Research Library

We examine the cost for an attacker to pay users to execute arbitrary code—potentially malware. We asked users at home to download and run an executable we wrote without being told what it did and without any way of knowing it was harmless. Each week, we increased the...

Traditional typologies of consumer privacy concern suggest that consumers fall into three distinct groups: One-fourth of consumers are not concerned about privacy, one-fourth are highly concerned, and half are pragmatic, in that their concerns about privacy depend on...

Cyber security and the role employees play in securing information are major concerns for businesses. The aim of this research is to explore employee security behaviours and design interventions that can motivate behaviour change. Previous research has focused on...

This paper measured leadership and need for cognition alongside decision making, concluding both need for cognition and leadership moderate susceptibility to decision-making biases.  

A study of 425 people suggested perceived severity of security threats has no significant influence on security attitudes, and that more technically literate users resist manditory security implementations moreso than less technically literate users.  

This paper's authors argue self-deception is an evolved trait with the evolutionary advantage of helping deceive others without severe cognitive strain. They suggest self-decpetion – which should in theory be paradoxical – is actually achieved through dissociations of...

This report provides an overview international cyber-security awareness raising and educational initiatives.    

We congratulate Ernesa¨ter et al. on their study of incident reporting in nurse-led telephone triage in Sweden. The reporting of errors is crucial to the process of error management. If adverse incidents are to be minimised, organisations must learn from their...

The purpose of this paper is to examine why mainstream information security awareness techniques have failed to evolve at the same rate as automated technical security controls and to suggest improvements based on psychology and safety science.

We propose a training program based on two theories: the universal constructive instructional theory and the elaboration likelihood model. We then validate the training program for IS security policy compliance training through an action research project. The action...