Mining the Mind – Applying Quantitative Techniques to Mental Models of Security

Abstract

Mental models, informal representations of reality, provide an appealing explanation for the apparently non-rational security decisions of information technology users. Although users may be attempting to make secure decisions, the use of incomplete or incorrect information security mental models as a shortcut to decision making may lead to undesirable results. We describe mental models about viruses and hackers drawing on data from a survey of 609 adult IT users and link these to security behaviours and perceptions. We find that there are potentially just a small number of common security beliefs and suggest that accommodating mental models during security design may be more beneficial to long-term security than expecting users to change to accommodate security requirements.