SBE: Small: Collaborative: Improving Security Behavior of Employees in Cyberspace through Evidence-based Malware Reports and E-Learning Materials

随着Web应用程序使用的增加，恶意内容和网络攻击的频率和复杂性都在迅速增加。对于粗心大意的用户及其组织来说，Tumblr、Facebook、MySpace、Twitter和LinkedIn等社交媒体网站构成了各种严重的安全风险和威胁。最近的研究表明，与以前流行的电子邮件传递方式相比，社交媒体网站更多地被用于传递恶意软件。正因为如此，许多组织都在寻找实施有效安全策略的方法。然而，让员工遵守安全政策可能是一项重大挑战。研究表明，安全链中最薄弱的一环是用户。因此，组织需要找到创新的方法来提高员工的安全意识和参与在线安全行为的能力。本项目旨在研究影响网络安全行为的因素，并使用定制化和循证的恶意软件报告和电子学习材料，帮助员工更深入地了解他们的安全风险，改善他们的安全行为。该项目的第一阶段将是一项大规模的调查研究，以确定影响组织员工安全行为的关键因素。这些数据将用于开发网络安全合规的心理决策模型。该项目的第二阶段将是一项对照实验研究，以比较旨在提高员工网络安全合规性的不同循证干预措施的有效性。该项目将有助于了解员工的网络安全行为，并制定更有效的网络安全政策。开发的模型将解释和预测各种因素如何影响员工的网络安全行为。项目成果将有助于心理学、行为学和教育学理论，这些理论与人们评估脆弱性和威胁、选择适应性或非适应性应对策略以及采用新的应对策略的基本过程有关。通过教育研讨会、项目门户网站、期刊出版物和会议演示，项目成果将接触到广泛的受众，包括房地产、金融服务、物流和供应链、保险和教育等不同行业的企业IT总监、经理、员工、研究人员和从业者。

As the use of Web applications has increased, malicious content and cyber attacks are rapidly increasing in both their frequency and their sophistication. For unwary users and their organizations, social media sites such as Tumblr, Facebook, MySpace, Twitter, and LinkedIn pose a variety of serious security risks and threats. Recent studies show that social media sites are more in use for delivering malware than were previously popular methods of email delivery. Because of this, many organizations are looking for ways to implement effective security policies. Getting employees to comply with a security policy, however, can be a significant challenge. Studies show that the weakest link in a security chain is users. Thus, organizations need to find innovative methods to increase their employees' security awareness and their capabilities to engage in online security behavior. This project aims to study the factors that affect cyber security behavior, and use customized and evidence-based malware reports and e-learning materials to help employees more deeply understand their security risks and to improve their security behavior. The first stage of this project will be a large-scale survey study to identify key factors that affect organizational employees' security behavior. These data will be used to develop a psychological decision-making model for cyber security compliance. The second stage of this project will be a controlled experimental study to compare the effectiveness of different evidence-based interventions designed to increase employees' cyber security compliance. This project will contribute to the understanding of cyber security behaviors of employees and the development of more effective cyber security policies. The developed model will explain and predict how various factors affect employees' cyber security behaviors. Project results will contribute to the psychological, behavioral, and educational theories relating to the basic processes by which people assess vulnerabilities and threats, choose adaptive or maladaptive coping strategies, and adopt new coping strategies. Through educational workshops, a project portal, journal publications, and conference presentations, the results of the project will reach a broad audience that includes corporate IT directors, managers, employees, researchers and practitioners in various industries such as real estate, financial services, logistics and supply chain, insurance and education.