Skip to main content
SpringerLink
Log in

Human Cyber Risk Management by Security Awareness Professionals: Carrots or Sticks to Drive Behaviour Change?

  • Conference paper
  • First Online:
HCI for Cybersecurity, Privacy and Trust (HCII 2020)

Part of the book series: Lecture Notes in Computer Science ((LNISA,volume 12210))

Included in the following conference series:

Abstract

Cyber crime is rising at an unprecedented rate. Organisations are spending more than ever combating the human element through training and other interventions, such as simulated phishing. Organisations employ “carrots” (rewards) and “sticks” (sanctions) to reduce risky behaviour. Sanctions (such as locking computers and informing one’s line manager) are problematic as they lead to unintended consequences towards employee trust and productivity. This study explored how organisations use rewards and sanctions both in their campaigns and specifically following simulated phishing. We also assessed what factors (such as control over rewards, tendency to blame users) influenced security awareness professionals’ use of rewards and sanctions. The findings revealed that organisations use a variety of rewards and sanctions within their campaigns, with sanctions being used across 90% of the organisations. We did not find any factors that influence security awareness professionals’ usage of rewards and sanctions. Our findings suggest the need for a greater consideration of the human element of cyber security. In particular, campaigns should take a more informed approach to use of behaviour change strategies that consider the organisational structure in which they are implemented and the role (and influence) of security awareness professionals within that structure.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. HM Government. National Cyber Security Strategy 2016–2021 (2016)

    Google Scholar 

  2. Office for National Statistics. Crime in England and Wales: year ending March 2018 (2018)

    Google Scholar 

  3. Blythe, J.M., Coventry, L.: Costly but effective: comparing the factors that influence employee anti-malware behaviours. Comput. Hum. Behav. 87, 87–97 (2018)

    Article  Google Scholar 

  4. Sasse, A.: Scaring and bullying people into security won’t work. IEEE Secur. Priv. 13(3), 80–83 (2015)

    Article  Google Scholar 

  5. Reinfelder, L., Landwirth, R., Benenson, Z.: Security managers are not the enemy either. In: Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems, p. 433. ACM (2019)

    Google Scholar 

  6. Murdoch, S.J., Sasse, M.A.: Should you really phish your own employees?. https://tech.newstatesman.com/business/phishing-employees. (2017)

  7. Caputo, D.D., Pfleeger, S.L., Freeman, J.D., Johnson, M.E.: Going spear phishing: exploring embedded training and awareness. IEEE Secur. Priv. 12(1), 28–38 (2014)

    Article  Google Scholar 

  8. Kirlappos, I., Sasse, M.A.: Fixing security together: leveraging trust relationships to improve security in organizations. Proceedings of the NDSS Symposium 2015, no. 1, pp, 1–10 (2015)

    Google Scholar 

  9. Ashenden, D., Sasse, A.: CISOs and organisational culture: their own worst enemy? Comput. Secur. 39, 396–405 (2013)

    Article  Google Scholar 

  10. Adams, A., Sasse, A.: Users are not the enemy. Commun. ACM 42(12), 40–46 (1999)

    Article  Google Scholar 

  11. Inglesant, P., Sasse, M.: The true cost of unusable password policies: password use in the wild. In: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp. 383–392. (2010)

    Google Scholar 

  12. Parkin, S., van Moorsel, A., Inglesant, P., Sasse, M.: A stealth approach to usable security: helping IT security managers to identify workable security solutions. In: Proceedings of the 2010 Workshop on New Security Paradigms, pp. 33–49. (2010)

    Google Scholar 

  13. Zimmermann, V., Renaud, K.: Moving from a ‘human-as-problem” to a ‘human-as-solution” cybersecurity mindset. Int. J. Hum Comput Stud. 131, 169–187 (2019)

    Article  Google Scholar 

  14. Coventry, L., Briggs, P., Blythe, J., Tran, M.: Using behavioural insights to improve the public’s use of cyber security best practices. Gov. UK report (2014)

    Google Scholar 

  15. NCSC. The trouble with phishing (2018). https://www.ncsc.gov.uk/blog-post/trouble-phishing

  16. Kumaraguru, P., Rhee, Y., Acquisti, A., Cranor, L. F., Hong, J., Nunge, E.: Protecting people from phishing: the design and evaluation of an embedded training email system. In: Proceedings of ACM CHI 2007 Conference on Human Factors in Computing Systems, vol. 1, pp. 905–914. (2017)

    Google Scholar 

  17. Kumaraguru, P., Sheng, S., Acquisti, A., Cranor, L.F., Hong, J.: Teaching Johnny not to fall for phish. ACM Trans. Internet Technol. 10(2), 1–31 (2010)

