Slides from the 'people are the strongest link' session at CyberUK 2017 given by Prof. Joinson. Discusses six principles of behaviour change to apply to cybersecurty

1. Stream Two
People: The Strongest Link
#CYBERUK17
Behaviour Change,
Cyber-Security and
lessons from other
domains
Professor Adam Joinson,
University of Bath

2. Lesson 1: Identify a behaviour
to change

3. • Fifteen campaigns
analysed
• Majority awareness
raising
• nature of cyber
security
• raising fear of
consequences
• One presented
evidence of
effectiveness
• Only one seemed to
be based on behaviour
change principles

4. Password management
Up-to-date anti-virus / OS
Log out / shut down
Trusted / secure connections and
sites
Stay informed
Minimize personal identity
Be aware of physical surrounding
Reporting
https://www.gov.uk/government/uploads/system/
uploads/attachment_data/file/309652/14-835-
cyber-security-behavioural-insights.pdf

5. The ‘who and what?’ of security behaviour
“…the styles, approaches and values that the organisation
wishes to adopt towards security. It can range from whether
employees adhere to a clear desk policy to whether they
share sensitive information on social networking sites.”
http://www.cpni.gov.uk/Documents/Publications/2016/03.08.
2016%20SeCuRE%20Tool.pdf

6. 8
COM-B system for analysing
behaviour in context (Michie et
al., 2011)
Michie et al., 2011

7. Lesson 2: Know what success
(and failure) looks like

8. Intervention mapping

9. Define
‘Cyber’
Take
Training
Measure
Compliance

10. Lesson 3: Look to understand
the causes of the behaviour

11. 23
The Behaviour Change Wheel: hub
Michie et al., 2011

12. 24Michie et al., 2011

13. Michie et al., 2011

14. 7
Common terms for methods for
inducing behaviour change
Educate
Train
Help
Expose to
Inform
Discuss
Suggest
Encourage
Incentivise
Ask
Order
Plead
Coerce
Force
Provide
Prompt
Constrain
Michie et al., 2011

15. 9
Common terms for methods for
inducing behaviour change
Capability
Educate
Train
Help
Motivation
Expose to
Inform
Discuss
Suggest
Encourage
Incentivise
Ask
Order
Plead
Coerce
Force
Opportunity
Provide
Prompt
Constrain
Michie et al., 2011

16. self-monitoring in
cycling
Piwek, L., Joinson, A., & Morvan, J. (2015). The use of self-monitoring solutions
amongst cyclists: An online survey and empirical study. Transportation Research Part A:
Policy and Practice, 77, 126-136.
is self-monitoring mainly relevant for
performance-oriented cyclists?

17. 13
NON-TRACKERS
12
TRACKERS
5 weeks
+
INITIAL
SURVEY
DEBRIEFING
INTERVIEW
pedometer
only
pedometer
+ calendar
+ cycling
computer

18. experience
sampling
calendar

19. total number of days cycled to campus in 5 weeks
total distance
cycled across
5 weeks (km)
non-trackers
trackers, high engagement with self-monitoring
trackers, low engagement with self-monitoring

20. self-monitoring
is mainly relevant
for performance-oriented
cyclists
>

21. Spear Phishing Simulations
Working with organisations in the CNI (gov, defence industry, finance)
Studying their results from internal spear phishing exercises
> 120,000 spear phish emails sent to staff
Coded by researchers on influence technique
Some individual data also collected
In one case, clicking led to survey

22. Common phishing techniques
• Exploit social norms and decision-making processes
Social
Influence
Processes
Sense of
Urgency
Invoking
Emotions
Decision
Biases
• Use of
deadlines
• Time pressure
• Can be negative
or positive
• Excitement,
desire, hope or
curiosity
• Fear, panic or
anxiety
• Anger
• Authority
• Liking &
similarity
• Reciprocity
• Conformity
• Truth bias
• Confirmation
bias
• Expectations
• Mimic trusted
entities
• Exploit
authenticity
cues
Legitimacy
Cues

23. Click rates vary hugely
Average ~ 15% in largest data set (63,000)
Authority, Urgency, Curiosity worked best
Few demographic differences, subsets of
vulnerable users.

24. Follow up focus groups

25. Example: The role of familiarity and
expectations
• “it’s a company she deals with, we’ve currently got problems
with accounts payable … and actually why would she not
believe that it was true.”
• “when I first came here, I was, because I wasn’t familiar with
what the companies were that were going to email me
necessarily I was just sort of clicking on anything … but it was
just because I wasn’t familiar with the companies that we were
dealing with”.
• “I mean there are some places, you do get, you get some emails
from America and they write in a different way and it does
make it difficult sometimes to sort of spot the difference”.
Williams, Hinds & Joinson (under
review) ‘Employee susceptibility to
phishing’

26. E-A-S-T framework
Joinson, A., & Piwek, L.
(2016). Technology and
the formation of socially
positive behaviours.
Beyond Behaviour
Change: Key Issues,
Interdisciplinary
Approaches and Future
Directions, 157.

27. Lesson 4: Accept complexity
and difficulty

29. Societal
Influences Individual
Psychology
Individual
Activity Activity
Environment
Food
production
industry
Consumption
and practices
Biological Factors

36. Type of trigger

37. Lesson 5: Work with the flow,
not against it

38. Kairos – the moment
• The opportune moment to aim an intervention towards users.
• B. J. Fogg: Persuasive Technology, p. 41

39. Make it easier to do the right thing

41. Lesson 6: Evaluate, repeat

42. Thanks
a.joinson@bath.ac.uk
or @joinson
www.joinson.com