manner, organizations dedicate significant financial and human resources to information security awareness programs designed to raise user knowledge about safe computing practices and information security risks. Unfortunately, despite the fact that many organizations are expending significant resources on awareness, organizations have little if any guidance or scientific evidence to construct effective strategies. Should strategies focus on positive or negative strategies? Are post cards or hallway posters or training classes more effective? Are awareness campaign effects temporary or long term? The focus of this work will be to provide that rigorous scientific basis by exploring how effective awareness techniques are in the ?wild? of the university environment, unimpeded by normal network security controls. A key broader impact of the work will be the creation of basic guidelines for the construction of security awareness programs. The net result will be dramatically improved cost efficiency of security awareness techniques and hence, significant improvement in the national cyber-security infrastructure.