TC: Small: Collaborative Research: Influencing Mental Models of Security

TC：小：协作研究：影响安全心理模型

• 批准号: 1115926
• 负责人: Emilee Rader
• 金额: $ 24.16万
• 依托单位: Michigan State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2011
• 资助国家: 美国
• 起止时间: 2011-08-01 至 2017-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1115926&HistoricalAwards=false
• 关键词: TC; Small; Collaborative; Research; Influencing

Over 80 million households in the United States have a home computer and an Internet connection. The vast majority of these are overseen by people who have little computer security knowledge or training, and many users try to avoid making security decisions because they feel they don't have the knowledge and skills to maintain proper security. Nevertheless, home computer users still make security-related decisions on a regular basis --- for example, whether or not to click on a link in an email message --- without being aware that is what they are doing. Their decisions are guided by how they think about computer security,their mental models. Interestingly, these models do not have to be technically correct to lead to desirable security behaviors. In other words, sometimes even "wrong" mental models produce good security decisions. This project will explore the implications of that insight. By eliminating the constraint that non-technical users must become more like computer security experts to properly protect themselves, this project will identify and create more effective ways of helping home computer users make good security decisions.This project will help advance our understanding of how mental models of security are formed and how ideas are incorporated into mental models and transmitted from person to person. What kinds of information are incorporated into home computer users' mental models? Work will initially be focused on experimentally testing two hypotheses: a) stories about experiences have a larger influence on behavior than behavioral advice, and b) information from friends and colleagues has a stronger influence on mental models, and therefore behavior, than information from security experts. Additionally, the prevalence of particular mental models will be measured and correlated with actual user security behaviors. Through these investigations, this project will characterize the reasons that many home computer users choose not to act securely --- a question which is one of the biggest challenges of home computer security. Finally, this project will explore ways of encouraging behaviors that support secure system use by developing a prototype socio-technical system that is capable of influencing their mental models and moving people toward models that lead to greater security.Home computer security and personal information security are large problems today. Current education campaigns have failed to effect widespread changes in the security behaviors of non-technical users. New technologies are being developed, but will do nothing if users intentionally choose to ignore the technology or to work around it. This project will find better ways of informing people about security issues, altering their understanding of security threats and thereby their security behaviors, which will ultimately create more secure home computers. It will produce research tools, including survey instruments and security behavior measurement software that can be used by other security researchers. It will train a number of students, both graduate and undergraduate, in working on multi-disciplinary, distributed teams. The results from this study will be disseminated broadly to multiple academic communities.

美国有超过 8000 万家庭拥有家用计算机和互联网连接。其中绝大多数是由缺乏计算机安全知识或培训的人员监督的，许多用户试图避免做出安全决策，因为他们觉得自己不具备维护适当安全性的知识和技能。尽管如此，家庭计算机用户仍然定期做出与安全相关的决定——例如，是否单击电子邮件中的链接——而没有意识到他们正在做什么。他们的决定取决于他们对计算机安全的看法和他们的心理模型。 有趣的是，这些模型不一定在技术上正确才能产生理想的安全行为。换句话说，有时甚至“错误”的心理模型也会产生良好的安全决策。该项目将探讨这一见解的影响。通过消除非技术用户必须变得更像计算机安全专家才能正确保护自己的限制，该项目将确定并创建更有效的方法来帮助家庭计算机用户做出良好的安全决策。该项目将有助于加深我们对心理如何影响的理解。安全模型是如何形成的，以及想法是如何融入心理模型并在人与人之间传播的。家庭计算机用户的心理模型中包含哪些类型的信息？工作最初将集中在实验上测试两个假设：a）关于经历的故事比行为建议对行为的影响更大，b）来自朋友和同事的信息比来自安全的信息对心理模型和行为的影响更大专家。 此外，将测量特定心理模型的流行程度并将其与实际用户安全行为相关联。通过这些调查，该项目将描述许多家庭计算机用户选择不采取安全措施的原因——这是家庭计算机安全的最大挑战之一。最后，该项目将探索鼓励支持安全系统使用的行为的方法，方法是开发一个原型社会技术系统，该系统能够影响他们的心理模型，并促使人们采用可带来更高安全性的模型。家庭计算机安全和个人信息安全是今天的大问题。当前的教育活动未能对非技术用户的安全行为产生广泛的改变。新技术正在开发中，但如果用户故意选择忽略该技术或绕过它，那么新技术将无济于事。该项目将找到更好的方法来告知人们安全问题，改变他们对安全威胁的理解，从而改变他们的安全行为，这最终将创造出更安全的家用计算机。它将生产研究工具，包括可供其他安全研究人员使用的调查工具和安全行为测量软件。它将培训一些研究生和本科生在多学科、分布式团队中工作。这项研究的结果将广泛传播给多个学术界。