Impact of digital nudging on information security behavior: an experimental study on framing and priming in cybersecurity. Issue 1 (20th September 2021)

• Record Type: Journal Article
• Authors: Sharma, Kavya; Zhan, Xinhui; Nah, Fiona Fui-Hoon; Siau, Keng; Cheng, Maggie X.
• Is Part Of: Organizational cybersecurity journal. Volume 1:Issue 1(2021)
• Page Start: 69
• Page End: 91
• Publication Date: 2021-09-20
• Subjects: Cybersecurity -- Framing -- Priming -- Digital nudging -- Information security -- User behavior; 658.478
• DOI: 10.1108/OCJ-03-2021-0009
• Languages: English
• ISSNs: 2635-0270

Abstract

Abstract : Purpose: Phishing attacks are the most common cyber threats targeted at users. Digital nudging in the form of framing and priming may reduce user susceptibility to phishing. This research focuses on two types of digital nudging, framing and priming, and examines the impact of framing and priming on users' behavior (i.e. action) in a cybersecurity setting. It draws on prospect theory, instance-based learning theory and dual-process theory to generate the research hypotheses. Design/methodology/approach: A 3 × 2 experimental study was carried out to test the hypotheses. The experiment consisted of three levels for framing (i.e. no framing, negative framing and positive framing) and two levels for priming (i.e. with and without priming). Findings: The findings suggest that priming users to information security risks reduces their risk-taking behavior, whereas positive and negative framing of information security messages regarding potential consequences of the available choices do not change users' behavior. The results also indicate that risk-averse cybersecurity behavior is associated with greater confidence with the action, greater perceived severity of cybersecurity risks, lower perceived susceptibility to cybersecurity risks resulting from the action and lower trust in the download link. Originality/value: This research shows that digital nudging in the form of priming is an effective way to reduce users' exposure to cybersecurity risks.