Persuasive Technology for Improving Information Security Awareness and Behavior: Literature Review
---
paper_title: Persuasive Technology Contributions Toward Enhance Information Security Awareness in an Organization

paper_content:

Persuasion is part and parcel of human interaction. The human persuaders in society have been always exit, masters of rhetoric skilled of changing our minds, or at least our behaviors. Leaders, mothers, salesmen, and teachers are clear examples of persuaders. Persuaders often turn to technology and digital media to amplify their persuasive ends. Besides, our lives and how we lead them influenced by technologies and digital media, but for the most part, their effects on our attitudes and behaviors have been incidental, even accidental. Although, nowadays, the use of computers to sell products and services considered as the most frequent application of persuasive technology. In this short paper, based on an extensive review of literatures, we aim to give a brief introduction to persuasive technology, and how it can play a role and contribute to enhance and deliver the best practice of IT. Some challenges of persuasive technology have been discussed. At the end, some recommendations and steps should be taken place to empower IT professional practices have been listed.
---
paper_title: The Behavior Grid: 35 ways behavior can change

paper_content:

This paper presents a new way of categorizing behavior change in a framework called the Behavior Grid. This preliminary work shows 35 types of behavior along two categorical dimensions. To demonstrate the analytical potential for the Behavior Grid, this paper maps behavior goals from Facebook onto the framework, revealing potential patterns of intent. To show the potential for designers of persuasive technology, this paper uses the Behavior Grid to show what types of behavior change might most easily be achieved through mobile technology. The Behavior Grid needs further development, but this early version can still be useful for designers and researchers in thinking more clearly about behavior change and persuasive technology.
---
paper_title: Persuasive and Culture-Aware Feedback Acquisition

paper_content:

User feedback is an important factor to improve software quality. For example, it can provide information on missing features and clarify user trends and preferences for future improvement. However, gathering user's feedback is not an easy process since the majority of users lack motivation and interest in providing feedback, especially in a constant and frequent style. In addition, studies have noted that the cultural differences among users also play a role in affecting their motivations to feedback acquisition. In this paper, we empirically investigate the role of culture in affecting users' perception and motivations to give feedback. Our study identifies some key differences between Western and Middle Eastern users on what motivate them to provide feedback and what could have an influence on the quality of the feedback they give. This also makes the case for the need to design a persuasive and culture-aware feedback acquisition.
---
paper_title: A behavior model for persuasive design

paper_content:

This paper presents a new model for understanding human behavior. In this model (FBM), behavior is a product of three factors: motivation, ability, and triggers, each of which has subcomponents. The FBM asserts that for a person to perform a target behavior, he or she must (1) be sufficiently motivated, (2) have the ability to perform the behavior, and (3) be triggered to perform the behavior. These three factors must occur at the same moment, else the behavior will not happen. The FBM is useful in analysis and design of persuasive technologies. The FBM also helps teams work together efficiently because this model gives people a shared way of thinking about behavior change.
---
paper_title: Personality and persuasive technology: An exploratory study on health-promoting mobile applications. Persuasive Technology

paper_content:

Though a variety of persuasive health applications have been designed with a preventive standpoint toward diseases in mind, many have been designed largely for a general audience. Designers of these technologies may achieve more success if applications consider an individual’s personality type. Our goal for this research was to explore the relationship between personality and persuasive technologies in the context of health-promoting mobile applications. We conducted an online survey with 240 participants using storyboards depicting eight different persuasive strategies, the Big Five Inventory for personality domains, and questions on perceptions of the persuasive technologies. Our results and analysis revealed a number of significant relationships between personality and the persuasive technologies we evaluated. The findings from this study can guide the development of persuasive technologies that can cater to individual personalities to improve the likelihood of their success.
---
paper_title: A Qualitative Study of Culture and Persuasion in a Smoking Cessation Game

paper_content:

To explore the issue of culture in persuasive technology, we identified strategies distinguishing individualist or collectivist audiences, and developed two versions of a prototype game. In this paper we report on a qualitative study of this game. The game concerned smoking cessation, and was set in a New Zealand context, where one version was designed for individualist New Zealand Europeans, and the other for collectivist New Zealand Mi¾?ori. Our qualitative study involved people from each group playing each of the two games. Using a "think-aloud" protocol, we recorded player comments and reflections that show the effect of our design on their behaviour. The results of the study show the designs were interpreted differently according to the audiences playing them, and reveal detail about culture and persuasion.
---
paper_title: Information Security Awareness: An Application of Psychological Factors - A Study in Malaysia

paper_content:

