Supporting Security Policy with Effective Digital Intervention (SSPEDI)

The behaviour of people is known to be critical to the security of organizations across all sectors of the economy. As users of IT systems, their action, or inaction, can create cyber security vulnerabilities. For example, users can be tempted to give away their authentication credentials (by phishing), to install malign software (malware), choose weak or inadequate passwords, or they may fail to install security patches, to scan computers for viruses, or to make secure backups of critical data.

Organizations design security policies which users are supposed to follow, for example, instructing them not to give away their authentication (login) credentials, or not to open certain kinds of attachments sent in unsolicited emails. However, in practice, managers find it very difficult to encourage users to follow policy.

This project will investigate effective ways to improve security communications with users, to enable them to understand security risks, and to persuade them to comply with policy. Our hypothesis is that to be most effective, communications and policy implementations must take into account individual personalities and motivations. Technological support is therefore required to support security communications and security persuasion so that it can scale up to large organizations.

We propose to transfer ideas and knowledge from the existing academic field of persuasive technologies and digital behaviour interventions, and apply them to the user security compliance problem. We will build, and trial, real technologies that implement persuasive strategies in real user security scenarios. These scenarios will be selected in partnership with industrial security practitioners.

The project takes a broad, interdisciplinary view of the roots of the user compliance challenge, and draws additionally on expert knowledge from the fields of psychology, behavioural decision, security, sentiment analysis and argumentation in search of solutions.

User compliance with IT security policy is a difficult challenge faced by managers of most organisations, across all sectors of the economy. Security risks could often be mitigated if users were to comprehend and follow policies. Even very technical attacks often require a failing on the human side of cyber defences. For example, phishing is often used to steal authentication (login) credentials of users, which can then be exploited in a complex attack, and users can also be tricked into authorising actions by malware sent as email attachments. Encouraging appropriate user behaviour within organisations is thus key to securing organisations, and thus to building a resilient nation.

The proposed research aims to deepen knowledge of how to support the implementation of IT security policies using digital behaviour interventions. It will investigate strategies for security communication with users of IT in organisations, and trial effective, personalised computer technologies that can persuade users to comply with policy. Worldwide research in this area is in its infancy, although attempts to persuade, of one form or another, are used throughout security. This project will move the UK to a world leading position in digital behaviour intervention and persuasion in security.

The impact will be of three principal kinds. Firstly, it will generate empirical knowledge of which digital intervention strategies are likely to be successful for which kinds of security policies in which organisational contexts. This knowledge will be of interest to IT professionals and managers as well as those interested in the scientific outcomes. Secondly, this knowledge, and technologies similar to those trialled, will be applicable within organisations by IT security practitioners. The results may translate to broader IT security communication situations, for example, between governments and individuals (although this is not a goal for the project). Thirdly, the research will contribute to the nation's cyber-security capacity by building and strengthening relationships between academics and industry professionals, and by developing skills and human capital around security and persuasion.

The research will be conducted alongside industry experts to ensure that it tackles human factors security policy scenarios of the greatest relevance, and so that pathways to translate the research knowledge into practice are clearly identified.