CAREER: The Role of Emotion and Social Motives in Communicating Risk: Implications for User Behavior in the Cyber Security Context

University Of Connecticut, Storrs CT

Investigators

Abstract

Prior research notes that many cyberattacks are preventable if end users take precautionary measures, such as keeping systems updated, but they often fail to do so. This proposal builds upon theories of risk communication, emotional intelligence, and self-determination to design new approaches to cybersecurity risk communication and training. The goals are to enable users to assess risks, costs, and benefits consistently and correctly, to promote task-focused coping responses, and to facilitate their internalization of values, promoting spontaneous diffusion of cybersecurity knowledge. By enabling non-expert users to make informed security decisions through raising cybersecurity risk awareness and self-efficacy development, this project directly addresses an increasingly serious threat to economic growth and national security. This project also creates cybersecurity research and training opportunities for graduate and undergraduate students, and members from the underrepresented groups through outreach initiatives. This project systematically tests two hypotheses: (i) that addressing gaps in mental models along with development of self-efficacy can promote task-focused coping responses and early conformance behavior, and (ii) that communicating social motives can lead to the development of intrinsic motivation and spontaneous diffusion of information. Towards that end, the researchers design and conduct a series of interview-style user studies including both expert and non-expert users, and they develop effective risk communication modules that address gaps in mental models and enable non-expert users to evaluate risks, costs and benefits of security decisions. This project will also test the efficacy of different interventions to promote task-focused coping responses and promote spontaneous diffusion of information. By systematically testing the aforementioned hypotheses, this project provides in-depth understanding regarding the influence of emotions and social motives in cybersecurity behavior and makes a valuable contribution to the theoretical foundation of risk communication. By investigating mental models of high school students as well as adults, this project advances the theory of risk communication for adolescents in the cybersecurity context and enables cybersecurity professionals to design risk communication modules specifically targeting this vulnerable demographic. Research results are synthesized in modular tutorials and made publicly available. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.