Keywords

NeuroIS, eye tracking, security warnings, habituation, behavioral information security

Abstract

Securitywarnings are critical to the security of end users and their organizations, often representing the final defense against an attack. Because warnings require users to make a contextual judgment, it is critical that they pay close attention to warnings. However, research shows that users routinely disregard them. A major factor contributing to the ineffectiveness of warnings is habituation, the decreased response to a repeated warning. Although previous research has identified the problem of habituation, the phenomenon has only been observed indirectly through behavioral measures. Therefore, it is unclear how habituation develops in the brain in response to security warnings, and how this in turn influences users' perceptions of these warnings. This paper contributes by using eye tracking to measure the eyemovement-basedmemory (EMM) effect, a neurophysiological manifestation of habituation in which people unconsciously scrutinize previously seen stimuli less than novel stimuli.We show that habituation sets in after only a few exposures to a warning and progresses rapidly with further repetitions. Using guidelines from the warning science literature, we design a polymorphic warning artifact which repeatedly changes its appearance.We demonstrate that our polymorphic warning artifact is substantiallymore resistant to habituation than conventional securitywarnings, offering an effective solution for practice. Finally, our results highlight the value of applying neuroscience to the domain of information security behavior.

Original Publication Citation

Anderson, B., Jenkins, J., Vance, A., Kirwan, B., Eargle, D. 2016 “Your Memory is Working Against You: How Eye Tracking and Memory Explain Habituation to Security Warnings," Decision Support Systems, 92, pp. 3-13. Available online at http://dx.doi.org/10.1016/j.dss.2016.09.010

Document Type

Peer-Reviewed Article

Publication Date

2016

Publisher

Decision Support Systems

Language

English

College

Marriott School of Business

Department

Information Systems Management

University Standing at Time of Publication

Full Professor

Download

Share

COinS