Digital security technology is able to identify and prevent many threats to users accounts. However, some threats remain that, to provide reliable security, require human intervention: e.g., through users paying attention to warning messages or completing secondary authentication procedures. While prior work has broadly explored people's mental models of digital security threats, we know little about users' precise, in-the-moment response process to in-the-wild threats. In this work, we conduct a series of qualitative interviews (n=67) with users who had recently experienced suspicious login incidents on their real Facebook accounts in order to explore this process of account security incident response. We find a common process across participants from five countries -- with differing online and offline cultures -- allowing us to identify areas for future technical development to best support user security. We provide additional insights on the unique nature of incident-response information seeking, known attacker threat models, and lessons learned from a large, cross-cultural qualitative study of digital security.
Prior cross-cultural work in security has focused on comparisons between two countries (often the US vs. another country). Topics covered include enterprise security @cite_7 , Internet buying behavior @cite_22 , online banking security @cite_28 @cite_29 , privacy beliefs @cite_21 , and, in one case, general mental models @cite_4 . A smaller set of papers has examined aspects of security across larger number of countries @cite_65 @cite_8 @cite_38 @cite_72 @cite_75 . For example, surveyed users from seven different countries (not including South America or Southeast Asia) regarding their intention to behave securely, finding variance in intended action and security knowledge between cultures @cite_75 . These works have all supported the need for a more nuanced examination of digital security from the lens of different user populations; a call echoed specifically for cross-cultural examinations in 's position paper on future directions for behavioral cybersecurity research @cite_78 .
@cite_38 @cite_4 @cite_22 @cite_7 @cite_8 @cite_28 @cite_78 @cite_29 @cite_21 @cite_65 @cite_72 @cite_75
1567646741 2022550710 2610939075 1990562690
Consumer Internet banking has been fairly successful in South Africa, with all major retail banks providing this service to customers. Approximately one million Internet users make use of this channel, with the profile tending to be those with higher incomes and occupying managerial and professional jobs. Recent media attention given to security breaches with Internet banking provides an opportunity to assess what impact this has had on perceptions of security across different cultural groups. In a study examining cultural values of managers from different ethnic groups in South Africa, it was found that groups differed mainly on the dimension of uncertainty avoidance. In this study therefore it was posited that those groups with higher scores for uncertainty avoidance would react more strongly to perceived security threats given the uncertainty that this created, and would therefore be less satisfied with security than those lower in uncertainty avoidance. In order to investigate this proposition, data gathered from a survey of postgraduate and MBA students at two leading business schools in South Africa was analysed. Respondents were surveyed as to their banking habits, cultural values and satisfaction with Internet banking. The findings confirm the above proposition as those groups with higher uncertainty avoidance were less satisfied with security than those groups with lower uncertainty avoidance. The implications of these findings are discussed. AbstractThe objective of this research is to develop a security framework for online banking based on security information posted on websites of eight major banks in Australia and Malaysia and to investigate whether and why banks in culturally different countries manage security differently. Twenty-five security measures were identified and classified into three categories-physical, administrative, and technical. Security measures adopted by the major banks in Australia and Malaysia were then compared and analyzed along the cultural perspective. Results show that Australian banks provide general security information more often than Malaysian banks. Moreover, Australian banks pay attention to all categories of security measures whereas Malaysian banks lack physical security measures. Such differences are attributed to cultural factors such as individualism, power distance, and uncertainty avoidance. Results help customers in Australia and Malaysia assess the security of their online banks and are useful as... Computer security tools usually provide universal solutions without taking user characteristics (origin, income level, ...) into account. In this paper, we test the validity of using such universal security defenses, with a particular focus on culture. We apply the previously proposed Security Behavior Intentions Scale (SeBIS) to 3,500 participants from seven countries. We first translate the scale into seven languages while preserving its reliability and structure validity. We then build a regression model to study which factors affect participants' security behavior. We find that participants from different countries exhibit different behavior. For instance, participants from Asian countries, and especially Japan, tend to exhibit less secure behavior. Surprisingly to us, we also find that actual knowledge influences user behavior much less than user self-confidence in their computer security knowledge. Stated differently, what people think they know affects their security behavior more than what they do know. Purpose – The aim of this research is to make users aware of the importance surrounding the issue of security and security awareness while at the same time making educators as well as other individuals aware of the differing effects of cultural dimensions into the learning process.Design methodology approach – An inter‐cultural study was conducted to investigate if users from the USA and Taiwan exposed to the same situational awareness learning would have different performance in those security awareness outcomes.Findings – The findings confirm that American users who received the situational learning outperformed those users who received the traditional face‐to‐face instruction. Taiwanese users did not perform significantly differently between these two treatments.Research limitations implications – The study was only focused on two countries and therefore may limit its implications worldwide. But the study does show that global citizens also react differently to security awareness as would be expected d...