The design of messages to improve cybersecurity incident reporting

Pam Briggs; Debora Jeske; Lynne Coventry

doi:10.1007/978-3-319-58460-7_1

The design of messages to improve cybersecurity incident reporting

Pam Briggs, Debora Jeske, Lynne Coventry^*

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

10 Citations (Scopus)

Abstract

Cybersecurity suffers from the problem of poor incident reporting. We explored message influences on incident reporting rate. Participants were presented with messages that differed in terms of (i) whether the problem was framed as a technical or a security issue and (ii) the perceived beneficiaries of making a report (benefit to the user, to others vs. no benefit message). Participants were more likely to report a problem if so doing implied some benefit to self, where making the problem more personally relevant might act to reduce social loafing in group settings. They were also more likely to report a technical rather than a security problem and qualitative data suggested that users were sometimes suspicious of messages reporting a security incident – believing that the message itself might be a cybersecurity attack. The findings provide starting points for future research aimed at improving incident reporting.

Original language	English
Title of host publication	Human Aspects of Information Security, Privacy and Trust
Subtitle of host publication	5th International Conference, HAS 2017, Held as Part of HCI International 2017, Vancouver, BC, Canada, July 9-14, 2017, Proceedings
Editors	Theo Tryfonas
Place of Publication	Cham
Publisher	Springer Verlag
Pages	3-13
Number of pages	11
ISBN (Electronic)	9783319584607
ISBN (Print)	9783319584591
DOIs	https://doi.org/10.1007/978-3-319-58460-7_1
Publication status	Published - 13 May 2017
Externally published	Yes
Event	5th International Conference on Human Aspects of Information Security, Privacy and Trust - Vancouver Convention Centre, Vancouver, Canada Duration: 9 Jul 2017 → 14 Jul 2017 Conference number: 5 http://2017.hci.international/pagesmith/129

Publication series

Name	Lecture Notes in Computer Science (including subseries Information Systems and Applications, incl. Internet/Web, and HCI (LNISA))
Publisher	Springer
Volume	10292
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	5th International Conference on Human Aspects of Information Security, Privacy and Trust
Abbreviated title	HAS 2017
Country/Territory	Canada
City	Vancouver
Period	9/07/17 → 14/07/17
Internet address	http://2017.hci.international/pagesmith/129

Keywords

Security
User behavior
Incident reporting
Behavior change
Protection-motivation theory
Social loafing

Access to Document

10.1007/978-3-319-58460-7_1

Cite this

Briggs, P., Jeske, D., & Coventry, L. (2017). The design of messages to improve cybersecurity incident reporting. In T. Tryfonas (Ed.), Human Aspects of Information Security, Privacy and Trust: 5th International Conference, HAS 2017, Held as Part of HCI International 2017, Vancouver, BC, Canada, July 9-14, 2017, Proceedings (pp. 3-13). (Lecture Notes in Computer Science (including subseries Information Systems and Applications, incl. Internet/Web, and HCI (LNISA)); Vol. 10292). Springer Verlag. https://doi.org/10.1007/978-3-319-58460-7_1

Briggs, Pam ; Jeske, Debora ; Coventry, Lynne. / The design of messages to improve cybersecurity incident reporting. Human Aspects of Information Security, Privacy and Trust: 5th International Conference, HAS 2017, Held as Part of HCI International 2017, Vancouver, BC, Canada, July 9-14, 2017, Proceedings. editor / Theo Tryfonas. Cham : Springer Verlag, 2017. pp. 3-13 (Lecture Notes in Computer Science (including subseries Information Systems and Applications, incl. Internet/Web, and HCI (LNISA))).

@inproceedings{349974b36ca042448536eec5cf53541d,

title = "The design of messages to improve cybersecurity incident reporting",

abstract = "Cybersecurity suffers from the problem of poor incident reporting. We explored message influences on incident reporting rate. Participants were presented with messages that differed in terms of (i) whether the problem was framed as a technical or a security issue and (ii) the perceived beneficiaries of making a report (benefit to the user, to others vs. no benefit message). Participants were more likely to report a problem if so doing implied some benefit to self, where making the problem more personally relevant might act to reduce social loafing in group settings. They were also more likely to report a technical rather than a security problem and qualitative data suggested that users were sometimes suspicious of messages reporting a security incident – believing that the message itself might be a cybersecurity attack. The findings provide starting points for future research aimed at improving incident reporting.",

author = "Pam Briggs and Debora Jeske and Lynne Coventry",

note = "Funding Information: We gratefully acknowledge the technical and data collection support of James Turland from the School of Computing at Newcastle University. The work presented in this paper was part of a project (2013–2016) that was funded through the Choice Architecture for Information Security (ChAIse) project (EP/K006568/1) from Engineering and Physical Sciences Research Council (EPSRC), UK, and Government Communications Headquarters (GCHQ), UK, as a part of the Research Institute in Science of Cyber Security. Publisher Copyright: {\textcopyright} Springer International Publishing AG 2017.; 5th International Conference on Human Aspects of Information Security, Privacy and Trust, HAS 2017 ; Conference date: 09-07-2017 Through 14-07-2017",

