Influence of Cumulative Risk Priming on Security Update Decision Making. (September 2021)

• Record Type: Journal Article
• Authors: Shieh, Michael; Rajivan, Prashanth
• Is Part Of: Proceedings of the Human Factors and Ergonomics Society ... Annual Meeting. Volume 65:Part 1(2021)
• Page Start: 353
• Page End: 357
• Publication Date: 2021-09
• Subjects: Human engineering -- Congresses; 620.8205
• DOI: 10.1177/1071181321651068
• Languages: English
• ISSNs: 1541-9312

Abstract

Installing security updates is one of the important security actions individuals can take to prevent potential cybersecurity threats. The cumulative risk of delaying the installation of security updates over an extended period can be substantial, and yet, people often choose to delay such actions. Past research suggests that people neglect to update because the majority overestimate the cost (e.g., time) of an update and underestimate an attack risk. Utilizing the repeated protective decision paradigm, we conducted a laboratory experiment to examine whether priming people about the cumulative risk of not updating could influence their update speed. Results from our experiment show that communicating cumulative risk would only have a momentary effect on peoples' update decisions and that people would quickly learn from experience to delay or neglect to update. Our findings highlight the importance of augmenting user habits to improve update decision-making.