Current technology advancement promotes borderless environment among individuals, organisations, global industries or public per se. It is akin to having a home but a physical house that is not visible. Looking at the present cybercrime trends, it cannot be disputed that information security is a key matter to observe in the rapid advancement of technology. Information security can be achieved through not only technological and procedural aspects but also the people aspect of information security. An examination of individual's self awareness of information security based on identified key computing areas is carried out through this study. This study aims to provide evidence to organisation(s) in identifying individuals who can be effective defenders to man critical systems and be change agents / ambassadors to cultivate a more security aware community. Index Terms - Information security awareness, self awareness, five factors model (FFM), theory of planned behavior.
---
paper_title: A conceptual foundation for organizational information security awareness

paper_content:

The current approaches in terms of information security awareness and education are descriptive (i.e. they are not accomplishment‐oriented nor do they recognize the factual/normative dualism); and current research has not explored the possibilities offered by motivation/behavioural theories. The first situation, level of descriptiveness, is deemed to be questionable because it may prove eventually that end‐users fail to internalize target goals and do not follow security guidelines, for example – which is inadequate. Moreover, the role of motivation in the area of information security is not considered seriously enough, even though its role has been widely recognised. To tackle such weaknesses, this paper constructs a conceptual foundation for information systems/organizational security awareness. The normative and prescriptive nature of end‐user guidelines will be considered. In order to understand human behaviour, the behavioural science framework, consisting in intrinsic motivation, a theory of planned behaviour and a technology acceptance model, will be depicted and applied. Current approaches (such as the campaign) in the area of information security awareness and education will be analysed from the viewpoint of the theoretical framework, resulting in information on their strengths and weaknesses. Finally, a novel persuasion strategy aimed at increasing users’ commitment to security guidelines is presented.
---
paper_title: Persuasive Information Security. A Behavior Change Support System to Help Employees Protect Organizational Information Security

paper_content:

Digital information is an important asset in the corporate world. Organi- zations typically devise policies and guidelines to help employees protect the secu- rity of such information. Complying with these policies can often be confusing and difficult and may obstruct the task at hand, thus potentially leading employees to circumvent or ignore these policies. Commercial technology and training programs to mitigate this issue suffer from various shortcomings. To overcome these limita- tions, we present a Behavior Change Support prototype that implements six per- suasive features: Security Points, Security Quiz, Challenges, Statistics, Personali- zation, and Risk Communication. Evaluation of the prototype established persua- sive security as a promising approach for influencing user attitudes and behaviors regarding secure work practices. We apply the findings to offer suggestions for how the six persuasive features could be further enhanced.
---
paper_title: User Awareness of Security Countermeasures and Its Impact on Information Systems Misuse: A Deterrence Approach

paper_content:

Intentional insider misuse of information systems resources (i.e., IS misuse) represents a significant threat to organizations. For example, industry statistics suggest that between 50%--75% of security incidents originate from within an organization. Because of the large number of misuse incidents, it has become important to understand how to reduce such behavior. General deterrence theory suggests that certain controls can serve as deterrent mechanisms by increasing the perceived threat of punishment for IS misuse. This paper presents an extended deterrence theory model that combines work from criminology, social psychology, and information systems. The model posits that user awareness of security countermeasures directly influences the perceived certainty and severity of organizational sanctions associated with IS misuse, which leads to reduced IS misuse intention. The model is then tested on 269 computer users from eight different companies. The results suggest that three practices deter IS misuse: user awareness of security policies; security education, training, and awareness (SETA) programs; and computer monitoring. The results also suggest that perceived severity of sanctions is more effective in reducing IS misuse than certainty of sanctions. Further, there is evidence that the impact of sanction perceptions vary based on one's level of morality. Implications for the research and practice of IS security are discussed.
---
paper_title: Persuasive Technology Contributions Toward Enhance Information Security Awareness in an Organization

paper_content:

