15 years ago, we learned that Johnny couldn't encrypt...

(or use any security tool, for that matter)

And we were shocked.

And confused.

And, just, sad.

We've spent the years since understanding why.

We've found at least three barriers inhibiting Johnny:

Johnny may not be aware of security threats or security tools.

(What is PGP? Or two-factor authentication?)

Johnny may not be motivated to use these tools to protect himself.

(Who would want to "hack" me?)

Johnny does not have the knowledge to use security tools.

(How would I encrypt e-mail, anyway?)

In other words, Johnny may have low security sensitivity.

We've used this understanding to do better.


1. Awareness: Risks/warnings communication.

2. Motivation: Cooler, faster security tools.

3. Knowledge: Usable interfaces.

But security sensitivity is still low.

What are we missing?

The Effect of Social Influence on Security Sensitivity

Sauvik Das {sauvik@cmu.edu}
Tiffany Hyun-Jin Kim {hyunjin@cmu.edu}
Laura Dabbish {dabbish@cmu.edu}
Jason I. Hong {jasonh@cs.cmu.edu}

Core Observation

Human beings are social creatures, and the decisions we make about security and privacy should be viewed within the context of a social system.

Introduction

We know that social influence is hugely important in the adoption of technology.

Introduction

We know that social influence can be powerfully effective at driving human behavior.

Introduction

Yet, we know little about how social processes affect security sensitivity.

Introduction

To explore this possibility, we set out to answer two questions:

Research Questions

Q1

What role does social influence play in security related behavior changes?

Research Questions > Q1

Q2

How and under what circumstances do people communicate about security and privacy?

Research Questions > Q2

To answer these questions, we conducted an interview study.

Method

We recruited:

19 participants

Age Range: 20—54

A variety of professional backgrounds

7 females

Method > Demographics

For Q1, we asked about specific instances of security related behavior changes.

Method > Semi-Structured Interview

For Q2, we asked about specific conversations they had about privacy or security.

Method > Semi-Structured Interview

3 Major Findings

Finding 1

Social influence often triggered security related behavior changes by modulating security sensitivity.

Finding 1: Behaviors

Almost all of our participants made at least one change because of a social trigger.



Almost half of all security related changes were made because of a social trigger.


Finding 1: Behaviors

What is a social trigger?

Finding 1: Behaviors > Social Triggers

A social process that was explicitly stated to be the root of a behavior change.

Finding 1: Behaviors > Social Triggers

“When I first had a smartphone I didn’t have a code, but then I started using one because everyone around me I guess had a code so I kind of felt a group pressure to also use a code.”—(P6, Male, 29, Programmer)

Finding 1: Behaviors > Social Triggers

“Diversification of passwords. I had the same password for every service so I wanted to pick a stronger password”—(P6, Male, 29, Programmer)

Finding 1: Behaviors > Social Triggers

We found many distinct social triggers, each effective at modulating security sensitivity.

Finding 1: Behaviors > Social Triggers

Observing Friends

Simply observing others use security features convinces people to use those features themselves.

Finding 1: Behaviors > Social Triggers > Observing Friends

“My mother had an iPhone before I did, and she always had the block on hers… I think just because I saw her doing it, it kind of just felt like it was something I had to do too.”—(P3, Female, 22, English Student)

Finding 1: Behaviors > Social Triggers > Observing Friends

“So when I was an undergrad I’ve been using it since then. And this four digit PIN everybody started using it and it was a hype."—(P14, Male, 24, IT Graduate Student)

Finding 1: Behaviors > Social Triggers > Observing Friends

Related to the concept of "social proof"—we look to friends for cues on what to do.



Observing Friends often raised awareness and motivation.

Finding 1: Behaviors > Social Triggers > Observing Friends

Pranks and Demonstrations

Demonstrations of insecure behavior by friends and loved ones.

Finding 1: Behaviors > Social Triggers > Pranks and Demonstrations

“When I was interning…one of my friends and a fellow intern came to my desk and just unlocked my  phone. I was surprised...He put it against the sunlight and he saw I guess the smudges my finger left. He just followed the direction. Yeah, he had access to my phone.” —(P18, Male, 20, Engineering student)

Finding 1: Behaviors > Social Triggers > Pranks and Demonstrations

Other demonstrations were not intended to be educational—they were pranks.

Finding 1: Behaviors > Social Triggers > Pranks and Demonstrations

“If I walk out of the room my friends just put up a funny status...or even just look through my messages or something like that... But once that happens, I usually change my password immediately”—(P19, Male, 20, Anthropology student) 

Finding 1: Behaviors > Social Triggers > Pranks and Demonstrations

Pranks and demonstrations were very effective at raising motivation.

Finding 1: Behaviors > Social Triggers > Pranks and Demonstrations

Social triggers do not necessarily raise security sensitivity—but they do modulate it.

Finding 1: Behaviors > Social Triggers > Negative Social Proof

“I don't think it will be dangerous...Like, my friends...have a lot of different accounts, the same as me. But they didn't get any trouble. So I think maybe it will not be dangerous.”—(P17, Female, 34, House wife) 

Finding 1: Behaviors > Social Triggers > Negative Social Proof

Back to Q1: What role does social influence play in driving security behaviors?

