Fluent Essays

Research article: Provide a description of each article in a min of 100 words in APA format. how_users_perceive_and_respond.pdf beyond_organisational_agendas.pdf the_effective_promotion_of_inf.pdf personality_traits_and_concern.pdf organizational_information_sec.pdf Unformatted Attachment Preview European Journal of Information Systems (2016) 25, 364–390 © 2016 Operational Research Society Ltd. All rights reserved 0960-085X/16 www.palgrave-journals.com/ejis/ RESEARCH ESSAY How users perceive and respond to security messages: a NeuroIS research agenda and empirical study Bonnie Brinton Anderson1, Anthony Vance1, C. Brock Kirwan2, David Eargle3 and Jeffrey L. Jenkins1 1 Information Systems Department, Marriott School of Management, Brigham Young University, Provo, U.S.A.; 2Department of Psychology and Neuroscience, Brigham Young University, Provo, U.S.A.; 3Katz Graduate School of Business, University of Pittsburgh, U.S.A. Correspondence: Anthony Vance, Information Systems Department, Brigham Young University, 779 TNRB, Provo, UT 84604, U.S.A. Tel: +1 801 361 2531; E-mail: anthony@vance.name Abstract Users are vital to the information security of organizations. In spite of technical safeguards, users make many critical security decisions. An example is users’ responses to security messages – discrete communication designed to persuade users to either impair or improve their security status. Research shows that although users are highly susceptible to malicious messages (e.g., phishing attacks), they are highly resistant to protective messages such as security warnings. Research is therefore needed to better understand how users perceive and respond to security messages. In this article, we argue for the potential of NeuroIS – cognitive neuroscience applied to Information Systems – to shed new light on users’ reception of security messages in the areas of (1) habituation, (2) stress, (3) fear, and (4) dual-task interference. We present an illustrative study that shows the value of using NeuroIS to investigate one of our research questions. This example uses eye tracking to gain unique insight into how habituation occurs when people repeatedly view security messages, allowing us to design more effective security messages. Our results indicate that the eye movement-based memory (EMM) effect is a cause of habituation to security messages – a phenomenon in which people unconsciously scrutinize stimuli that they have previously seen less than other stimuli. We show that after only a few exposures to a warning, this neural aspect of habituation sets in rapidly, and continues with further repetitions. We also created a polymorphic warning that continually updates its appearance and found that it is effective in substantially reducing the rate of habituation as measured by the EMM effect. Our research agenda and empirical example demonstrate the promise of using NeuroIS to gain novel insight into users’ responses to security messages that will encourage more secure user behaviors and facilitate more effective security message designs. European Journal of Information Systems (2016) 25(4), 364–390. doi:10.1057/ejis.2015.21; published online 23 February 2016 Keywords: security messages; information security behavior; NeuroIS; habituation; dualtask interference; eye tracking Introduction Received: 2 March 2014 Revised: 2 November 2015 Accepted: 10 November 2015 In recent years, information security has emerged as a top managerial concern, driving the worldwide security technology and services market to a value of U.S.$67.2 billion in 2013, and it is expected to increase to $86 billion by 2016 (Gartner, 2013). Despite the growing investment in information security technology, users continue to represent the weakest link in How users perceive and respond to security messages security (Furnell & Clarke, 2012). Accordingly, attackers increasingly target users to gain access to the information resources of organizations (Mandiant, 2013). A crucial aspect of security behavior is how users perceive and respond to security messages – discrete communication designed to persuade users to either impair or improve their information security posture. Research shows that users are susceptible to malicious messages such as phishing attacks that prompt users to install malware or visit compromised Websites (Hong, 2012). A parallel stream of research shows that users routinely disregard protective messages such as software security warnings (Bravo-Lillo et al, 2013). One reason for the ineffectiveness of warnings is the mismatch between security concerns and security behavior. For example, individuals’ stated security concerns have been found to be inconsistent with their subsequent behavior in response to security warnings (Vance et al, 2014). These empirical results confirm those of Crossler et al (2013), who called for research that explains the discrepancy between security intentions and behaviors. One promising means for exploring the security intention–behavior