TC:Small: A Formal Inter-Disciplinary Study of the Impact of Security Awareness Efforts on User Behavior

鉴于计算机安全的多样性和复杂性，学术界和工业界的一个自然反应是研究如何为这个问题创造技术解决方案。尽管针对各种问题的技术解决方案可能非常有效，但许多解决方案的基本前提是基于用户对避免危险行为的重要性的知情意识。虽然对各种技术方法的有效性进行了相当严格的评估，但计算机安全的人的方面受到的关注相对较少，主要是粗略的/道听途说的评估。这种缺乏严格科学数据的不幸结果是使用资金不足和临时意识安全意识活动，这些活动对企业的安全性提供的好处有限。这项工作将利用大学环境的独特方面来进行多尺度（时间，观察组，数据粒度）关于安全意识技术有效性的正式实验集。此外，跨学科的努力将带来正式实验的应用，以探索从现有犯罪学、心理学和信息系统文献的理论考虑中得出的消极、积极和有针对性的沟通干预的使用。以另一种方式陈述，组织将大量的财政和人力资源投入到信息安全意识计划中，旨在提高用户对安全计算实践和信息安全风险的认识。不幸的是，尽管许多组织在意识上花费了大量的资源，但组织几乎没有任何指导或科学证据来构建有效的策略。策略应该关注积极还是消极策略？是明信片、走廊海报还是培训课程更有效？宣传活动的效果是暂时的还是长期的？这项工作的重点将是通过探索意识技术在野外的有效性来提供严格的科学基础。大学的环境，不受正常网络安全控制的阻碍。这项工作的一个关键的更广泛的影响将是为建设安全意识项目制定基本指导方针。最终结果将显著提高安全意识技术的成本效率，从而显著改善国家网络安全基础设施。

Given the diverse and complex nature of computer security, a natural response of the academic and industrial community has been to study how one can create technical solutions to the problem. Although the technical solutions to various problems can be quite effective, the underlying premise of many of the solutions is predicated upon an informed awareness of the user of the importance of avoiding risky behavior. While there has been considerable rigor undertaken with regards to the evaluation of the efficacy of the various technical approaches, the human aspect of computer security has received relatively minor attention with largely cursory / anecdotal evaluation. The unfortunate result of this lack of rigorous scientific data is the use of under-funded and ad hoc awareness security awareness initiatives that offer limited benefit to the security of the enterprise. This work will leverage the unique aspects of the university-environment to conduct a multi-scale (time, observation group, data granularity) formal set of experiments regarding the efficacy of security awareness techniques. Moreover, the inter-disciplinary effort will bring to bear the application of formal experiments to explore the usage of negative, positive, and targeted communication interventions drawn from theoretical considerations of existing criminology, psychology, and information system literature.Stated in an alternative manner, organizations dedicate significant financial and human resources to information security awareness programs designed to raise user knowledge about safe computing practices and information security risks. Unfortunately, despite the fact that many organizations are expending significant resources on awareness, organizations have little if any guidance or scientific evidence to construct effective strategies. Should strategies focus on positive or negative strategies? Are post cards or hallway posters or training classes more effective? Are awareness campaign effects temporary or long term? The focus of this work will be to provide that rigorous scientific basis by exploring how effective awareness techniques are in the ?wild? of the university environment, unimpeded by normal network security controls. A key broader impact of the work will be the creation of basic guidelines for the construction of security awareness programs. The net result will be dramatically improved cost efficiency of security awareness techniques and hence, significant improvement in the national cyber-security infrastructure.