CAREER: The Role of Emotion and Social Motives in Communicating Risk: Implications for User Behavior in the Cyber Security Context

先前的研究指出，如果最终用户采取预防措施，如保持系统更新，许多网络攻击是可以预防的，但他们往往无法做到这一点。这项建议建立在风险沟通、情商和自我决定理论的基础上，以设计网络安全风险沟通和培训的新方法。目标是使用户能够一致和正确地评估风险、成本和收益，促进以任务为重点的应对措施，并促进他们的价值观内化，促进网络安全知识的自发传播。通过提高网络安全风险意识和自我效能发展，使非专家用户能够做出明智的安全决策，该项目直接解决了对经济增长和国家安全日益严重的威胁。该项目还通过外展活动为研究生和本科生以及来自代表性不足群体的成员创造了网络安全研究和培训机会。该项目系统地检验了两个假设：(I)随着自我效能感的发展，解决心理模型中的差距可以促进以任务为重点的应对反应和早期顺从行为；(Ii)沟通社会动机可以促进内在动机的发展和信息的自发传播。为此，研究人员设计并进行了一系列面谈式的用户研究，包括专家和非专家用户，他们开发了有效的风险沟通模块，以弥补心理模型中的差距，并使非专家用户能够评估安全决策的风险、成本和收益。该项目还将测试不同干预措施的效果，以促进以任务为重点的应对反应，并促进信息的自发传播。通过对上述假设的系统检验，本课题对情绪和社会动机在网络安全行为中的影响提供了深入的理解，为风险沟通的理论基础做出了有价值的贡献。通过调查高中生和成年人的心理模型，本项目提出了网络安全背景下青少年风险沟通的理论，并使网络安全专业人员能够专门针对这一弱势群体设计风险沟通模块。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Prior research notes that many cyberattacks are preventable if end users take precautionary measures, such as keeping systems updated, but they often fail to do so. This proposal builds upon theories of risk communication, emotional intelligence, and self-determination to design new approaches to cybersecurity risk communication and training. The goals are to enable users to assess risks, costs, and benefits consistently and correctly, to promote task-focused coping responses, and to facilitate their internalization of values, promoting spontaneous diffusion of cybersecurity knowledge. By enabling non-expert users to make informed security decisions through raising cybersecurity risk awareness and self-efficacy development, this project directly addresses an increasingly serious threat to economic growth and national security. This project also creates cybersecurity research and training opportunities for graduate and undergraduate students, and members from the underrepresented groups through outreach initiatives.This project systematically tests two hypotheses: (i) that addressing gaps in mental models along with development of self-efficacy can promote task-focused coping responses and early conformance behavior, and (ii) that communicating social motives can lead to the development of intrinsic motivation and spontaneous diffusion of information. Towards that end, the researchers design and conduct a series of interview-style user studies including both expert and non-expert users, and they develop effective risk communication modules that address gaps in mental models and enable non-expert users to evaluate risks, costs and benefits of security decisions. This project will also test the efficacy of different interventions to promote task-focused coping responses and promote spontaneous diffusion of information. By systematically testing the aforementioned hypotheses, this project provides in-depth understanding regarding the influence of emotions and social motives in cybersecurity behavior and makes a valuable contribution to the theoretical foundation of risk communication. By investigating mental models of high school students as well as adults, this project advances the theory of risk communication for adolescents in the cybersecurity context and enables cybersecurity professionals to design risk communication modules specifically targeting this vulnerable demographic. Research results are synthesized in modular tutorials and made publicly available.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.