disparity in the context of security messages is NeuroIS – cognitive neuroscience and its associated neurophysiological measures applied to information systems (Dimoka et al, 2011). The neural bases for human cognitive processes can offer new insights into the complex interaction between information processing and decision making (Dimoka et al, 2012), allowing researchers to open the ‘black box’ of cognition by directly observing the brain (Benbasat et al, 2010). The potential of NeuroIS has been recognized by security researchers who have begun using neurophysiological measures to investigate security behavior (e.g., Moody et al, 2011; Warkentin et al, 2012; Hu et al, 2014; Vance et al, 2014; Neupane et al, 2014, 2015). We term this approach neurosecurity (Anderson et al, 2015). Crossler et al (2013, p. 96) observed that ‘these studies, and others like them, will offer new insights into individual behaviors and cognitions in the context of information security threats’. In this article, we argue for the potential of NeuroIS to shed new light on users’ reception of security messages. We contribute to the nascent area of NeuroIS security research by presenting a research agenda for examining cognitive and emotional responses to security messages. To do so, we outline four key questions drawn from the security and cognitive neuroscience literature that directly relate to how users receive and process security messages. NeuroIS theories and methodologies can help advance pressing needs in each of these areas, generating potentially fruitful streams of research. These are not the only important research questions, but they represent the security issues that NeuroIS is ideally suited to address. Therefore, our guiding questions for researching security messages via NeuroIS are: 1. How does habituation affect users’ responses to security messages? 2. What is the impact of stress on a users’ response to security messages? Bonnie Brinton Anderson et al 365 3. How does fear influence users’ cognitive processing of security messages? 4. How does dual-task interference, for example, multitasking, disrupt the cognitive processing of security messages? To illustrate how NeuroIS can be used to advance these research questions, we present the results of an experiment that uses the NeuroIS method of eye tracking to begin exploring our first research question on habituation. Habituation as a mental state is difficult to observe using conventional methods. Therefore, security researchers have examined habituation indirectly by observing its influence on security behavior rather than by measuring habituation itself (e.g., Brustoloni & Villamarín-Salomón, 2007; Bravo-Lillo et al, 2013). Although valuable for highlighting the problem of habituation with regard to security warnings, these conventional methods do not provide insight into the neural process of habituation, which could lead to more effective security message designs. We illustrate the potential of NeuroIS to address this gap in two ways. First, using eye tracking to measure the eye movement-based memory (EMM) effect – a neural phenomenon in which people unconsciously scrutinize images previously seen – we demonstrate how habituation develops in the brain. We show that after only a few exposures to a warning, habituation sets in rapidly and continues to decline with further repetitions. These results (a) reveal how quickly habituation to warnings develops over time, and (b) provide a neurobiological explanation for why it occurs – both contributions made possible through the application of NeuroIS. Second, we use eye tracking to evaluate the effectiveness of a security message designed to reduce habituation, a polymorphic warning whose appearance changes with each exposure. Previous studies of habituation were limited in their efforts to design warnings that target habituation because they did not have the benefit of neurophysiological measures. Using eye-tracking measures of the EMM effect, we were able to directly measure whether a polymorphic warning was effective in reducing habituation. We found that people were substantially less habituated to polymorphic warnings compared with conventional warnings. Our research agenda and illustrative experiment demonstrate the promise of using NeuroIS to study users’ responses to security messages. We anticipate that the pursuit of this research agenda will provide scholars with a more complete understanding of how users neurologically process security messages, which will lead to the more accurate development and application of theory (Dimoka et al, 2011). We also expect that the neurophysiological data stemming from this research will guide the design and testing of more effective forms of security messages to mitigate security threats to users (Dimoka et al, 2012). This article echoes Crossler et al (2013) call to use NeuroIS methods to study information security European Journal of Information Systems 366 How users perceive and respond to security messages behavior by