Digital security technology is able to identify and prevent many threats to users accounts. However, some threats remain that, to provide reliable security, require human intervention: e.g., through users paying attention to warning messages or completing secondary authentication procedures. While prior work has broadly explored people's mental models of digital security threats, we know little about users' precise, in-the-moment response process to in-the-wild threats. In this work, we conduct a series of qualitative interviews (n=67) with users who had recently experienced suspicious login incidents on their real Facebook accounts in order to explore this process of account security incident response. We find a common process across participants from five countries -- with differing online and offline cultures -- allowing us to identify areas for future technical development to best support user security. We provide additional insights on the unique nature of incident-response information seeking, known attacker threat models, and lessons learned from a large, cross-cultural qualitative study of digital security.
In this paper, we present results from an online survey with 1,510 participants and an interview study with 31 participants on (secure) mobile instant messaging. Our goal was to uncover how much of a role security and privacy played in people’s decisions to use a mobile instant messenger. In the interview study, we recruited a balanced sample of ITsecurity experts and non-experts, as well as an equal split of users of mobile instant messengers that are advertised as being more secure and or private (e.g., Threema) than traditional mobile IMs. Our results suggest that peer influence is what primarily drives people to use a particular mobile IM, even for secure private IMs, and that security and privacy play minor roles. In recent years, numerous surveys have been conducted to assess attitudes about privacy in the United States, Australia, Canada, and the European Union. Very little information has been published about privacy attitudes in India. As India is becoming a leader in business process outsourcing, increasing amounts of personal information from other countries is flowing into India. Questions have been raised about the ability of Indian companies to adequately protect this information. We conducted an exploratory study to gain an initial understanding of attitudes about privacy among the Indian high tech workforce. We carried out a written survey and one-on-one interviews to assess the level of awareness about privacy-related issues and concern about privacy among a sample of educated people in India. Our results demonstrate an overall lack of awareness of privacy issues and less concern about privacy in India than has been found in similar studies conducted in the United States. This research attempted to examine differences in Internet usage, Internet innovativeness, perceived risks of Internet buying, and Internet buying behaviors between Korea and America, and to identify a model for factors influencing Internet buying behavior, explained by Internet usage, perceived risks, and innovativeness on a cross‐cultural basis. Results showed that there were significant differences in Internet usage and the perceived risks of Internet shopping, but no significant differences in Internet buying intentions or online buying experience between Korean and American consumers. Nonetheless, analyzing a regression model of factors influencing Internet buying behavior, and cultural differences in effects of Internet usage and perceived risks on Internet buying behavior were found. While there were main effects of Internet usage and perceived risk on Internet buying behavior, these effects were weaker or even opposite to those related to Korean samples. The implications of the study are discussed and further research was suggested. Purpose – The aim of this research is to make users aware of the importance surrounding the issue of security and security awareness while at the same time making educators as well as other individuals aware of the differing effects of cultural dimensions into the learning process.Design methodology approach – An inter‐cultural study was conducted to investigate if users from the USA and Taiwan exposed to the same situational awareness learning would have different performance in those security awareness outcomes.Findings – The findings confirm that American users who received the situational learning outperformed those users who received the traditional face‐to‐face instruction. Taiwanese users did not perform significantly differently between these two treatments.Research limitations implications – The study was only focused on two countries and therefore may limit its implications worldwide. But the study does show that global citizens also react differently to security awareness as would be expected d...  AbstractThe objective of this research is to develop a security framework for online banking based on security information posted on websites of eight major banks in Australia and Malaysia and to investigate whether and why banks in culturally different countries manage security differently. Twenty-five security measures were identified and classified into three categories-physical, administrative, and technical. Security measures adopted by the major banks in Australia and Malaysia were then compared and analyzed along the cultural perspective. Results show that Australian banks provide general security information more often than Malaysian banks. Moreover, Australian banks pay attention to all categories of security measures whereas Malaysian banks lack physical security measures. Such differences are attributed to cultural factors such as individualism, power distance, and uncertainty avoidance. Results help customers in Australia and Malaysia assess the security of their online banks and are useful as... Information Security (InfoSec) research is far reaching and includes many approaches to deal with protecting and mitigating threats to the information assets and technical resources available within computer based systems. Although a predominant weakness in properly securing information assets is the individual user within an organization, much of the focus of extant security research is on technical issues. The purpose of this paper is to highlight future directions for Behavioral InfoSec research, which is a newer, growing area of research. The ensuing paper presents information about challenges currently faced and future directions that Behavioral InfoSec researchers should explore. These areas include separating insider deviant behavior from insider misbehavior, approaches to understanding hackers, improving information security compliance, cross-cultural Behavioral InfoSec research, and data collection and measurement issues in Behavioral InfoSec research. Consumer Internet banking has been fairly successful in South Africa, with all major retail banks providing this service to customers. Approximately one million Internet users make use of this channel, with the profile tending to be those with higher incomes and occupying managerial and professional jobs. Recent media attention given to security breaches with Internet banking provides an opportunity to assess what impact this has had on perceptions of security across different cultural groups. In a study examining cultural values of managers from different ethnic groups in South Africa, it was found that groups differed mainly on the dimension of uncertainty avoidance. In this study therefore it was posited that those groups with higher scores for uncertainty avoidance would react more strongly to perceived security threats given the uncertainty that this created, and would therefore be less satisfied with security than those lower in uncertainty avoidance. In order to investigate this proposition, data gathered from a survey of postgraduate and MBA students at two leading business schools in South Africa was analysed. Respondents were surveyed as to their banking habits, cultural values and satisfaction with Internet banking. The findings confirm the above proposition as those groups with higher uncertainty avoidance were less satisfied with security than those groups with lower uncertainty avoidance. The implications of these findings are discussed.  We present the results of an online survey of smartphone unlocking (N=8,286) that we conducted in eight different countries. The goal was to investigate differences in attitudes towards smartphone unlocking between different national cultures. Our results show that there are indeed significant differences across a range of categories. For instance, participants in Japan considered the data on their smartphones to be much more sensitive than those in other countries, and respondents in Germany were 4.5 times more likely than others to say that protecting data on their smartphones was important. The results of this study shed light on how motivations to use various security mechanisms are likely to differ from country to country.  Computer security tools usually provide universal solutions without taking user characteristics (origin, income level, ...) into account. In this paper, we test the validity of using such universal security defenses, with a particular focus on culture. We apply the previously proposed Security Behavior Intentions Scale (SeBIS) to 3,500 participants from seven countries. We first translate the scale into seven languages while preserving its reliability and structure validity. We then build a regression model to study which factors affect participants' security behavior. We find that participants from different countries exhibit different behavior. For instance, participants from Asian countries, and especially Japan, tend to exhibit less secure behavior. Surprisingly to us, we also find that actual knowledge influences user behavior much less than user self-confidence in their computer security knowledge. Stated differently, what people think they know affects their security behavior more than what they do know.