EVALUATING RISK APPEAL APPROACHES BASED ON PMT TOWARDS MAKING SECURE DECISIONS

To explain changes in users’ security behaviors and behavioral intentions, we investigated the different messaging approaches that followed the Protection Motivation Theory (PMT) design guidelines. These messaging approaches were used in different
security contexts in terms of authentication (e.g., using screen lock and Two Factor Authentication) and confidentiality (e.g., sharing sensitive information via secure email). As a part of our work, in the first approach, we investigated different risk appeal messaging designs based on PMT that were more suited for the Saudi population to adopt the screen lock. Our results showed that the Saudi-customized messaging
was extremely effective in changing our participants’ locking behavior. In the second approach, to encourage users to voluntarily adopt 2FA, we investigated whether video-based risk communication messages based on PMT would be received differently if they were delivered by a human speaker from the target population versus a cartoon speaker. Our evaluation showed that a video message from a human speaker
improved our participants’ behavior versus the animated speaker video message. Regarding the last approach, we first conducted a structured interview with Gmail users who had used Gmail’s Confidential Mode (GCM) to explore what motivated them
to use the confidential mode, what their perceptions were of confidential mode, and whether they understood the features of this mode for achieving confidentiality. We found that users used GCM to share their confidential or private documents with recipients and perceived GCM to be encrypted and confidential. Encouraged by these findings, we evaluated messaging approaches that followed the PMT and paired with
anticipated regret (PMT+AR) and planning techniques (PMT+AR+P) in persuading Gmail users to utilize an encrypted email (e.g., Virtru) for sharing their sensitive information. Our evaluation showed that both messaging approaches (PMT+AR and PMT+AR+P) increased the adoption rate of utilizing an encrypted email and motivated participants to use Virtru when they shared sensitive information via email. Therefore, our results offered further insights regarding how PMT video messaging incorporated with other elements can increase the likelihood that the actual behavior will be implemented.