identifying the insights that can be gained through neurophysiological methods. This article is organized as follows. First, we formally define security messages and give a brief overview of NeuroIS methods. We then describe the literature review we performed to identify our research questions. Next, for each research question, we highlight (a) existing gaps in the security literature, and why these gaps are important to address, and (b) potential ways NeuroIS can be used to address these gaps. We then show the value of applying NeuroIS to investigate our research questions through an eye-tracking experiment. Finally, we describe the implications of our research agenda for future research on security messages. Review of security messages and NeuroIS Security messages We define a security message as discrete communication that is designed to persuade users to either impair or improve their information security posture. Most security messages are predominantly textual, such as software dialogs or e-mail communication, but messages may be aural, visual, or both, such as voicemail memos, signage, or online videos. See Appendix A for a taxonomy of security messages. Our definition is broad in that it includes messages from both attackers and defenders because both commonly use the same persuasive techniques and cues (Dhamija et al, 2006; Abbasi et al, 2010; Bravo-Lillo et al, 2013), and engage many of the same mental processes (Wright & Marett, 2010; Luo et al, 2013). Our definition is narrow, though, because it includes only discrete messages, rather than the entirety of security-related communication. The latter typically includes interaction with coworkers and peers; security, education, training, and awareness (SETA); classroom instruction (Karjalainen & Siponen, 2011); and sustained social engineering attacks that might continue over hours, days, or longer (Mitnick & Simon, 2001). The potential of NeuroIS to explain security behavior As the field of information security behavior matures, understanding why a particular behavior happens becomes increasingly necessary. To this end, NeuroIS offers a promising approach for investigating the effectiveness of security (Crossler et al, 2013). The neural bases for human cognitive processes can offer new insights into the complex interactions among the processing of security messages, decision making, and behavior (Dimoka et al, 2011). Whereas IS researchers have historically relied on external measures of cognition, such as survey responses or observed behavior, neuroscience methods allow researchers to open the ‘black box’ of cognition by directly observing brain processes (Benbasat et al, 2010). NeuroIS holds the promise of ‘providing a richer account of user cognition than that obtained from any other source, including the user himself’ (Minnery & Fine, 2009, p. 73). The promise of applying neuroscience to Human European Journal of Information Systems Bonnie Brinton Anderson et al Computer Interaction (HCI) is to use insights from research on neural processes to design effective user interfaces that can help users make informed decisions (Mach et al, 2010; Riedl et al, 2010). Table 1 presents a sampling of the variety of tools and measures available in NeuroIS, along with key citations for more information about each method. For further information, see Dimoka et al (2012) and Riedl et al (2014), who offer a thorough discussion of the methods, tools, and measurements associated with NeuroIS. Identifying research questions for examining users’ reception of security messages through the lens of NeuroIS To select questions for our research agenda, we took a three-pronged approach by analyzing (1) security message literature from premier IS and HCI-security publications; (2) IS-security research essays and calls for papers; and (3) NeuroIS literature. Approaches (1) and (2) helped identify important and relevant research questions, while approach (3) ascertained whether the research questions identified would be productively investigated using NeuroIS methods. This approach follows the recommendation of vom Brocke & Liang (2014), who emphasize the importance of selecting NeuroIS research questions that, first and foremost, answer problems of importance to the IS community, and second, benefit from studies using neurophysiological measures. Survey of the IS and HCI-security literature To identify articles describing security messages, we searched for articles in the AIS Senior Scholars basket of six journals (AIS-6; Lowry et al, 2013), and in premier computer science publications on human–computer interaction and security, including the Conference on Human Factors in Computing Systems (CHI), the Symposium on Usable Privacy and Security (SOUPS), and the USENIX Security Symposium. In each of these outlets, we searched for articles with security in the title, abstract, or keywords that were published before July 2014. We also filtered the articles based on whether they included terms derived from our taxonomy in Appendix