TC: Small: Collaborative Research: Influencing Mental Models of Security

TC：小：协作研究：影响安全心理模型

• 批准号: 1115926
• 负责人: Emilee Rader
• 金额: $ 24.16万
• 依托单位: Michigan State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2011
• 资助国家: 美国
• 起止时间: 2011-08-01 至 2017-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1115926&HistoricalAwards=false
• 关键词: TC; Small; Collaborative; Research; Influencing

Over 80 million households in the United States have a home computer and an Internet connection. The vast majority of these are overseen by people who have little computer security knowledge or training, and many users try to avoid making security decisions because they feel they don't have the knowledge and skills to maintain proper security. Nevertheless, home computer users still make security-related decisions on a regular basis --- for example, whether or not to click on a link in an email message --- without being aware that is what they are doing. Their decisions are guided by how they think about computer security,their mental models. Interestingly, these models do not have to be technically correct to lead to desirable security behaviors. In other words, sometimes even "wrong" mental models produce good security decisions. This project will explore the implications of that insight. By eliminating the constraint that non-technical users must become more like computer security experts to properly protect themselves, this project will identify and create more effective ways of helping home computer users make good security decisions.This project will help advance our understanding of how mental models of security are formed and how ideas are incorporated into mental models and transmitted from person to person. What kinds of information are incorporated into home computer users' mental models? Work will initially be focused on experimentally testing two hypotheses: a) stories about experiences have a larger influence on behavior than behavioral advice, and b) information from friends and colleagues has a stronger influence on mental models, and therefore behavior, than information from security experts. Additionally, the prevalence of particular mental models will be measured and correlated with actual user security behaviors. Through these investigations, this project will characterize the reasons that many home computer users choose not to act securely --- a question which is one of the biggest challenges of home computer security. Finally, this project will explore ways of encouraging behaviors that support secure system use by developing a prototype socio-technical system that is capable of influencing their mental models and moving people toward models that lead to greater security.Home computer security and personal information security are large problems today. Current education campaigns have failed to effect widespread changes in the security behaviors of non-technical users. New technologies are being developed, but will do nothing if users intentionally choose to ignore the technology or to work around it. This project will find better ways of informing people about security issues, altering their understanding of security threats and thereby their security behaviors, which will ultimately create more secure home computers. It will produce research tools, including survey instruments and security behavior measurement software that can be used by other security researchers. It will train a number of students, both graduate and undergraduate, in working on multi-disciplinary, distributed teams. The results from this study will be disseminated broadly to multiple academic communities.

美国超过8000万户家庭拥有家用计算机和互联网连接。其中的绝大多数是由几乎没有计算机安全知识或培训的人监督的，许多用户试图避免做出安全决定，因为他们认为自己没有知识和技能来维持适当的安全性。尽管如此，家庭计算机用户仍然定期做出与安全有关的决定 - 例如，无论是否单击电子邮件中的链接，都不知道他们在做什么。他们的决定是由他们如何看待计算机安全和心理模型的指导。 有趣的是，这些模型在技术上不必是正确的，即可导致理想的安全行为。换句话说，有时甚至“错误”的心理模型会产生良好的安全决定。该项目将探讨该见解的含义。通过消除非技术用户必须变得更像计算机安全专家以适当保护自己的限制，该项目将识别并创建更有效的方法来帮助家庭计算机用户做出良好的安全性决策。该项目将帮助我们促进我们对如何形成安全模型的理解以及如何将思想纳入人的心理模型，并向个人传播。家庭计算机用户的心理模型中包含了哪些类型的信息？最初，工作将专注于实验检验两个假设：a）关于经历的故事比行为建议对行为的影响更大，而b）来自朋友和同事的信息对心理模型，因此对行为的影响更大，因此与安全专家的信息相比。 此外，将测量特定心理模型的患病率与实际用户安全行为相关。通过这些调查，该项目将表征许多家庭计算机用户选择不安全行动的原因 - 这是家庭计算机安全的最大挑战之一。最后，该项目将通过开发一个能够影响其心理模型并将人们迈向更大安全的模型的原型社会技术系统来探讨鼓励支持安全系统使用的行为的方法。目前，计算机安全和个人信息安全是当今的大问题。当前的教育运动未能影响非技术用户的安全行为的广泛变化。正在开发新技术，但是如果用户故意选择忽略该技术或围绕它工作，将无能为力。该项目将找到更好的方法，向人们告知安全问题，改变他们对安全威胁的理解，从而改变其安全行为，最终将创造更安全的家用计算机。它将生产研究工具，包括其他安全研究人员可以使用的调查工具和安全行为衡量软件。它将培训许多研究生和本科生，从事多学科分布式团队的工作。这项研究的结果将大量传播给多个学术社区。