Adam Beautement, Ingolf Becker, Simon Parkin, Kat Krol and M. Angela Sasse
Organisational security policies are often written without suﬃciently taking in to account the goals and capabilities of the employees that must follow them. Eﬀective security management requires that security managers are able to assess the eﬀectiveness of their policies, including their impact on employee behaviour. We present a methodology for gathering large scale data sets on employee behaviour and attitudes via scenario-based surveys. The survey questions are grounded in rich data drawn from interviews, and probe perceptions of security measures and their impact. Here we study employees of a large multinational company, demonstrating that our approach is capable of determining important diﬀerences between various population groups. We also report that our work has been used to set policy within the partner organisation, illustrating the real-world impact of our research.
Date: 22 June 2016 Published:
Paper included in the Proceedings of the Twelfth Symposium on Usable Privacy and Security (SOUPS 2016). Publisher: USENIX Publisher URL: https://www.usenix.org/system/files/conference/soups2016/soups2016-paper-beautement.pdf