Supporting Security Policy with Effective Digital Intervention (SSPEDI)

众所周知，人们的行为对经济所有部门的组织安全至关重要。作为IT系统的用户，他们的作为或不作为都会造成网络安全漏洞。例如，用户可能会被引诱泄露他们的身份验证凭证（通过网络钓鱼），安装恶意软件（恶意软件），选择弱或不充分的密码，或者他们可能无法安装安全补丁，扫描计算机以查找病毒，或对关键数据进行安全备份。组织设计用户应该遵循的安全策略，例如，指示他们不要泄露身份验证（登录）凭证，或者不要打开未经请求的电子邮件中发送的某些类型的附件。然而，在实践中，管理人员发现很难鼓励用户遵守政策。这个项目将调查有效的方法来改善与用户的安全沟通，使他们了解安全风险，并说服他们遵守政策。我们的假设是，为了达到最有效的效果，沟通和政策实施必须考虑到个人的个性和动机。因此，需要技术支持来支持安全通信和安全说服，以便它可以扩展到大型组织。我们建议从现有的说服性技术和数字行为干预的学术领域转移思想和知识，并将其应用于用户安全合规问题。我们将构建并试验在真实用户安全场景中实现说服策略的真实技术。这些场景将与工业安全从业人员合作选择。该项目对用户遵从性挑战的根源采取了广泛的跨学科观点，并从心理学、行为决策、安全、情感分析和论证领域汲取了额外的专家知识，以寻求解决方案。

The behaviour of people is known to be critical to the security of organizations across all sectors of the economy. As users of IT systems, their action, or inaction, can create cyber security vulnerabilities. For example, users can be tempted to give away their authentication credentials (by phishing), to install malign software (malware), choose weak or inadequate passwords, or they may fail to install security patches, to scan computers for viruses, or to make secure backups of critical data. Organizations design security policies which users are supposed to follow, for example, instructing them not to give away their authentication (login) credentials, or not to open certain kinds of attachments sent in unsolicited emails. However, in practice, managers find it very difficult to encourage users to follow policy. This project will investigate effective ways to improve security communications with users, to enable them to understand security risks, and to persuade them to comply with policy. Our hypothesis is that to be most effective, communications and policy implementations must take into account individual personalities and motivations. Technological support is therefore required to support security communications and security persuasion so that it can scale up to large organizations. We propose to transfer ideas and knowledge from the existing academic field of persuasive technologies and digital behaviour interventions, and apply them to the user security compliance problem. We will build, and trial, real technologies that implement persuasive strategies in real user security scenarios. These scenarios will be selected in partnership with industrial security practitioners. The project takes a broad, interdisciplinary view of the roots of the user compliance challenge, and draws additionally on expert knowledge from the fields of psychology, behavioural decision, security, sentiment analysis and argumentation in search of solutions.