Scaling the Security Wall

TLDR

End‑user security behavior lacks a standard measurement tool despite abundant advice and education. The study aims to develop a standardized measurement tool for end‑user security behaviors. The authors surveyed common expert advice, designed Likert‑scale questions, and iteratively tested them with 3,619 users to refine a reliable, broadly applicable instrument. Factor analysis yielded a 16‑item scale with four sub‑scales measuring attitudes toward passwords, device securement, updates, and proactive awareness.

Abstract

Despite the plethora of security advice and online education materials offered to end-users, there exists no standard measurement tool for end-user security behaviors. We present the creation of such a tool. We surveyed the most common computer security advice that experts offer to end-users in order to construct a set of Likert scale questions to probe the extent to which respondents claim to follow this advice. Using these questions, we iteratively surveyed a pool of 3,619 computer users to refine our question set such that each question was applicable to a large percentage of the population, exhibited adequate variance between respondents, and had high reliability (i.e., desirable psychometric properties). After performing both exploratory and confirmatory factor analysis, we identified a 16-item scale consisting of four sub-scales that measures attitudes towards choosing passwords, device securement, staying up-to-date, and proactive awareness.