CAREER: The Role of Emotion and Social Motives in Communicating Risk: Implications for User Behavior in the Cyber Security Context

之前的研究指出，如果最终用户采取预防措施，例如保持系统更新，许多网络攻击是可以预防的，但他们往往没有这样做。该提案建立在风险沟通，情商和自决的理论基础上，旨在设计网络安全风险沟通和培训的新方法。其目标是使用户能够一致和正确地评估风险，成本和收益，促进以任务为中心的应对措施，并促进他们的价值观内化，促进网络安全知识的自发传播。通过提高网络安全风险意识和自我效能发展，使非专家用户能够做出明智的安全决策，该项目直接解决了对经济增长和国家安全日益严重的威胁。该项目还通过外展活动为研究生和本科生以及代表性不足群体的成员创造网络安全研究和培训机会。该项目系统地测试了两个假设：（i）解决心理模型中的差距沿着自我效能的发展可以促进以任务为中心的应对反应和早期顺应行为，（2）交流社会动机可以导致内在动机的发展和信息的自发传播。为此，研究人员设计并进行了一系列访谈式用户研究，包括专家和非专家用户，并开发了有效的风险沟通模块，以解决心理模型中的差距，并使非专家用户能够评估安全决策的风险，成本和收益。该项目还将测试不同干预措施的有效性，以促进以任务为重点的应对反应和促进信息的自发传播。通过系统地检验上述假设，本项目深入了解了情绪和社会动机对网络安全行为的影响，为风险沟通的理论基础做出了宝贵的贡献。通过调查高中生和成年人的心理模型，该项目推进了网络安全背景下青少年风险沟通的理论，并使网络安全专业人员能够设计专门针对这一弱势群体的风险沟通模块。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Prior research notes that many cyberattacks are preventable if end users take precautionary measures, such as keeping systems updated, but they often fail to do so. This proposal builds upon theories of risk communication, emotional intelligence, and self-determination to design new approaches to cybersecurity risk communication and training. The goals are to enable users to assess risks, costs, and benefits consistently and correctly, to promote task-focused coping responses, and to facilitate their internalization of values, promoting spontaneous diffusion of cybersecurity knowledge. By enabling non-expert users to make informed security decisions through raising cybersecurity risk awareness and self-efficacy development, this project directly addresses an increasingly serious threat to economic growth and national security. This project also creates cybersecurity research and training opportunities for graduate and undergraduate students, and members from the underrepresented groups through outreach initiatives.This project systematically tests two hypotheses: (i) that addressing gaps in mental models along with development of self-efficacy can promote task-focused coping responses and early conformance behavior, and (ii) that communicating social motives can lead to the development of intrinsic motivation and spontaneous diffusion of information. Towards that end, the researchers design and conduct a series of interview-style user studies including both expert and non-expert users, and they develop effective risk communication modules that address gaps in mental models and enable non-expert users to evaluate risks, costs and benefits of security decisions. This project will also test the efficacy of different interventions to promote task-focused coping responses and promote spontaneous diffusion of information. By systematically testing the aforementioned hypotheses, this project provides in-depth understanding regarding the influence of emotions and social motives in cybersecurity behavior and makes a valuable contribution to the theoretical foundation of risk communication. By investigating mental models of high school students as well as adults, this project advances the theory of risk communication for adolescents in the cybersecurity context and enables cybersecurity professionals to design risk communication modules specifically targeting this vulnerable demographic. Research results are synthesized in modular tutorials and made publicly available.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.