Bridging the Gap in Computer Security Warnings A Mental Model Approach

18 COPUBLISHED BY THE IEEE COMPUTER AND RELIABILITY SOCIETIES 1540-7993/11/$26.00 © 2011 IEEE MARCH/APRIL 2011 W arnings are a form of communication designed to protect people from harm. Psychologists have studied physicalworld warnings since the early 20th century. The psychological processes involved in paying attention to warnings, grasping their meaning, and deciding to comply with them haven’t changed substantially, even in the digital realm. An effective physical warning clearly communicates risk, consequences of not complying, and instructions to comply (although some of this information can be omitted if the risk is obvious or the consequences can be deduced from the warning). However, many of the most common computer warnings fail to follow one or more of these guidelines. For example, in Figure 1, the warning dialog doesn’t explain the risk (the file might be infected with malware) or consequences (information might get corrupted, erased, or disclosed to third parties), and it doesn’t instruct users on how to avoid the risk (either delete attachment or save it on your hard disk and scan it with your antivirus software). Besides protecting people from harm, warnings are also intended to modify behavior to comply with existing safety regulations; to decrease the likelihood of health problems, accidents, or property damage; and to serve as reminders. However, warnings aren’t the most effective method for protecting people from hazards, and should be used only as a third line of defense, after considering ways of designing out hazards and guarding against them. Consider a hazardous broken sidewalk. You could repair (design the risk out) or put a barricade around it (guard against the risk). You could post warning signs as an interim solution, but they shouldn’t be the only safeguard. However, in some situations, designing out a hazard or guarding against it might not be feasible. For example, the sharp edge of a knife can’t be designed out without making the knife useless, and guarding against the risk of cutting oneself isn’t practical. Similarly, the risk of being phished by a malicious website can’t be completely designed out, although users could employ guarding strategies such as automatically detecting and removing suspicious links from email. An additional difficulty with digital risks is that they’re less understood, and analogies to the physical world can be incomplete or misleading. If users don’t know what phishing is, they won’t be able to assess whether they’re at risk. Here, users rely on a very rudimentary form of learning. If choosing a particular option lets them continue their work unhindered, then they might choose that option every time, especially if they don’t really understand the risk that they’re being warned about. Even experts dismiss warnings when they understand them because they find them unimportant. Regardless of people’s expertise level, warnings don’t seem to be doing what they are supposed to be doing—stopping people from engaging in unsafe behaviors. To improve users’ understanding of warnings, we first need to determine how users Computer security warnings are intended to protect