The Microfoundations of State Cybersecurity: Cyber Risk Perceptions and the Mass Public

Abstract

Cybersecurity represents a unique national security challenge for states: data breaches with the potential for national, macro-level consequences are most likely to occur at the micro-level, originating through the security errors of individual computer users. Thus, aspects of national cybersecurity can often critically depend on the personal attitudes and behavior of average citizens connecting online. However, to date, theories of state cybersecurity have almost exclusively focused on the macro-level, and very little is known about how the mass public reacts to—and protects themselves from—cybersecurity threats. This study addresses this gap, drawing on psychological theories of risk perception to explain why the public simultaneously reports great concern about cybersecurity, yet does little to protect their personal safety online. Using a novel survey experiment, we examine how exposure to different types of data breaches impacts citizens’ cyber risk assessments, personal online behavior, and support for various national cybersecurity policies. We find that baseline concerns about cybersecurity and knowledge about safe online practices are very low. However, exposure to a personally relevant data breach heightens risk perception and increases willingness to engage in safer online practices. But these effects are circumscribed—actual online behavior is more resistant to change. These results have important implications for the design of effective state cybersecurity policy.

Predicting individual differences to cyber attacks: Knowledge, arousal, emotional and trust responses

“…This perceived personal locus of control may similarly explain the higher levels of situational trust in technology in response to phishing (relative to malware and ransomware). Our pattern of results is thus consistent with the hypothesis of Kostyuk and Wayne (2021) that knowledge and controllability influence assessments of cyber risk. There is also research to suggest that phishing attacks may instead/also negatively impact trust in other people ("phishers") or in oneself in the form of loss of self-confidence if one fell for the attack (Kelley et al, 2012).…”

“…Another important avenue for further research would be to assess how exposure to personally relevant cyber threat scenarios and the resulting affective responses impact the subjects' future computer security attitudes and behaviors. When Kostyuk and Wayne's (2021) subjects were exposed to an article about a personally relevant cyber data breach, they reported a higher level of perceived personal risk for future cyber threats, but did not actually change their on-line behavior (i.e., remained susceptible to a phishing email) or their reported support for specific national cyber-security policies. In their study, however, subjects were not assessed directly on their emotional responses (valence & arousal) to their cyber threat stimuli, so it would be interesting to investigate if the nature or strength of affective responses might mediate/predict behavioral change and policy support.…”

Cyber Risk Perception in the Maritime Domain: A Systematic Literature Review

“…The findings indicate that in most cases when people have knowledge of, and are familiar with the cyber risk in question [72], they perceive the risk as lower than if they have limited knowledge [56], [57], [61], [63]- [65]. In one of the studies the result was the opposite, but the values were not statistically significant [58].…”

Balancing the Freedom–Security Trade-Off During Crises and Disasters

“…For example, communicating the dangers of hurricanes or wildfires increases people’s willingness to evacuate (Demuth et al, 2016; McLennan et al, 2019), and conveying the dangers of climate change increases support for freedom-restricting climate policies (Feldman & Hart, 2018). Likewise, people who perceive greater danger of hacking and other online security violations are more supportive of government cybersecurity policy (Kostyuk & Wayne, 2021), and greater perceptions of risk are associated with increased support for restrictions on the use of nuclear power (Hartmann et al, 2013). There is a large body of work in public health illustrating the potential benefits of making risks and threats salient (Kok et al, 2018; Witte & Allen, 2000), and initial converging evidence in the context of the COVID-19 pandemic suggests that perceiving the coronavirus as more threatening makes people more supportive of and compliant with government policies such as mask mandates and lockdowns (Barceló & Sheen, 2020; Broomell et al, 2020; Harper et al, 2020).…”