Attribution And Security Behavior

Computer security largely depends on appropriate user behavior, their conscious thinking, and actions they take. This exploratory study examines the relationship between computer-related causal attributions and security behavior (i.e., the use of security technology and security-conscious care behavior). Attribution theory deals with the subjectively perceived causes of events and is commonly used for explaining and predicting human behavior and motivation. Individuals’ attributions could either positively, or negatively influence one’s learning behavior, confidence levels, effort, or persistence. The results of an online survey with 179 participants suggest that especially attributions in situations of success are influential towards security

ACM Classification Keywords

J.4. Social and Behavioral Sciences: Psychology; K.6.5. Management of Computing and Information Systems: Security and Protection

INTRODUCTION

According to Internet Live Stats database, more than 43% of the world’s population had access to the Internet in 2015 [3] and the use of the Internet has become a common practice in our everyday lives. Individuals use the Internet to conduct their daily activities, such as online shopping, e-banking, sharing private information via social networks or email. While people enjoy convenient advantages of online activities, there are various security threats such as spam, malware, hacking, phishing, etc. Security incidents may result e.g. in financial damages or the misuse of personal data. For example, in Germany alone, cybercrime caused financial damage of €40,5 million in 2015 [37]. A survey investigating Internet users’ experiences with cybercrime in Germany in 2014 showed that roughly 43% of respondents aged 14 years and older had already fallen victim to cybercrimes like fraud, identity theft or phishing [38]. In 2013, the global spending for security services (e.g. predictive security, advanced threat defense, real-time threat management, situational risk awareness) amounted to $795 million [42]. Despite many available security mechanisms (anti-virus/anti-spyware software, firewall, etc.) and numerous efforts of institutions

Some studies deal e.g. with the questions of how users assess threats on the Internet and the measures they take to counteract these risks (e.g. [12], [4]). Other researchers have noted that users differ in their effort and motivation to protect their personal data, as well as in their knowledge about tools and risks. For example, the DIVSI milieu study on trust and security on the Internet [8] developed a typology of seven user-types that describe and reflect the behavior of Internet users in Germany regarding their attitudes towards trust and security, as well as their everyday life background and their position in society. Another example are the privacy personas developed by Dupree et al. [9]. They clustered users based on their attitudes and behaviors toward security practice. Furthermore, some studies examined the influence of individual differences by means of the Big-Five model (e.g. [39], [43], [40]). Other related studies investigated factors like age, education level, ability to control impulsivity, familiarity with computers, and personality