Scroll Top

A CYBER BELIEF MODEL

Technical Report 23-01 | 2023

The Health Belief Model (HBM) is a longstanding family of models to explain why people don’t act on health advice. Adaptation of the HBM to cybersecurity provides insight and explanations as to why cybersecurity advice is not consistently acted upon. This technical report presents motivation, a first Cyber Belief Model, results of an interview study and an interview coding scheme. The interview study with 9 participants analyzed enterprise responses to the log4shell crisis, and indicates that awareness and prompts to action are well addressed, but barriers to action remain. It may be that the overall cybersecurity investment could be rebalanced in ways that increase the rate of taking preventative actions. This Cyber Belief Model may be a useful way to identify and address inhibitors to action, leading to improved security globally.

A CYBER BELIEF MODEL

Technical Report 23-01 | 2023

The Health Belief Model (HBM) is a longstanding family of models to explain why people don’t act on health advice. Adaptation of the HBM to cybersecurity provides insight and explanations as to why cybersecurity advice is not consistently acted upon. This technical report presents motivation, a first Cyber Belief Model, results of an interview study and an interview coding scheme. The interview study with 9 participants analyzed enterprise responses to the log4shell crisis, and indicates that awareness and prompts to action are well addressed, but barriers to action remain. It may be that the overall cybersecurity investment could be rebalanced in ways that increase the rate of taking preventative actions. This Cyber Belief Model may be a useful way to identify and address inhibitors to action, leading to improved security globally.

A CYBER BELIEF MODEL

Technical Report 23-01 | 2023

The Health Belief Model (HBM) is a longstanding family of models to explain why people don’t act on health advice. Adaptation of the HBM to cybersecurity provides insight and explanations as to why cybersecurity advice is not consistently acted upon. This technical report presents motivation, a first Cyber Belief Model, results of an interview study and an interview coding scheme. The interview study with 9 participants analyzed enterprise responses to the log4shell crisis, and indicates that awareness and prompts to action are well addressed, but barriers to action remain. It may be that the overall cybersecurity investment could be rebalanced in ways that increase the rate of taking preventative actions. This Cyber Belief Model may be a useful way to identify and address inhibitors to action, leading to improved security globally.

TERMS OF USE

The CyberGreen Institute (“CyberGreen”) Is a non-profit, charitable organization dedicated to the creation and dissemination of metrics measuring the Cyber health of networks along with related data, metrics, and analysis. We also assist network operators with the adoption of Cyber hygiene best practices and risk remediation. A big part of our mission is the collection, calculation, and public distribution of our CyberGreen Index. The CyberGreen Index and the other data that we publish on this website is released under the Affero General Public License (version 3) (the “License”). The use of License ensures that our data remains freely accessible and freely useable by members of the public. (In rare circumstances, we may use another license to distribute data, in which case the specific data set will not be available without a click-thru notice specifying the specific license that applies.)

We do ask that you cite us properly in any academic work as the source for anything that you take from this website. If you are a commercial firm and wish to incorporate our data into a commercial product, you must acknowledge CyberGreen as the source of the data that you used and provide your customers with a link to this website with simple instructions on how to find the data that you took from our site.

We do not publish personally identifiable information (PII) or other information that implicates third party privacy rights. CyberGreen is committed to being compliant with GDPR. Our compliance efforts have been certified by the Institute for Social Internet Public Policy (ISIPP).

TERMS OF USE

The CyberGreen Institute (“CyberGreen”) Is a non-profit, charitable organization dedicated to the creation and dissemination of metrics measuring the Cyber health of networks along with related data, metrics, and analysis. We also assist network operators with the adoption of Cyber hygiene best practices and risk remediation. A big part of our mission is the collection, calculation, and public distribution of our CyberGreen Index. The CyberGreen Index and the other data that we publish on this website is released under the Affero General Public License (version 3) (the “License”). The use of License ensures that our data remains freely accessible and freely useable by members of the public. (In rare circumstances, we may use another license to distribute data, in which case the specific data set will not be available without a click-thru notice specifying the specific license that applies.)

We do ask that you cite us properly in any academic work as the source for anything that you take from this website. If you are a commercial firm and wish to incorporate our data into a commercial product, you must acknowledge CyberGreen as the source of the data that you used and provide your customers with a link to this website with simple instructions on how to find the data that you took from our site.

We do not publish personally identifiable information (PII) or other information that implicates third party privacy rights. CyberGreen is committed to being compliant with GDPR. Our compliance efforts have been certified by the Institute for Social Internet Public Policy (ISIPP).

TERMS OF USE

The CyberGreen Institute (“CyberGreen”) Is a non-profit, charitable organization dedicated to the creation and dissemination of metrics measuring the Cyber health of networks along with related data, metrics, and analysis. We also assist network operators with the adoption of Cyber hygiene best practices and risk remediation. A big part of our mission is the collection, calculation, and public distribution of our CyberGreen Index. The CyberGreen Index and the other data that we publish on this website is released under the Affero General Public License (version 3) (the “License”). The use of License ensures that our data remains freely accessible and freely useable by members of the public. (In rare circumstances, we may use another license to distribute data, in which case the specific data set will not be available without a click-thru notice specifying the specific license that applies.)

We do ask that you cite us properly in any academic work as the source for anything that you take from this website. If you are a commercial firm and wish to incorporate our data into a commercial product, you must acknowledge CyberGreen as the source of the data that you used and provide your customers with a link to this website with simple instructions on how to find the data that you took from our site.

We do not publish personally identifiable information (PII) or other information that implicates third party privacy rights. CyberGreen is committed to being compliant with GDPR. Our compliance efforts have been certified by the Institute for Social Internet Public Policy (ISIPP).