Scaring people is not enough : an examination of fear appeals within the context of promoting good password hygiene

Dupuis, Marc and Jennings, Anna and Renaud, Karen; (2021) Scaring people is not enough : an examination of fear appeals within the context of promoting good password hygiene. In: SIGITE '21: Proceedings of the 22st Annual Conference on Information Technology Education. SIGITE 2021 - Proceedings of the 22nd Annual Conference on Information Technology Education . ACM, USA, pp. 35-40. ISBN 9781450383554 (https://doi.org/10.1145/3450329.3476862)

[thumbnail of Dupuis-etal-SIGITE-2021-Scaring-people-is-not-enough-an-examination-of-fear-appeals]
Preview
 Text. Filename: Dupuis_etal_SIGITE_2021_Scaring_people_is_not_enough_an_examination_of_fear_appeals.pdf
Accepted Author Manuscript
Download (1MB)| Preview

Abstract

Fear appeals have been used for thousands of years to scare people into engaging in a specific behavior or omitting an existing one. From religion, public health campaigns, political ads, and most recently, cybersecurity, fear appeals are believed to be effective tools. However, this assumption is often grounded in intuition rather than evidence. We know little about the specific contexts within which fear appeals may or may not work. In this study, we begin to examine various components of a fear appeal within the context of password hygiene. A large-scale randomized controlled experiment was conducted with one control and three treatment groups: (1) fear only; (2) measures needed and the efficacy of such measures, and (3) fear combined with measures needed and the efficacy of such measures. The results suggest that the most effective way to employ a fear appeal within the cybersecurity domain is by ensuring that fear is not used on its own. Instead, it is important that information on the measures needed to address the threat and the efficacy of such measures is used in combination with information about the nature of the threat. Since many individuals that enter the information technology profession become the de facto security person, it is important for information technology education programs to distill in students the inadequacy of fear, on its own, in motivating secure actions.

ORCID iDs

Dupuis, Marc, Jennings, Anna and Renaud, Karen ORCID logoORCID: https://orcid.org/0000-0002-7187-6531;
CORE (COnnecting REpositories)