year = "2017",

month = may,

day = "13",

doi = "10.1007/978-3-319-58460-7\_1",

language = "English",

isbn = "9783319584591",

series = "Lecture Notes in Computer Science (including subseries Information Systems and Applications, incl. Internet/Web, and HCI (LNISA))",

publisher = "Springer Verlag",

pages = "3--13",

editor = "Theo Tryfonas",

booktitle = "Human Aspects of Information Security, Privacy and Trust",

address = "Germany",

url = "http://2017.hci.international/pagesmith/129",

}

Briggs, P, Jeske, D & Coventry, L 2017, The design of messages to improve cybersecurity incident reporting. in T Tryfonas (ed.), Human Aspects of Information Security, Privacy and Trust: 5th International Conference, HAS 2017, Held as Part of HCI International 2017, Vancouver, BC, Canada, July 9-14, 2017, Proceedings. Lecture Notes in Computer Science (including subseries Information Systems and Applications, incl. Internet/Web, and HCI (LNISA)), vol. 10292, Springer Verlag, Cham, pp. 3-13, 5th International Conference on Human Aspects of Information Security, Privacy and Trust, Vancouver, Canada, 9/07/17. https://doi.org/10.1007/978-3-319-58460-7_1

The design of messages to improve cybersecurity incident reporting. / Briggs, Pam; Jeske, Debora; Coventry, Lynne.
Human Aspects of Information Security, Privacy and Trust: 5th International Conference, HAS 2017, Held as Part of HCI International 2017, Vancouver, BC, Canada, July 9-14, 2017, Proceedings. ed. / Theo Tryfonas. Cham: Springer Verlag, 2017. p. 3-13 (Lecture Notes in Computer Science (including subseries Information Systems and Applications, incl. Internet/Web, and HCI (LNISA)); Vol. 10292).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - The design of messages to improve cybersecurity incident reporting

AU - Briggs, Pam

AU - Jeske, Debora

AU - Coventry, Lynne

N1 - Conference code: 5

PY - 2017/5/13

Y1 - 2017/5/13

N2 - Cybersecurity suffers from the problem of poor incident reporting. We explored message influences on incident reporting rate. Participants were presented with messages that differed in terms of (i) whether the problem was framed as a technical or a security issue and (ii) the perceived beneficiaries of making a report (benefit to the user, to others vs. no benefit message). Participants were more likely to report a problem if so doing implied some benefit to self, where making the problem more personally relevant might act to reduce social loafing in group settings. They were also more likely to report a technical rather than a security problem and qualitative data suggested that users were sometimes suspicious of messages reporting a security incident – believing that the message itself might be a cybersecurity attack. The findings provide starting points for future research aimed at improving incident reporting.

AB - Cybersecurity suffers from the problem of poor incident reporting. We explored message influences on incident reporting rate. Participants were presented with messages that differed in terms of (i) whether the problem was framed as a technical or a security issue and (ii) the perceived beneficiaries of making a report (benefit to the user, to others vs. no benefit message). Participants were more likely to report a problem if so doing implied some benefit to self, where making the problem more personally relevant might act to reduce social loafing in group settings. They were also more likely to report a technical rather than a security problem and qualitative data suggested that users were sometimes suspicious of messages reporting a security incident – believing that the message itself might be a cybersecurity attack. The findings provide starting points for future research aimed at improving incident reporting.

U2 - 10.1007/978-3-319-58460-7_1

DO - 10.1007/978-3-319-58460-7_1

M3 - Conference contribution

AN - SCOPUS:85025157584

SN - 9783319584591

T3 - Lecture Notes in Computer Science (including subseries Information Systems and Applications, incl. Internet/Web, and HCI (LNISA))

SP - 3

EP - 13

BT - Human Aspects of Information Security, Privacy and Trust

A2 - Tryfonas, Theo

PB - Springer Verlag

CY - Cham

T2 - 5th International Conference on Human Aspects of Information Security, Privacy and Trust

Y2 - 9 July 2017 through 14 July 2017

ER -

Briggs P, Jeske D, Coventry L. The design of messages to improve cybersecurity incident reporting. In Tryfonas T, editor, Human Aspects of Information Security, Privacy and Trust: 5th International Conference, HAS 2017, Held as Part of HCI International 2017, Vancouver, BC, Canada, July 9-14, 2017, Proceedings. Cham: Springer Verlag. 2017. p. 3-13. (Lecture Notes in Computer Science (including subseries Information Systems and Applications, incl. Internet/Web, and HCI (LNISA))). Epub 2017 May 13. doi: 10.1007/978-3-319-58460-7_1

The design of messages to improve cybersecurity incident reporting

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Cite this