Amidst growing IT security challenges, psychological underpinnings of security behaviors have received considerable interest, e.g. cybersecurity Self-Efficacy (SE), the belief in one’s own ability to enact cybersecurity-related skills. Due to diverging definitions and proposed mechanisms, research methods in this field vary considerably, potentially impeding replicable evidence and meaningful research synthesis. We report a preregistered systematic literature review investigating (a) cybersecurity SE measures, (b) SE’s proposed roles, and (c) intervention approaches. We minimized selection bias by detailed exclusion criteria, interdisciplinary search strategy, and double coding. Among 174 cybersecurity SE studies (2010-2021) from 18 databases with 55,758 subjects, we identified 173 different SE measures with considerable differences in psychometric quality and validity evidence. We found 276 variables as assumed causes/outcomes of cybersecurity SE and identified 13 intervention designs. This review demonstrates the extent of methodological and conceptual fragmentation in cybersecurity SE research. We offer recommendations to inspire our research community toward standardization.

Trust in digital systems depends on secure hardware, often assured through HRE. This work develops methods for investigating human problem-solving processes in HRE, an underexplored yet critical aspect. Since reverse engineers rely heavily on visual information, eye tracking holds promise for studying their cognitive processes. To gain further insights, we additionally employ verbal thought protocols during and immediately after HRE tasks: Concurrent and Retrospective Think Aloud. We evaluate the combination of eye tracking and Think Aloud with 41 participants in an HRE simulation. Eye tracking accurately identifies fixations on individual circuit elements and highlights critical components. Based on two use cases, we demonstrate that eye tracking and Think Aloud can complement each other to improve data quality. Our methodological insights can inform future studies in HRE, a specific setting of human-computer interaction, and in other problem-solving settings involving misleading or missing information.

The ubiquity of devices connected to the internet raises concerns about the security and privacy of smart homes. The effectiveness of interventions to support secure user behaviors is limited by a lack of validated instruments to measure relevant psychological constructs, such as self-efficacy – the belief that one is able to perform certain behaviors. We developed and validated the Cybersecurity Self-Efficacy in Smart Homes (CySESH) scale, a 12-item unidimensional measure of domain-specific self-efficacy beliefs, across five studies (N = 1247). Three pilot studies generated and refined an item pool. We report evidence from one initial and one major, preregistered validation study for (1) excellent reliability (α = 0.90), (2) convergent validity with self-efficacy in information security (rSEIS = 0.64, p < .001), and (3) discriminant validity with outcome expectations (rOE = 0.26, p < .001), self-esteem (rRSE = 0.17, p < .001), and optimism (rLOT-R = 0.18, p < .001). We discuss CySESH’s potential to advance future HCI research on cybersecurity, practitioner user assessments, and implications for consumer protection policy.

There is an underexploited potential in enhancing massive online learning courses through small-group learning activities. Size and diversity allow for optimizing group composition in small-group tasks. The purpose of this paper was to investigate how groups formed based on learner behavior affect productivity of students in a small-group task. Students classified as high, average and low were randomly assigned to homogeneous or heterogeneous groups. Results indicate that overall, heterogeneous groups were either similarly or a bit more productive than homogeneous groups. Yet, we found that homogeneous groups classified as high-level were as or more than heterogeneous groups. However, heterogeneous groups were still more productive than homogeneous-average and homogeneous-low groups suggesting heterogeneous groups are the best choice for the entire community. Students classified as low-level were more productive in homogeneous groups, suggesting that grouping less active students together, makes social loafing more difficult and students participate more.