publications

2024

1. Digital Security — A Question of Perspective A Large-Scale Telephone Survey with Four At-Risk User Groups

   Franziska Herbert, Steffen Becker, Annalina Buckmann, Marvin Kowalewski, Jonas Hielscher, Yasemin Acar, Markus Dürmuth, Yixin Zou, and M. Angela Sasse

   In 2024 IEEE Symposium on Security and Privacy (SP), 2024

   DOI
2. "What Keeps People Secure is That They Met The Security Team": Deconstructing Drivers And Goals of Organizational Security Awareness

   Jonas Hielscher, and Simon Parkin

   In 33rd USENIX Security Symposium (USENIX Security 24), Aug 2024

2023

1. "Employees$ Who Don’t Accept the Time Security Takes Are Not Aware Enough": The CISO View of Human-Centred Security

   Jonas Hielscher, Uta Menges, Simon Parkin, Annette Kluge, and M Angela Sasse

   In 32nd USENIX Security Symposium (USENIX Security 23), Aug 2023
2. A World Full of Privacy and Security (Mis)conceptions? Findings of a Representative Survey in 12 Countries

   Franziska Herbert, Steffen Becker, Leonie Schaewitz, Jonas Hielscher, Marvin Kowalewski, Angela Sasse, Yasemin Acar, and Markus Dürmuth

   In Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems, Hamburg, Germany, Aug 2023

   Abs DOI

   Misconceptions about digital security and privacy topics in the general public frequently lead to insecure behavior. However, little is known about the prevalence and extent of such misconceptions in a global context. In this work, we present the results of the first large-scale survey of a global population on misconceptions: We conducted an online survey with n = 12, 351 participants in 12 countries on four continents. By investigating influencing factors of misconceptions around eight common security and privacy topics (including E2EE, Wi-Fi, VPN, and malware), we find the country of residence to be the strongest estimate for holding misconceptions. We also identify differences between non-Western and Western countries, demonstrating the need for region-specific research on user security knowledge, perceptions, and behavior. While we did not observe many outright misconceptions, we did identify a lack of understanding and uncertainty about several fundamental privacy and security topics.

3. "To Do This Properly, You Need More Resources": The Hidden Costs of Introducing Simulated Phishing Campaigns

   Lina Brunken, Annalina Buckmann, Jonas Hielscher, and M. Angela Sasse

   In 32nd USENIX Security Symposium (USENIX Security 23), Aug 2023

2022

1. “Taking out the Trash”: Why Security Behavior Change requires Intentional Forgetting

   Jonas Hielscher, Annette Kluge, Uta Menges, and M. Angela Sasse

   In Proceedings of the 2021 New Security Paradigms Workshop, Virtual Event, USA, Aug 2022

   Abs DOI

   Security awareness is big business – virtually every organization in the Western world provides some form of awareness or training, mostly bought from external vendors. However, studies and industry reports show that these programs have little to no effect in terms of changing the security behavior of employees. We explain the conditions that enable behavior change, and identify one significant blocker in the implementation phase: not disabling existing (insecure) routines – failure to take out the trash – prevents embedding of new (secure) routines. Organizational Psychology offers the paradigm Intentional Forgetting (IF) and associated tools for replacing old (insecure) behaviors with new (secure) ones by identifying and eliminating different cues (sensoric, routine-based, time and space based as well as situational strength cues) that trigger old behavior. We introduce the underlying theory, examples of successful application in safety contexts, and show how its application leads to effective behavior change by reducing the information that needs to be transmitted to employees, and suppressing obsolete routines.