A. We narrowed the articles to include only those that were behaviorally oriented and focused on security messages. Our review resulted in 29 articles, some of which addressed multiple research questions. These articles, combined with the IS search results, are listed in Table B1 of Appendix B. Table 2 summarizes the overarching research questions extracted from the papers we reviewed and the count of articles that supported each one. Table B2 of Appendix B presents a detailed research question set showing each question identified and its frequency of occurrence. Several studies examined participants’ attitudes, beliefs, and motivations related to security messages, but there was no cohesion on that topic. Thus, this article does not address this research question. Table 1 Description and focus of measurement of commonly used neurophysiological tools Strengths Weaknesses Psychophysiological tools Eye tracking (e.g., Proctor & Vu, 2006; Castellina et al, 2008) Eye pupil location (gaze) and movement Identify visual activity; clear visualization of what was viewed at any given moment Skin conductance response (SCR) or electrodermal activity (EDA) (e.g., Dawson et al, 2011) Facial electromyography (fEMG) (e.g., Ekman et al, 1992; Minas et al, 2014) Sweat in eccrine glands of the palms or feet Low cost; easy to use; minimal intervention on subjects Electrical impulses on the face caused by muscle fibers High degree of precision, widely accessible, minimally invasive Electrocardiogram (ECG or EKG) (e.g., Ortiz de Guinea et al, 2013; Schellhammer et al, 2013) Measurement of cortisol levels (e.g., Wastell & Newman, 1993; Riedl, 2012) Mouse-cursor tracking (e.g., Freeman & Ambady, 2010; Grimes et al, 2013) Electrical activity on skin caused by heart muscles Minimally invasive; low cost; widely accessible Does not capture peripheral vision; cannot ensure gaze equates with thought or attention; artificial setting may bias behavior Lack of predictable measurement; habituation; still some debate on interpretation Only a small number of muscles can be measured; difficulty with interpretation; setting may bias behavior Heart rate may be affected by a wide variety of factors Level of cortisol (commonly called the stress hormone) in one’s bloodstream or saliva The cursor location and movement properties on the screen Minimally invasive; low cost Non-invasive; standard data analysis methods; spatial resolution Positron emission tomography (PET) (e.g., Haier et al, 1988; Bench et al, 1993) Blood flow changes or blood oxygenation level dependent signal (BOLD response) in the brain because of neural activity Metabolic changes in the brain because of neural activity Electroencephalography (EEG) (e.g., Minas et al, 2014; Vance et al, 2014) Electrical potentials on the scalp because of neural activity Magnetoencephalography (MEG) (e.g., Pantev et al, 2004; Moses et al, 2007) Transcranial magnetic stimulation (TMS) (e.g., Hiraga et al, 2009; Schutter & van Honk, 2009) Magnetic field changes because of neural activity Weak electrical current causes activity in specific parts of the brain – measure activity and function of specific connections/ pathways Blood flow changes (BOLD response) in the brain because of neural activity Inexpensive; tolerant of a little subject motion; directly measures electrical activity; temporal resolution in milliseconds Temporal resolution in milliseconds; deeper capability than EEG Non-invasive; less expensive than fMRI Brain imaging tools Functional magnetic resonance imaging (fMRI) (e.g., Dimoka, 2010, 2012) Spatial resolution Non-invasive; less expensive and more portable than fMRI Artificial setting; temporal resolution (few seconds’ delay); need to be careful with correlation vs causation Invasive (because of injected tracer); potentially harmful; low temporal resolution (2–3 min) Spatial resolution; only sensitive to outer layers of cortex Spatial resolution Can only stimulate 2 in deep; may induce seizure or fainting Can only measure cortical activity 4 cm deep 367 European Journal of Information Systems Functional near-infrared spectroscopy (fNIR) (e.g., Kemper et al, 2007; Gefen et al, 2014) Inexpensive; non-invasive; mass-deployable; useful in natural and non-laboratory settings; surrogate for attention; changes in movement precision correlate with emotional changes Cortisol levels peak 10–40 min after stressor onset Cannot capture attention if the mouse cursor is not moving. Cannot ensure movement equates with thought or attention Bonnie Brinton Anderson et al Focus of measurement How users perceive and respond to security messages Neurophysiological tools 368 Table 2 How users perceive and respond to security messages Reduced research questions sorted by article count Research question Attention/habituation Comprehension Attitudes and beliefs, motivations Fear Dual-task interference Stress Gender differences Social norms Uncertainty Count 22 18 10 6 6 5 1 1 1 Survey of the IS security calls fo ... Purchase answer to see full attachment