Studying the Impact of Security Awareness Efforts on User Behavior

Security has long been a technical problem with technical solutions. Over time, it has become apparent that human behavior is a major weakness in technical solutions. Extensive efforts have been taken to inform individuals about the threats and safeguards with which to protect against such threats. Organizations have developed awareness campaigns to enhance the security behaviors of employees. These awareness campaigns seek to provide employees with information about a threat as well as measures to take to prevent against the threats. This dissertation investigates the effectiveness of various security awareness message themes as well as the individual perceptions and characteristics that affect security behavior. First, a survey study is conducted which measures perceptions surrounding security threats and safeguards. The analysis of the survey data builds a foundational understanding of how individuals assess and respond to technical security threats. Next, five awareness themes are evaluated through the use of targeted interventions with non-complying individuals presented awareness messages. The individual responses to interventions and surveys allow for the usage of personality data to inform both initial security safeguard behavior as well as response behavior to targeted awareness messages. Overall, the tested awareness methods were found to be somewhat effective. However, with the addition of individual information, analysis identified correlations with individual response. These correlations point to the importance of considering individual motivations and perceptions surrounding security threats and safeguards.