Research Article
Security Mental Models and Personal Security Practices of Internet Users in Africa
@INPROCEEDINGS{10.1007/978-3-031-06374-9_4, author={Enock Samuel Mbewe and Josiah Chavula}, title={Security Mental Models and Personal Security Practices of Internet Users in Africa}, proceedings={e-Infrastructure and e-Services for Developing Countries. 13th EAI International Conference, AFRICOMM 2021, Zanzibar, Tanzania, December 1-3, 2021, Proceedings}, proceedings_a={AFRICOMM}, year={2022}, month={5}, keywords={Usable security Security mental models Internet security Privacy}, doi={10.1007/978-3-031-06374-9_4} }- Enock Samuel Mbewe
Josiah Chavula
Year: 2022
Security Mental Models and Personal Security Practices of Internet Users in Africa
AFRICOMM
Springer
DOI: 10.1007/978-3-031-06374-9_4
Abstract
Recent trends show an increase in risks for personal cyberattacks, in part due to an increase in remote work that has been imposed by worldwide Covid-19 lockdowns. These attacks have further exposed the inefficiencies of thepaternalisticdesign of Internet security systems and security configuration frameworks. Prior research has shown that users often have inadequate Internet security and privacy mental models. However, little is known about the causes of flawed mental models. Using mixed methods over a period of nine months, we investigate Internet security mental models of users in Africa and the implications of these mental models on personal security practice. Consistent with prior research, we find inadequate Internet security mental models in self-reported expert and non-expert Internet users. In addition, our mental modelling and task analysis reveal that the flawed security practice does not only result from users’ negligence, but also from lack of sufficient Internet security knowledge. Our findings motivate for reinforcing users’ Internet security mental models through personalised security configuration frameworks to allow users, especially those with limited technical skills, to easily configure their desired security levels.
