SaTC: NSF-BSF: CORE: Small: Increasing Users' Cyber-Security Compliance by Reducing Present Bias

尽管在计算机安全方面取得了进步，但仍然存在用户必须手动执行计算机安全任务(例如，重新启动以应用更新)的情况。尽管许多人认识到这些任务很重要，但他们仍然拖延。拖延往往是由于未能正确权衡长期安全利益与短期成本以及中断主要任务的恼人之处造成的。决策和行为经济学的研究人员几十年来一直在研究这种有偏见的权重现象，并在包括健康、储蓄和慈善捐赠在内的各个领域提出了克服这种现象的可行技术。通过这一多学科的研究议程，研究人员正在对如何最好地将这些技术应用于计算机安全进行实证研究。这项研究最初的重点是调查时间承诺如何鼓励遵守安全任务，如升级。已经检查了提高安全合规率的各种技术，但都没有解决问题的根本原因：目前的偏见。目前的偏差是一种倾向，即忽视未来的风险和收益，转而追求眼前的满足。基于行为经济学领域的见解，这个项目包括实证研究，以检验承诺轻推在什么时候和什么条件下可以用来改善安全行为，以及其他旨在对抗当前偏见的说服技术。通过研究团队在计算机安全、人机交互、决策、心理学和行为经济学方面的联合专业知识，它正在进行实验，以对未来计算机安全用户界面的设计产生可操作的见解。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Despite advances in computer security, there are still situations in which users must manually perform computer security tasks (e.g., rebooting to apply updates). Although many people recognize that these tasks are important, they still procrastinate. Procrastination is often caused by the failure to properly weigh the long-term security benefits against short-term costs and the annoyance of interrupting the primary task. Researchers in decision-making and behavioral economics have studied this phenomenon of biased weighting for decades and yielded viable techniques for overcoming it in various domains, including health, savings, and charitable giving. Through this multidisciplinary research agenda, the investigators are empirically examining how these techniques can best be applied to computer security. The initial focus of this research is an investigation of how time commitments can encourage compliance with security tasks such as upgrades.Various techniques to increase security compliance rates have been examined but none address a root cause of the problem: present bias. Present bias is the tendency to discount future risks and gains in favor of immediate gratifications. Based on insights from the field of behavioral economics, this project involves empirical studies to examine when and under what conditions commitment nudges, amongst other persuasion techniques aimed at countering present bias, can be used to improve security behaviors. Through the research team's joint expertise in computer security, human-computer interaction, decision-making, psychology, and behavioral economics, it is performing experiments to yield actionable insights on the design of future computer security user interfaces.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.