    Article  Google Scholar 

  18. Siadati, H., Palka, S., Siegel, A., McCoy, D.: Measuring the effectiveness of embedded phishing exercises. In: 10th USENIX Workshop on Cyber Security Experimentation and Test (2017)

    Google Scholar 

  19. Rezaei, A., Allameh, S.M., Ansari, R.: Effect of organisational culture and organisational learning on organisational innovation: an empirical investigation. Int. J. Prod. Quality Manag. 23(3), 307–327 (2018)

    Google Scholar 

  20. McCarthy, B.: New economics of sociological criminology. Ann. Rev. Sociol. 28, 417–442 (2002)

    Article  Google Scholar 

  21. Becker, G.: Crime and punishment: an economic approach. J. Polit. Econ. 76(2), 169–217 (1968)

    Article  Google Scholar 

  22. Bankston, W., Cramer, J.: Toward a macro-sociological interpretation of general deterrence. Criminol. Interdiscip. J. 12(3), 251–280 (1974)

    Article  Google Scholar 

  23. Herath, T., Rao, H.R.: Protection motivation and deterrence: a framework for security policy compliance in organizations. Eur. J. Inf. Syst. 18(2), 106–125 (2009)

    Article  Google Scholar 

  24. Bratton, J., Gold, J.: Human Resource Management: Theory and Practice. Palgrave, London (2017)

    Book  Google Scholar 

  25. Ajmal, A., Bashir, M., Abrar, M., Khan, M.M., Saqib, S.: The effects of intrinsic and extrinsic rewards on employee attitudes; mediating role of perceived organizational support. J. Serv. Sci. Manag. 8(04), 461 (2015)

    Google Scholar 

  26. Burke, W.W.: Organization Change: Theory and Practice. Sage publications, Thousand Oaks (2017)

    Google Scholar 

  27. Jacobs, S., Renard, M., Snelgar, R.J.: Intrinsic rewards and work engagement in the South African retail industry. SA J. Ind. Psychol. 40(2), 1–13 (2014)

    Article  Google Scholar 

  28. Dhillon, G., Backhouse, J.: Current directions in IS security research: towards sociotechnical perspectives. Inf. Syst. J. Blackwell 11(2), 127–153 (2001)

    Article  Google Scholar 

  29. Hardy, C.: Understanding power: ‘Bringing about strategic change’. Br. J. Manag. (Special Issue) 17, S3–S16 (1996)

    Google Scholar 

  30. Walsh, C.: Power and advantage in organizations. Organ. Stud. 2(2), 131–152 (1981)

    Article  Google Scholar 

  31. Sasse, M.A., Brostoff, S., Weirich, D.: Transforming the ‘weakest link’—a human/computer interaction approach to usable and effective security. BT Technol. J. 19(3), 122–131 (2001)

    Article  Google Scholar 

  32. Michie, S., et al.: The behavior change technique taxonomy (v1) of 93 hierarchically clustered techniques: building an international consensus for the reporting of behavior change interventions. Ann. Behav. Med. 46(1), 81–95 (2013)

    Article  Google Scholar 

  33. Rahim, A.M.: Relationships of leader power to compliance and satisfaction with supervision: evidence from a national sample of managers. J. Manag. 12(4), 545–556 (1989)

    Google Scholar 

  34. Nunnally, J.C.: Psychometric Theory, 2nd edn. McGraw-Hill, New York (1978)

    Google Scholar 

  35. Braun, V., Clarke, V.: Using thematic analysis in psychology. Qual. Res. Psychol. 3(2), 77–101 (2006)

    Article  Google Scholar 

  36. Boss, S.R., Kirsch, L.J., Angermeier, I., Shingler, R.A., Boss, R.W.: If someone is watching, I’ll do what I’m asked: Mandatoriness, control, and information security. Eur. J. Inf. Syst. 18, 151–164 (2009)

    Article  Google Scholar 

  37. Patterson, K., Grenny, J., Maxfield, D., McMillan, R., Switzler, A.: Influencer: the Power to Change Anything. McGraw-Hill, New York, NY (2008)

    Google Scholar 

  38. Siponen, M., Willison, R., Baskerville, R.: Power and practice in information systems security research.” In: Proceedings of the International Conference on Information Systems, pp. 1–12. Association for Information Systems, Paris (2008)

    Google Scholar 

  39. Warkentin, M., Willison, R.: Behavioral and policy issues in information systems security: the insider threat. Eur. J. Inf. Syst. 18(2), 101–105 (2009)

