User Perceptions of Phishing Consequence Severity and Likelihood, and Implications for Warning Message Design

Foster, E.; Jones, Keith S.; Armstrong, Miriam; Namin, Akbar Siami

doi:10.1007/978-3-030-79997-7_33

Cited by 1 publication

(1 citation statement)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the present results do not specify exactly how severe participants perceived specific consequences to be. Foster et al (2021) addressed that issue for phishing attack consequences. Future research should examine the perceived severity of the consequences of other attack types, which will provide an important piece to our understanding of how users think about cyberattack consequences.…”

Section: Future Directionsmentioning

confidence: 99%

How do non experts think about cyber attack consequences?

Jones

Lodinger

Widlus

et al. 2022

ICS

Self Cite

View full text Add to dashboard Cite

Purpose Nonexperts do not always follow the advice in cybersecurity warning messages. To increase compliance, it is recommended that warning messages use nontechnical language, describe how the cyberattack will affect the user personally and do so in a way that aligns with how the user thinks about cyberattacks. Implementing those recommendations requires an understanding of how nonexperts think about cyberattack consequences. Unfortunately, research has yet to reveal nonexperts’ thinking about cyberattack consequences. Toward that end, the purpose of this study was to examine how nonexperts think about cyberattack consequences. Design/methodology/approach Nonexperts sorted cyberattack consequences based on perceived similarity and labeled each group based on the reason those grouped consequences were perceived to be similar. Participants’ labels were analyzed to understand the general themes and the specific features that are present in nonexperts’ thinking. Findings The results suggested participants mainly thought about cyberattack consequences in terms of what the attacker is doing and what will be affected. Further, the results suggested participants thought about certain aspects of the consequences in concrete terms and other aspects of the consequences in general terms. Originality/value This research illuminates how nonexperts think about cyberattack consequences. This paper also reveals what aspects of nonexperts’ thinking are more or less concrete and identifies specific terminology that can be used to describe aspects that fall into each case. Such information allows one to align warning messages to nonexperts’ thinking in more nuanced ways than would otherwise be possible.

show abstract

Section: Future Directionsmentioning

confidence: 99%