Cyber Security Awareness Campaigns: Why do they fail to change behaviour?

Abstract

The present paper focuses on Cyber Security Awareness Campaigns, and aims to identify key factors regarding security which may lead them to failing to appropriately change people's behaviour. Past and current efforts to improve information-security practices and promote a sustainable society have not had the desired impact. It is important therefore to critically reflect on the challenges involved in improving information-security behaviours for citizens, consumers and employees. In particular, our work considers these challenges from a Psychology perspective, as we believe that understanding how people perceive risks is critical to creating effective awareness campaigns. Changing behaviour requires more than providing information about risks and reactive behaviours - firstly, people must be able to understand and apply the advice, and secondly, they must be motivated and willing to do so - and the latter requires changes to attitudes and intentions. These antecedents of behaviour change are identified in several psychological models of behaviour. We review the suitability of persuasion techniques, including the widely used 'fear appeals'. From this range of literature, we extract essential components for an awareness campaign as well as factors which can lead to a campaign's success or failure. Finally, we present examples of existing awareness campaigns in different cultures (the UK and Africa) and reflect on these.

Cited by in corpus (8)

• Challenges and Opportunities in Securing the Industrial Internet of Things
• Developing cybersecurity education and awareness programmes for Small and medium-sized enterprises (SMEs)
• If you can't understand it, you can't properly assess it! The reality of assessing security risks in Internet of Things systems
• The efficacy potential of cyber security advice as presented in news articles
• Countering Social Engineering through Social Media: An Enterprise Security Perspective
• Untersuchung der Wirkung von Data Storytelling auf das Datenverstaendnis von Dashboard-Nutzern
• An application of cyberpsychology in business email compromise
• "Privacy is the Boring Bit": User Perceptions and Behaviour in the Internet-of-Things