    Article  Google Scholar 

  40. Harris, M., Furnell, S.: Routes to security compliance: be good or be shamed? Comput. Fraud Secur. 12, 12–20 (2012)

    Article  Google Scholar 

  41. Aurigemma, S., Mattson, T.: Deterrence and punishment experience impacts on ISP compliance attitudes. Inf. Comput. Secur. 25(4), 421–436 (2017)

    Google Scholar 

  42. Han, J., Kim, Y.J., Kim, H.: An integrative model of information security policy compliance with psychological contract: examining a bilateral perspective. Comput. Secur. 66, 52–65 (2017)

    Article  Google Scholar 

  43. Kim, B., Lee, D., Kim, B.: Deterrent effects of punishment and training on insider security threats: a field experiment on phishing attacks. Behav. Inf. Technol. 1–20 (2019)

    Google Scholar 

  44. Krebs, B.: Should failing phishing tests be a fireable offense? (2019). https://krebsonsecurity.com/2019/05/should-failing-phish-tests-be-a-fireable-offense

  45. UK Government.: Developing the UK cyber security profession (2019). https://www.gov.uk/government/consultations/developing-the-uk-cyber-security-profession

  46. Hinna, A., De Nito, E., Mangia, G., Scarozza, D., Tomo, A.: Advancing public governance research: individual and collective dynamics in and around the boardroom. Stud. Public Non-Profit Govern. 2, 3–39 (2014)

    Article  Google Scholar 

  47. Baldwin, T.T., Ford, J.K., Blume, B.D.: The state of transfer of training research: moving toward more consumer-centric inquiry. Hum. Resour. Dev. Q. 28(1), 17–28 (2017)

    Article  Google Scholar 

  48. Michie, S., Van Stralen, M.M., West, R.: The behaviour change wheel: a new method for characterising and designing behaviour change interventions. Implement. Sci. 6(1), 42 (2011)

    Article  Google Scholar 

Download references

Acknowledgements

This work was funded by the Centre for Research and Evidence on Security Threats (ESRC Award: ES/N009614/1).

Author information

Authors and Affiliations

  1. CybSafe, London, E14 5AB, UK

    John M. Blythe & Alan Gray

  2. School of Psychology, Cardiff University, Cardiff, CF10 3AT, UK

    Emily Collins

  3. School of Management, University of Bath, Bath, BA2 7AY, UK

    Emily Collins

Authors
  1. John M. Blythe
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Alan Gray
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Emily Collins
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to John M. Blythe .

Editor information

Editors and Affiliations

  1. San Jose State University, San Jose, CA, USA

    Abbas Moallem

Appendices

Appendix A

Behaviour Change Strategies Scale

To the best of your knowledge, has your organisation used any of the following within the last 12 months when it comes to managing human cyber risk and resilience? (Yes/No/I Don’t know)

  • Publicly recognised an employee as a security advocate (e.g. in an organisational newsletter, email etc.)

  • Given gifts to employees (e.g. prize draw, vouchers, time off)

  • Informed an employee’s line manager of risky behaviour (e.g. non-course completion, failing a phishing test)

  • Certificates of completion (e.g. awareness course completion)

  • Required an employee to sit/resit e-learning following assessment results

  • Named and shamed an employee for risky behaviour

  • Had a 1:1 with employees who have failed security awareness assessments

  • Required an employee to attend an in-person security awareness workshop

  • Issued an employee with a disciplinary warning

  • Locked an employee’s work station until security awareness training is complete

  • Decreased an employee’s privileged access

  • Other (please specify): ___________________

Appendix B

Attitudes Towards Users’ Scale

Please indicate the extent to which you agree with the following statements (Strongly Agree - Strongly Disagree)

  • It is the responsibility of individual employees to avoid clicking on phishing links

  • Employees who click on simulated phishing links should be punished

  • It is wrong to blame employees who click on simulated phishing links

Perceived Consequences of Simulated Phishing

Please indicate the extent to which you agree with the following statements (Strongly Agree - Strongly Disagree)

  • Our simulated phishing policy is damaging to employee morale

  • My organisation’s simulated phishing policy harms the relationship between our company and its employees

  • Employee satisfaction suffers because of my organisation’s simulated phishing policies

  • Employees feel ‘tricked’ when our organisation sends them simulated phishing emails

  • Our simulated phishing policy is damaging to employee productivity

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Blythe, J.M., Gray, A., Collins, E. (2020). Human Cyber Risk Management by Security Awareness Professionals: Carrots or Sticks to Drive Behaviour Change?. In: Moallem, A. (eds) HCI for Cybersecurity, Privacy and Trust. HCII 2020. Lecture Notes in Computer Science(), vol 12210. Springer, Cham. https://doi.org/10.1007/978-3-030-50309-3_6

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-50309-3_6

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-50308-6

  • Online ISBN: 978-3-030-50309-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation