When believing in technology leads to poor cyber security: Development of a trust in technical controls scale

Abstract

While technical controls can reduce vulnerabilities to cyber threats, no technology provides absolute protection and we hypothesised that people may act less securely if they place unwarranted trust in these automated systems. This paper describes the development of a Trust in Technical Controls Scale (TTCS) that measures people's faith in four of these technical controls. In an online study (N = 607), Australian employees demonstrated a greater degree of trust in firewalls and anti-virus software than they did in spam filters and social media privacy settings. Lower scores on the four item TTCS were related to better information security awareness (ISA) and higher scores on tests of cognitive abilities such as non-verbal IQ and cognitive reflection. The TTCS predicted an individual's ability to detect a phishing email to a similar degree as other factors such as ISA, non-verbal IQ and cognitive impulsivity. However, unlike ISA, the scale did not predict the strength of passwords people constructed. Results suggest that the TTCS is a useful complement to ISA in understanding and predicting certain cyber security behaviours.

Introduction

One of the most common factors contributing to incidents that undermine the security of an organisation's information system is the behaviour of employees (Alavi, and Mouratidis, 2016; Gyunka, and Christiana, 2017; Proctor.and Chen, 2015). It follows that relying on technological security solutions alone will never adequately protect our systems (Furnell et al, 2006, 2019; Vroom and von Solms, 2004). It is important that we understand the human factors that are associated with good security behaviours so that not only can we can better predict vulnerabilities but we can design training and education programs to address these underlying factors. A number of variables have been previously proposed as factors that may predict good cyber security behaviour in the work place such as; office environment (Pattinson et al., 2018), cyber security culture (Da Veiga and Eloff, 2010; Wiley, McCormac and Calic, 2020), resilience and work stress (McCormac et al., 2018), cognitive and cultural biases (Butavicius et al., 2017; Tsohou, Karyda and Kokolakis, 2015), learning styles (Pattinson et al., 2019), personality and risk taking propensity (McCormac et al., 2017b) and information security awareness (Parsons et al., 2017; Siponen, 2000).

In this paper, we explore a novel factor influencing cyber security behaviours, namely, people's trust in technological security solutions. These technical controls, such as firewalls and spam filters, do not provide absolute protection against all cyber threats (Furnell et al., 2019; Proofpoint, 2019; Yadron, 2014). However, if an individual incorrectly believes that this technology does provide such absolute protection, they may, as a consequence, engage in risky behaviours. Even if people know what policy states that they should do, they may still engage in non-malicious, unsafe behaviour because they believe, incorrectly, that the actions will have no consequences because of the technical security measures in place. For example, an employee may choose to click on a link in a potentially suspicious but interesting email because they believe that their actions will be safeguarded by their organisation's cyber security controls. Understanding how technical controls work, and how they can fail, is a type of knowledge. However, it is a more specific type of knowledge that is not incorporated into definitions or measures of general information security awareness in the literature (Bulgurcu, Cavusoglu, and Benbasat, 2010; Kruger and Kearney, 2006; Parsons et al., 2017; Siponen, 2000). While the information security policies tell people what to do, an understanding of the fallibility of technical safeguards relates to why people should behave in a certain way and, as such, this type of knowledge is not included in extant information security awareness measures.

Our approach to examining this concept was as follows. In the next section, we provide a review of relevant literature on trust and cyber security behaviours and formulate a set of research questions. We then present a new measure of people's faith in technological security measures, known as the Trust in Technical Controls Scale (TTCS), and then use this measure to test our research questions empirically. Specifically, we tested this measure in on online study to examine the level of trust in different safeguards (i.e., spam filters, firewalls, social media privacy settings and antivirus software), looked at how it relates to established tests of information security awareness and cognitive processing and then tested how well it can predict cyber security behaviours such as phishing email detection and password creation. Finally, we discuss the findings of this study, discuss their practical implications, indicate directions for future research and summarise the conclusions.