Measuring and Understanding Security Behaviours

Measuring and Understanding Security Behaviours Ingolf Becker A thesis submitted for the degree of Doctor of Philosophy at UCL 2019 I, Ingolf Becker confirm that the work presented in this thesis is my own. Where information has been derived from other sources, I confirm that this has been in- dicated in the thesis. i Abstract Information security embodies the complex interaction between security policies, user perceptions of these policies, productive activity and the security culture in general. The vast majority of organisations consist not solely of data and technology, but have human actors involved in the productive activity, and are thus socio-technical systems. The aim of this thesis is to understand how individuals perceive, understand and react to information security policies, and how they fit into productive tasks, while investigating the viability of measuring each of these aspects. An analytical evaluation and empirical user study in three countries of banking policies evidences difficulties in understanding policies. A second study quantifies actual user characteristics and shows that the assumptions on user behaviour in the policies are unrealistic. Advice attempting to explain security aspects to the general public fail to improve user understanding, and security awareness is promoted without measuring the impact of the interventions. Better understanding and measurements of security culture are needed. This demand is pursued in the remainder of the thesis: in two companies, the results of context-aware surveys that elicit responses to typical scenarios of non-compliant behaviours are evaluated. The responses are used to define the security culture of the company, and to re-frame the notion of Security Champions based on the observed security cultures. Finally, the impact of a change in password policy in a university with over 100,000 users for 17 months is studied. Virtually all users respond positively to the policy change, adopting a more secure password over time in response to a longer password lifetime. This work gives evidence for the benefit of involving users in security decisions. The metrics developed in this thesis allow security to be grounded in the actual circumstances of the organisation and its human actors and security to be evaluated objectively. By involving and empowering individuals, security can become workable and sustainable. iii Impact Statement My academic publications are actively being disseminated, with a total of 34 citations to date. Due to the Productive Security project, we have re- ceived two small grants for further work, both part of this thesis: the security construct work (Chapter 3) and the password project (Chapter 7). Wherever possible, the research in this thesis has been conducted in a reproducible man- ner. I have released datasets and analysis code under a permissive license, allowing future researchers and practitioners to easily understand and build upon my results. Based on our research on banking terms and conditions we submitted evidence to the European Banking authority's consultation on strong customer authentication in the Payment Service Directive 2. Organisations can use the methodologies presented in this thesis to measure their security culture. This enables them to tailor interventions to their organisation, and measure the impact of interventions. At Companies A & B we presented the findings to their respective boards, and we are continuing to work with UCL to integrate our feedback into their password policy. To dis- seminate my research to the wider public, a number of blog posts have been released our Information Security Group's Blog1 and the blog of the Research Institute in Science of Cyber Security2, each with over 2500 unique readers per month. 1Bentham's Gaze 2RISCS v Acknowledgements I would like to thank my supervisors, Angela Sasse and Sebastian Riedel, for their support and advice throughout my PhD. Their enthusiasm and drive was an essential motivation for this thesis and will continue to inspire me for years to come. In addition, Simon Parkin, my frequent collaborator, was invaluable as a constant source of feedback, inspiration and complicated hol- istic analyses that put my research into perspective. I was supported by an EPSRC grant through the Doctoral Training Centre in Security and Crime Science. I would like to thank the staff in the Department of Security and Crime Science as well as those in the Department of Computer Science for their kind assistance in all administrative matters. I am also grateful for the anonymous companies A, B and C who generously donated their employees' time to this research. I enjoyed my time as a research student at UCL, and this is primarily thanks to a great research