Persuasion is part and parcel of human interaction. The human persuaders in society have been always exit, masters of rhetoric skilled of changing our minds, or at least our behaviors. Leaders, mothers, salesmen, and teachers are clear examples of persuaders. Persuaders often turn to technology and digital media to amplify their persuasive ends. Besides, our lives and how we lead them influenced by technologies and digital media, but for the most part, their effects on our attitudes and behaviors have been incidental, even accidental. Although, nowadays, the use of computers to sell products and services considered as the most frequent application of persuasive technology. In this short paper, based on an extensive review of literatures, we aim to give a brief introduction to persuasive technology, and how it can play a role and contribute to enhance and deliver the best practice of IT. Some challenges of persuasive technology have been discussed. At the end, some recommendations and steps should be taken place to empower IT professional practices have been listed.
---
paper_title: Persuasive technologies: a systematic literature review and application to PISA

paper_content:

Persuasive Technologies is an expansive eld that covers various research areas including engineering and social sciences. This document summarizes current and historical models of information processing, persuasion and persuasive systems design in order to place other studies in the eld within context. The Persuasive Systems Design Model is then selected as the most recent and comprehensive model in the eld, afer which a series of sample context analyses are performed using this model. The case used for these context analyses is the PISA tool. Finally, we consider the limitations and possible future work of this literature review.
---
paper_title: Persuasion for Stronger Passwords: Motivation and Pilot Study

paper_content:

Text passwords are the ubiquitous method of authentication, used by most people for most online services. Many people choose weak passwords that are vulnerable to attackers who simply guess all the passwords within the most probable password spaces. This paper describes a lightweight password creation mechanism that uses Persuasive Technology to influence users to create stronger passwords. Results from a pilot study show that our Persuasive Text Passwords (PTP) prototype system successfully influenced users to create and remember more secure passwords.
---
paper_title: Persuasion as Education for Computer Security

paper_content:

Most organisations realise the importance of computer security, yet many struggle with how to teach and influence their users to behave securely. Despite existing research on new instructions and security measures, users create memorable but insecure passwords. In an effort to teach users how to behave more securely, we present the Persuasive Authentication Framework, which applies persuasive technology to authentication mechanisms. Furthermore, we describe some examples of how the framework can be applied to existing authentication systems.
---
paper_title: Designing Interventions to Persuade Software Developers to Adopt Security Tools

paper_content:

The nature of security information workers' jobs requires a certain level of care and attention to detail. There exist tools that can assist these workers with their daily tasks; however, workers may not be using these tools. Research suggests persuasive techniques can positively affect a worker's outlook on a given technology. We attempt to develop an effective way to motivate security workers to adopt and use security tools by using persuasive design guidelines. We present an system that generates automated emails to inform software developers of FindBugs, a tool that detects potential vulnerabilities within a project. We discuss the decisions supporting our overall design of the automated emails.
---
paper_title: Toward an experimental methodology for studying persuasion-based online security

paper_content:

In this paper we highlight a controlled experimental design in development to investigate how the intersection of a brand's familiarity and persuasive appeal impact user willingness to engage in increased web security procedures. We offer the results of a 2 (Source: familiar vs. unfamiliar brand) x 2 (Persuasive Strategy: benefit to user vs. benefit to site) web experiment (N=48) using this approach to demonstrate its viability and generate ideas for future directions. Lessons learned and opportunities to improve this experimental methodology to further psychological research in the web security domain are discussed.
---
paper_title: Towards designing effective security messages: Persuasive password guidelines

paper_content:

The current state of information security compliance in workplaces is deteriorating. In many cases human factors were attributed as the cause of the problem. Humans are well known as the weakest link in the security chain. Commonly, end-users will depend on security messages when confronted with security-related decision making. Most of the time, end-users will try their best to make sense of unclear instructions in order to cope with situations. This indicates the way security messages are presented is of utmost importance. However, research focusing on designing effective security messages is quite limited. This paper presents research in progress, towards designing effective security messages focusing on passwords guidelines. Our initial review indicated the lack of persuasive elements in the current password guidelines may lead to unmotivated behaviour of producing good (strong) passwords. This paper also includes initial results obtained from pilot study which reveal promising results supporting the usage of persuasion strategies to improve the current state information security compliance.
---
paper_title: Persuasive Information Security. A Behavior Change Support System to Help Employees Protect Organizational Information Security

paper_content:

