Stories as Informal Lessons about Computer Security

Research Overview: Stories as Informal Lessons about Security

• The central research inquiry explores how everyday internet users make security decisions and where their perceptions of digital threats originate.

• Most users do not receive formal training to identify suspicious digital communications, such as sketchy emails; instead, they rely on informal narratives.

• Digital security management in the US resides overwhelmingly in the hands of non-experts:

  • There are over $81,000,000$ households in the US with an internet-connected computer.

  • These systems are largely managed by individuals with almost zero formal security knowledge.

• Attackers specifically target home users rather than IT departments or large corporations, which possess better resources for defense:

  • Data from $2006$ indicates that $86\%$ of new identified security threats were aimed specifically at home users.

Barriers to Home Computer Security Adherence

• Research into why homeowners struggle with implementable security measures highlights four primary obstacles:

  • $43\%$ of users do not understand the nature of the threats.

  • $38\%$ of users do not know how to operate security software.

  • $35\%$ do not know the technical requirements for securing a computer.

  • $32\%$ are entirely unaware that specific threats even exist.

Folk Models of Digital Security

• Non-expert users develop "folk models" to navigate security decisions. These are rough, simplified mental constructs rather than accurate technical depictions.

• These models dictate behavioral responses to threats:

  • The "Bored Teenager" Model: If a user perceives hackers as bored teenagers seeking amusement, they are likely to install a firewall to keep them out.

  • The "Organized Criminal" Model: If a user perceives hackers as professionals hunting for money, they may conclude they don't have enough wealth to be targeted, leading to a decision not to protect themselves at all.

Origins of Security Models: Three Primary Sources

• Personal Experience: Directly experiencing security incidents is rare. Furthermore, events like identity theft are often impossible to trace back to a specific action, and viruses do not clearly communicate what behavior caused the infection.

• Formal Education: Participation in security training or classes is low. Lessons are often forgotten quickly because the advice ignores the time, cost, and effort required by non-experts to implement it (e.g., advising recycling in a building without bins).

• Stories: This is the primary focus of current research. In the absence of experts or personal experience, people fall back on social narratives (e.g., "My friend clicked a link and their account was hacked").

Characteristics of Social Security Narratives

• Security information propagates through social circles in a manner similar to gossip.

• Source and Trust:

  • $85\%$ of remembered gossip involves people the user knows personally rather than celebrities.

  • $70\%$ of security stories are heard in personal environments like homes, cafes, or friend's houses.

  • $69\%$ are transmitted face-to-face via direct person-to-person communication (including instant messaging).

  • $64\%$ of stories specifically involve family or friends.

  • $90\%$ of study participants believe these stories to be true.

• Longevity: These stories remain influential over time. $71\%$ of reported stories were over a month old, and $40\%$ were over a year old.

Study Methodology: Michigan State University

• A survey was conducted in $\text{December 2011}$ and $\text{January 2012}$.

• The sample included five undergraduate telecommunication classes at Michigan State University.

• Participant demographics:

  • Age range: $18$ to $23$ years old.

  • Total usable responses: $301$.

  • Only $37\%$ of the sample had any technical or security background, representing a predominantly non-expert population.

• Procedure: Respondents brainstormed security threats and stories to jog memory, then selected one specific story to analyze in detail regarding its source, emotional impact, lesson, and resulting behavior change.

Thematic Analysis of Security Stories

• Since stories often contain multiple themes, they are categorized non-exclusively:

• PC Effects: The most common category. These focus on computer symptoms like slow performance or a "broken" state due to viruses. These stories prioritize the negative outcome (fear) over prevention.

• Theft: Overlaps heavily with "breaking in" and "phishing." Involves the loss of personal information or monetary assets.

• Spam: Involves receiving or sending unwanted messages. Recipients often frame spam as a symptom of the computer being "broken into."

Lessons Encoded in Stories

• $72\%$ of security stories carry an explicit lesson code:

  • Half of these are prescriptive (Always do something: e.g., "Always check the sender email address").

  • $30\%$ are proscriptive (Never do something: e.g., "Never give away your password").

• Common Themes of Lessons:

  1. Be Careful: General mistrust of strangers or the internet.

  2. Watch Specific Activities: Cautious approach to clicking and downloading.

  3. Guard Private Information: Protecting passwords and sensitive data.

• Informal lessons are frequently vague, requiring the receiver to reach their own conclusions rather than offering technical steps.

Impact on Behavior and Retrieval

• Cognitive Impact: $94\%$ of people report a change in their way of thinking after hearing a security story.

• Behavioral Impact: Only $52\%$ report taking actual steps to change their security behavior.

• Predictors of Behavioral Change:

  • Stories containing an explicit lesson.

  • Autobiographical stories (told by a close contact).

  • Stories that elicit strong emotional reactions, such as anxiety or anger.

  • Narratives involving knowledgeable sources in a home context.

• Social Propagation: $45\%$ of people retold the stories they heard. Of those, $97\%$ retold them to family or friends within one day. Stories involving high-seriousness threats (stolen money or passwords) propagate the fastest.

Theoretical Context: Evolutionary Psychology and Sense-Making

• Storytelling is framed as "Adaptive Collective Sense-Making."

• This is a basic human survival mechanism: learning from the failures of others to avoid the cost of first-hand experience (e.g., hearing a story about someone being eaten by a bear in a specific cave so one avoids that cave without being mauled).

• Stories are "cheap" to share but offer high survival payoffs for rare, dangerous events.

• They provide a causal explanation and allow a group to update collective models of danger.

Questions & Discussion

Lesson Refinement and Actionability:

• The group discussed how common advice like "Don't click on shady links" is not actionable because non-experts cannot distinguish between "shady" and "legitimate" links.

• Problem with URL Clarity: Malicious links can be visually obscured (e.g., the text says "google.com" but the hyperlink leads to a malicious site).

• URL Parsing Issues: Most users do not understand the hierarchy of URLs. For example, they may trust "facebook.blah.com" because the word "Facebook" is present, failing to recognize that the second-level domain is actually "blah.com".

• Technical Limitations of Advice: Advising users to look for "HTTPS" is insufficient because malicious sites can also use secure connections to bad servers.

Improving Security Communication:

• The group proposed that security lessons need to be simple and "packageable" like physical safety advice (e.g., "Lock your windows at night").

• Interface Support:

  • Apple's iCloud email system now uses verified brand icons (e.g., a Qantas logo next to a Qantas email) to signify legitimacy.

  • Historically, the EV (Extended Validation) indicator for banking websites provided a non-technical heuristic for users to verify they were on the correct site.

• The goal for future practice is to design better security stories or platforms that help spread actionable heuristics rather than vague warnings.