Finding 1: Behaviors > Summary

Social processes play a pivotal role in modulating security sensitivity.


Finding 1: Behaviors > Summary

But, social triggers come from security related interactions or communications, which remain rare.

Finding 1: Behaviors > Summary

“That’s one thing I will never talk about.”—(P11, Male, 54, Chef)

Finding 1: Behaviors > Summary

“It depends on the context. It does become a boring subject.”—(P9, Male, 30, Programmer)

Finding 1: Behaviors > Summary

When do conversations about security or privacy actually occur?

Finding 1: Behaviors > Summary

Finding 2

People did not often communicate about security, but did so primarily to teach or to warn .

Finding 2: Communications

Warnings

Conversations focused on raising awareness of a threat  that comes into the attention of the conversation initiator.

Finding 2: Communications > Warnings

Cautionary Tales

A warning-type conversation triggered by a security or privacy breach with the goal of warning friends and loved ones about a threat.


The threat was experienced either directly by the conversation initiator or by someone close.

Finding 2: Communications > Warnings > Cautionary Tales

“When I opened the e-mail, it said that they were...in England and they didn’t have enough money to come back to the States so can you send us some money...I was probably the first to contact them that they were hacked. I’m like, ‘This isn’t right. Something strange’“—(P11, Male, 54, Chef)

Finding 2: Communications > Warnings > Cautionary Tales

Targeted Warnings

Conversations where the initiator issues a warning about potential threats after observing others engaging in insecure behavior.

Finding 2: Communications > Warnings > Targeted Warnings

“I was having a conversation with somebody and they were saying, ‘Don’t you have your passcode on there anymore?’ And I said, ‘No, it’s a pain in the butt.’ And they said, ‘Well, it’d probably be a good idea especially if you like leave it lay around on your desk or something like that…’” (P7, Female, 54, Admin. Assistant) 

Finding 2: Communications > Warnings > Targeted Warnings

Teachings

Conversations focused on sharing  specific information about good security behaviors  to solve an immediate problem or avoid a future threat.

Finding 2: Communications > Teachings

Lectures

Generally one-way conversations where the lecturer informs the listener about good security practices.


Often parents to young children, adult children to parents, or managers to employees.

Finding 2: Communications > Teachings > Lectures

“I've told them to also use the same features that I do. Like having screen locks for phones and being more careful about passwords. And not logging into public computers and just leaving them without signing out.”—(P8, Male, 31, Accountant)

Finding 2: Communications > Teachings > Lectures

Social Learning

Conversation about observed novel security or privacy behaviors or tools. 

Observations by novices lead to questions that allow experts or early adopters to boast about their solutions for solving common security problems.

Finding 2: Communications > Teachings > Social Learning

“One of my co-workers told me about the whole algorithm thing...it just helps you I guess have different passwords...I guess you can...change your algorithm, depending on I guess what you want to be in it. But, ever since, I started using it.”—(P18, male, 22 years old) 

Finding 2: Communications > Teachings > Social Learning

Social learning conversations are ideal: curious novices willingly receive advice from experts.


Finding 2: Communications > Teachings > Social Learning

Back to Q2: Under what circumstances do people communicate about security and privacy?

Finding 2: Communications > Summary

People communicate about security and privacy to warn and to teach.

Finding 2: Communications > Summary

Thus, conversations about privacy and security tended to be educational experiences.

Finding 2: Communications > Summary

And, these educational conversations often led to heightened security sensitivity.

Finding 2: Communications > Summary

Observability was again a key driving force for security related conversations.


Finding 2: Communications > Summary

Finding 3

The observability of security tool usage was a key enabler of socially triggered behavior change and conversation.


Finding 3: Observability

Unfortunately, security and privacy tools are markedly unobservable (often intentionally).

Finding 3: Observability

Johnny has little social proof that security is important, and thus has little incentive to care about security.

Finding 3: Observability

Conclusion

We presented a retrospective interview study exploring the effects of social processes on modulating security sensitivity.  

Conclusion

Our results introduce a typology of social interaction around cybersecurity behavior.

Conclusion

3 Take-Aways

Conclusion > Take-Aways

1. Social processes play a pivotal role in modulating security sensitivity and triggering security related behavior change.

Conclusion > Take-Aways

2. Conversations about security and privacy are rare, but when they occur, they are primarily to warn or to teach.

Conclusion > Take-Aways

3. The observability of security tool usage is a key enabler of socially triggered behavior change and conversation.

Conclusion > Take-Aways

We've long overlooked the social forces driving security sensitivity.

Conclusion

Let's start taking these social considerations into account, to give Johnny a stronger reason to care about security.

Conclusion

Acknowledgements

This work was generously sponsored by the NDSEG fellowship, as well NSF CNS SaTC Award #1347186.

Food for Thought

1. Social processes play a pivotal role in modulating security sensitivity and triggering security related behavior change.

2. Conversations about security and privacy are rare, but when they occur, they are primarily to warn or to teach.


3. The observability of security tool usage is a key enabler of socially triggered behavior change and conversation.

Extra Slides

We've made learning about security more interesting and accessible to raise awareness.

We've built faster, cooler, and flashier security tools to increase motivation.

We've reduced the knowledge barrier by making security tools usable.

Made with Slides.com