Cyber-Security across the Life Span (cSaLSA)

尽管组织和个人加大了改善网络安全的努力，但越来越多的违规和攻击报告表明，我们不仅比以往任何时候都更脆弱，而且“没有明显的解决方案来解决网络安全问题”（Garfinkel，2012年，第32页）。随着技术已经嵌入到日常生活的几乎所有方面，越来越多的人参与到与系统的互动中，网络安全的“问题”在可预见的未来似乎仍将无法解决。虽然网络安全是一个“社会技术”系统，既有技术因素，也有人的因素，这已成为公认的智慧，但事实证明，在这种理解的基础上取得进展是困难的。这部分是由于人们和他们生活的社会环境以及他们互动的系统的多样性。与此同时，关于网络安全的公共话语和指导令人困惑，而且往往针对性不强。例如，“网络安全”一词可用于涵盖广泛的态度、行为、技术和威胁，包括认证方法、SCADA系统、鱼叉式网络钓鱼和网络欺凌，干预措施针对性不强，过于基于技术威胁。然而，至关重要的是，每个人对网络安全问题的经验和理解并不相同，cSALSA项目旨在解决我们如何更充分地了解各种网络安全经验，态度和行为的根本挑战，以便设计更好，更有效的网络安全服务和教育材料。在cSALSA项目中，我们采用生命周期方法来研究如何理解网络安全，以及人们对网络安全和风险的态度和行为。该项目将研究三个主要生命阶段的网络安全-年轻人，工作年龄段和老年人。该研究项目将侧重于人们对网络安全和风险的态度和行为如何在整个生命周期中与其目标和愿望、认知能力和知识以及控制和适应其网络安全行为的能力同步变化。重要的是，我们认识到，与网络安全相关的行为或生命历程发展都不是在真空中发生的。相反，它们是个体特征、特定生命阶段中与他人共有的元素以及人发现自己所处的动态环境的复杂相互作用的一部分。这些背景包括家庭生活、组织结构、认知能力和知识以及社会支持网络等方面。我们提出了一个三管齐下的方法来研究这三个生命阶段：（1）研究如何理解网络安全，并在整个生命周期的日常语言框架;（2）对我们生活中的三个方面的网络安全态度、知识和行为进行深入的定性和定量研究，特别关注人们生活的动态如何影响人们对网络安全的理解，评估和讨论的风险，以及采取的行动;（3）关于网络安全指标的具体工作，以及制定经心理测量验证的新的网络安全观念和行为措施。

Despite increased efforts to improve cyber-security for organisations and individuals, growing reports of breaches and attacks suggest that not only are we more vulnerable than ever, but also that there "is no obvious solution to the problem of cyber-security" (Garfinkel, 2012, p. 32). As technology has become embedded in virtually all aspects of everyday life, and more and more people are engaged in interactions with systems, it seems likely that the 'problem' of cyber-security will remain unsolved in the foreseeable future. While it has become accepted wisdom that cyber-security is a 'socio-technical' system, with both technical and human elements, making advances based on this understanding has proved difficult. In part this is due to the diversity of both people and the social contexts in which they live their lives, and the systems with which they interact. At the same time, the public discourse and guidance about cyber-security is confusing and often inappropriately targeted. For instance, the term 'cyber-security' can be used to encompass a wide range of attitudes, behaviours, technologies and threats ranging from authentication methods, SCADA systems, spear phishing and cyber-bullying, with interventions poorly targeted and overly technology-threat based. Crucially, however, the experience and understanding of the cyber-security problem is not the same for everyone and the cSALSA project seeks to address the fundamental challenge of how we can more fully understand a diverse range of cyber-security experiences, attitudes and behaviours in order to design better, more effective cyber-security services and educational materials. In the cSALSA project, we take a lifespan approach to studying how cyber-security is understood, and the attitudes and behaviours of people to cyber-security and risk. The project will study cyber-security across three main life stages - amongst young people, those of working age, and older people. The research project will focus on how people's attitudes and behaviours towards cyber-security and risk change across the lifespan in sync with their goals and aspirations, cognitive abilities and knowledge and ability to control and adapt their cyber-security behaviour. Importantly, we recognize that neither cyber-security related behaviours nor life course development occur in a vacuum. Rather, they are part of a complex inter-play of individual characteristics, elements shared with others in a particular life stage, and the dynamic context in which the person finds themselves. These contexts include aspects of family life, organizational structures, cognitive capacity and knowledge, and social support networks. We propose a three pronged approach to studying these three life stages: (1) research investigating how cyber-security is understood and framed in everyday language across the lifespan; (2) in-depth qualitative and quantitative work on cyber-security attitudes, knowledge and behaviour across our three points in life, with a specific focus on how the dynamics of people's lives influences how cyber-security is understood, risks appraised and talked about, and actions taken; and (3) specific work on metrics for cyber-security, and the development of new psychometrically validated measures of cyber-security perceptions and behaviours.