SBE: Small: Collaborative: Improving Security Behavior of Employees in Cyberspace through Evidence-based Malware Reports and E-Learning Materials

SBE：小型：协作：通过基于证据的恶意软件报告和电子学习材料改善网络空间中员工的安全行为

• 批准号: 1318470
• 负责人: Wu He
• 金额: $ 24.55万
• 依托单位: Old Dominion University Research Foundation
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2013
• 资助国家: 美国
• 起止时间: 2013-09-15 至 2017-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1318470&HistoricalAwards=false
• 关键词: SBE; Small; Collaborative; Improving; Security

As the use of Web applications has increased, malicious content and cyber attacks are rapidly increasing in both their frequency and their sophistication. For unwary users and their organizations, social media sites such as Tumblr, Facebook, MySpace, Twitter, and LinkedIn pose a variety of serious security risks and threats. Recent studies show that social media sites are more in use for delivering malware than were previously popular methods of email delivery. Because of this, many organizations are looking for ways to implement effective security policies. Getting employees to comply with a security policy, however, can be a significant challenge. Studies show that the weakest link in a security chain is users. Thus, organizations need to find innovative methods to increase their employees' security awareness and their capabilities to engage in online security behavior. This project aims to study the factors that affect cyber security behavior, and use customized and evidence-based malware reports and e-learning materials to help employees more deeply understand their security risks and to improve their security behavior. The first stage of this project will be a large-scale survey study to identify key factors that affect organizational employees' security behavior. These data will be used to develop a psychological decision-making model for cyber security compliance. The second stage of this project will be a controlled experimental study to compare the effectiveness of different evidence-based interventions designed to increase employees' cyber security compliance. This project will contribute to the understanding of cyber security behaviors of employees and the development of more effective cyber security policies. The developed model will explain and predict how various factors affect employees' cyber security behaviors. Project results will contribute to the psychological, behavioral, and educational theories relating to the basic processes by which people assess vulnerabilities and threats, choose adaptive or maladaptive coping strategies, and adopt new coping strategies. Through educational workshops, a project portal, journal publications, and conference presentations, the results of the project will reach a broad audience that includes corporate IT directors, managers, employees, researchers and practitioners in various industries such as real estate, financial services, logistics and supply chain, insurance and education.

随着Web应用程序使用的增加，恶意内容和网络攻击的频率和复杂性都在迅速增加。对于粗心的用户及其组织来说，Tumblr、Facebook、MySpace、Twitter和LinkedIn等社交媒体网站构成了各种严重的安全风险和威胁。最近的研究表明，社交媒体网站比以前流行的电子邮件发送方法更常用于发送恶意软件。因此，许多组织都在寻找实施有效安全策略的方法。然而，让员工遵守安全策略可能是一项重大挑战。研究表明，安全链中最薄弱的环节是用户。因此，组织需要找到创新的方法来提高员工的安全意识和参与在线安全行为的能力。 该项目旨在研究影响网络安全行为的因素，并使用定制和基于证据的恶意软件报告和电子学习材料，帮助员工更深入地了解其安全风险并改善其安全行为。本研究的第一阶段将是一个大规模的调查研究，以确定影响组织员工安全行为的关键因素。这些数据将用于开发网络安全合规性的心理决策模型。该项目的第二阶段将是一项对照实验研究，以比较旨在提高员工网络安全合规性的不同循证干预措施的有效性。该项目将有助于了解员工的网络安全行为，并制定更有效的网络安全政策。开发的模型将解释和预测各种因素如何影响员工的网络安全行为。项目结果将有助于心理，行为和教育理论的基本过程，人们评估脆弱性和威胁，选择适应或适应不良的应对策略，并采取新的应对策略。通过教育研讨会、项目门户网站、期刊出版物和会议演示，该项目的成果将惠及广泛的受众，包括真实的房地产、金融服务、物流和供应链、保险和教育等各行业的企业IT主管、经理、员工、研究人员和从业人员。