group, and the many current and past students and post-docs of 6.07 and 6.22. This environment has led to many interesting and fruitful discussions and collaborations. I am also grateful for the comments from my examiners, Emiliano De Cristofaro and Kami Vaniea. I would also like to thank my co-authors, especially those of the papers on which this thesis is based: Ruba Abu-Salma, Ross Anderson, Adam Beautement, Nicholas Bohm, AlbesëDemjaha, Alice Hutchings, Kat Krol, Steven Murdoch, Simon Parkin, Angela Sasse, Jono Spring and Gianluca Stringhini. I appreciate the support my friends, new and old, and family have given me throughout this journey, and especially my parents who have provided nothing but useful advice and guidance. Last but not least, I thank Louise for her love and encouragement, and for sharing this journey with me. vii Contents Abstract iii Impact Statementv Acknowledgements vii Contents ix List of Figures xv List of Tables xvii 1 Introduction1 1.1 Security scope............................. 2 1.2 Security manifestation........................ 3 1.3 Security awareness .......................... 3 1.4 Security decision making....................... 4 1.5 Research questions.......................... 4 1.6 Overview of thesis........................... 5 1.6.1 Motivational research..................... 6 1.6.2 Productive Security...................... 9 1.6.3 Password project....................... 12 1.6.4 Other research conducted during my PhD......... 14 1.7 My original contributions of this thesis............... 14 2 Literature review 17 2.1 Measuring security.......................... 17 2.2 Factors influencing compliance.................... 20 2.3 Perceived security fatigue ...................... 25 2.3.1 Sources of fatigue....................... 26 2.3.2 Responses to fatigue ..................... 26 ix Contents 2.3.3 Types of compliance ..................... 26 2.4 Coping strategies and workarounds................. 27 3 Security constructs survey 29 3.1 Introduction.............................. 30 3.2 Methodology ............................. 31 3.2.1 Construct validation..................... 33 3.2.2 Construct grouping...................... 34 3.3 The database ............................. 35 3.3.1 Publication pages....................... 35 3.3.2 Construct pages........................ 38 3.3.3 Category pages........................ 40 3.4 Analysis................................ 41 3.5 A case study of construct origins .................. 43 3.6 Limitations .............................. 46 3.7 Conclusion............................... 47 3.7.1 Recommendations for researchers and practitioners . 48 4 Bank Terms and Conditions: perceptions and reality 49 4.1 Introduction.............................. 49 4.1.1 My contribution in this chapter............... 51 4.2 Related literature........................... 52 4.2.1 Legal and regulatory context................. 54 4.3 Review of banking Terms and Conditions internationally . 55 4.3.1 Methodology ......................... 55 4.3.2 Results............................. 58 4.3.3 Discussion........................... 68 4.3.4 Limitations .......................... 69 4.4 Survey of payment card PIN usage ................. 69 4.4.1 Questionnaire setup...................... 70 4.4.2 Results............................. 70 4.4.3 Discussion........................... 73 4.5 Survey of understanding and interpretation of banking T&Cs . 74 4.5.1 Related literature....................... 75 4.5.2 Survey design......................... 76 4.5.3 The scenarios......................... 77 4.5.4 The Terms and Conditions.................. 79 4.5.5 Demographics......................... 79 x Contents 4.5.6 Payment demographics.................... 81 4.5.7 Scenario overview....................... 83 4.5.8 Scenario 1: card loss..................... 84 4.5.9 Scenario 2: phone scam.................... 87 4.5.10 Understanding of Terms and Conditions.......... 90 4.6 Discussion............................... 93 4.6.1 Data availability ....................... 95 5 Studies on perceptions of security 97 5.1 Security metaphors.......................... 97 5.1.1 Metaphors considered..................... 99 5.1.2 Survey testing of metaphors . 100 5.1.3 Reliability and validity.................... 101 5.1.4 Findings............................ 102 5.1.5 Discussion........................... 104 5.2 SANS analysis............................. 106 5.3 Conclusion............................... 108 6 Productive Security 109 6.1 Introduction.............................. 110 6.2 Related literature........................... 111 6.3 Methodology ............................. 114 6.4 Surveys ................................ 116 6.4.1 Online scenario-based survey . 116 6.4.2 Scenario commonality ...................

Load more