Digital information is an important asset in the corporate world. Organi- zations typically devise policies and guidelines to help employees protect the secu- rity of such information. Complying with these policies can often be confusing and difficult and may obstruct the task at hand, thus potentially leading employees to circumvent or ignore these policies. Commercial technology and training programs to mitigate this issue suffer from various shortcomings. To overcome these limita- tions, we present a Behavior Change Support prototype that implements six per- suasive features: Security Points, Security Quiz, Challenges, Statistics, Personali- zation, and Risk Communication. Evaluation of the prototype established persua- sive security as a promising approach for influencing user attitudes and behaviors regarding secure work practices. We apply the findings to offer suggestions for how the six persuasive features could be further enhanced.
---
paper_title: Image Based Authentication for Folder Security using Persuasive Cued Click-Points and SHA

paper_content:

In this paper Image Based Authentication application is applied on folder's (folders that are confidential to user) ,since the studies till date have shown that textual passwords are more prone that they are well hacked by hackers through easily available software's or programming different code to hack the password. The textual passwords use languages that can be identified using the grammar that they use, therefore our project focuses on Graphical passwords , because as such it has been observed that human brains is better at re-collecting and recognizing images than text, the images are well captured and stored rather than text. There have been phases in creating a strong graphical password scheme from 1999, with the promise that the graphical passwords would provide improved password memorability and usability. The technique that we use here is PCCP (PERSUASIVE CUED CLICK POINTS), this is a combination of recall and recognition based techniques with the implementation of SHA1 (Secure Hash Algorithm). Here PCCP is used for user to have better strong passwords by expanding password space and SHA1 is used to ensure security to folder. Keyword: Authentication, Graphical Password, Hotspot, Passpoints, Secure Hash Algorithm,
---
paper_title: Pretty good persuasion: a first step towards effective password security in the real world

paper_content:

In the past, research on password mechanisms has focussed almost entirely on technical issues. Only in recent years has the security research community acknowledged that user behavior plays a part in many security failures, and that policies alone may not be sufficient to ensure correct behavior. We argue that password mechanisms and their users form a socio-technical system, whose effectiveness relies strongly on users' willingness to make the extra effort that security-conscious behavior requires. In most organizations, users cannot be forced to comply; rather, they have to be persuaded to do so. Ultimately, the mechanisms themselves, policies, tutorials, training and the general discourse have to be designed with their persuasive power in mind. We present the results of a first study that can guide such persuasive efforts, and describe methods that can be used to persuade users to employ proper password practice.
---
paper_title: Towards Deeper Understanding of Persuasion in Software and Information Systems

paper_content:

A growing number of information technology systems and services are being developed for persuasive purposes, i.e. to change users' attitudes or behaviour or both. Despite the fact that attitudinal theories from social psychology have been quite extensively applied to the study of user intentions and behaviour, computer scientists and user interface designers are not very familiar with the theories related to attitude change. Moreover, these theories are not directly applicable for developing software and information systems. This paper builds upon the attitude change theories from social psychology recognising dimensions and approaches that help move towards a practical conceptual framework for understanding and designing persuasion in information systems.
---

Title: Persuasive Technology for Improving Information Security Awareness and Behavior: Literature Review

Section 1: INTRODUCTION
Description 1: Discuss the rapid advancement of information technology, its benefits and associated risks, and the need for persuasive technology in improving information security.

Section 2: Meaning Of The Term 'Persuasion'
Description 2: Explain the concept of persuasion and its relevance in influencing user behavior and attitudes, particularly in the context of information security.

Section 3: Persuasive Technology (Captology)
Description 3: Detail how computers and technology can be designed to change behaviors and attitudes towards various issues including information security, and introduce the concept of Captology.

Section 4: Threat to Confidential Information
Description 4: Describe the various internal and external threats to organizational confidential information and the role of persuasive technology in mitigating these risks.

Section 5: Information Security Awareness
Description 5: Examine the importance of information security awareness, current approaches, and how persuasive technology can enhance this awareness to prevent security lapses.

Section 6: Creation of Information Security Policy
Description 6: Discuss the formulation of information security policies using persuasive technology and the importance of these policies in ensuring information security within organizations.

Section 7: Persuasive Technology for Information Security
Description 7: Highlight the need for a concentrated implementation of persuasive strategies to improve information security policy compliance and prevent insider threats.

Section 8: Persuasive Technology to Change Behavior regarding Information Security
Description 8: Explore approaches like Behavior Change Support Systems to promote secure user behavior and attitudes, with a focus on practical interventions such as strong password creation, regular updates, and email management.

Section 9: CONCLUSION
Description 9: Summarize the potential of persuasive technology in creating long-term awareness and behavior change regarding information security, and suggest areas for future research.