Stories as informal lessons about security

Abstract

Non-expert computer users regularly need to make securityrelevant decisions; however, these decisions tend not to be particularly good or sophisticated. Nevertheless, their choices are not random. Where does the information come from that these non-experts base their decisions upon? We argue that much of this information comes from stories they hear from other people. We conducted a survey to ask open-and closed-ended questions about security stories people hear from others. We found that most people have learned lessons from stories about security incidents informally from family and friends. These stories impact the way people think about security, and their subsequent behavior when making security-relevant decisions. In addition, many people retell these stories to others, indicating that a single story has the potential to influence multiple people. Understanding how non-experts learn from stories, and what kinds of stories they learn from, can help us figure out new methods for helping these people make better security decisions.

Cross-country analysis of spambots

“…To the extent that security awareness and corresponding mitigation strategies are contingent on stories exchanged in communities [63], the exposure of a homogenous community would be lower. While it is difficult to test this relationship on a country level, it may be possible by looking at indicators of income inequality, e.g., GINI index.…”

Multiple Sources for Security: Seeking Online Safety Information and their Influence on Coping Self-efficacy and Protection Behavior Habits

“…However, individuals may not be aware of these resources, or know where to look for information about an emergent threat, leaving many individuals to rely on hearsay [5]. Using search engines to find help is often challenging.…”

“…Media, government, businesses, educational institutions, and non-profit organizations offer everything from breaking news to advanced technical training. Friends and family who may know more about technology offer advice or stories about experiences with security violations [5]. Even though all these groups have the same general goal of helping individuals improve their online safety habits, little is known how different sources affect security beliefs and behaviors.…”

Understanding the Experience-Centeredness of Privacy and Security Technologies

“…Indeed, dialogue implies: (i) openness and creativity in how we engage with others; (ii) responsiveness to another's needs, aspirations and concerns; (iii) actively listening and withholding judgment [43]. Storytelling is a common vehicle to engage someone in dialogue-indeed, recent research has even suggested the value of user storytelling in relation to security issues [28]. Considering these three facets and the notion of storytelling, we can see how an interview protocol that runs through a list of pre-determined questions is not dialogue.…”

“…Storytelling is an important feature of experience-centered design, and there are already examples of using stories to elicit insights from users in relation to security and privacy (e.g. [28]). But we may also think about the ways technologies may be explicitly designed and deployed to provoke reaction and reflection upon personal practices.…”