Abstract

Security messages, as a form of information security awareness training, are designed to encourage individuals to make an informed security decision, reducing their susceptibility to online victimization. To date, no known study has assessed the effectiveness of security messages or whether the effectiveness of these messages varies based on the recipients’ characteristics. Using a randomized controlled trial, this study tests the efficacy of security messages on reducing SMiShing victimization, then assesses whether thoughtfully reflective decision-making (TRDM) moderates the effect of these messages on victimization by launching simulated attacks against participants of the study. Findings reveal that neither security messages nor TRDM directly affect SMiShing victimization. However, security messages effectively prevent victimization when the message recipient has higher TRDM levels. The interaction between TRDM and security messages demonstrates the relevance of criminological theory and the importance of interdisciplinary scholarship in understanding how human behavior influences the effectiveness of cybersecurity practices.

摘要

安全消息作为信息安全意识培训的一种形式，旨在鼓励个人做出明智的安全决策，降低他们对网络受害的敏感性。迄今为止，还没有已知的研究评估安全消息的有效性或这些消息的有效性是否根据收件人的特征而变化。本研究使用随机对照试验，测试安全消息在减少 SMiShing 受害方面的功效，然后评估深思熟虑的反思决策 (TRDM) 是否通过对研究参与者发起模拟攻击来缓和这些消息对受害的影响。调查结果显示，安全消息和 TRDM 都不会直接影响 SMiShing 受害情况。然而，当消息接收者具有较高的 TRDM 级别时，安全消息可有效防止受害。TRDM 和安全信息之间的相互作用证明了犯罪学理论的相关性以及跨学科学术在理解人类行为如何影响网络安全实践有效性方面的重要性。