My lightning talk to the 2019 Women in Cybersecurity conference in Pittsburgh, PA, USA, given March 29, 2019.

1. Reframing
Usable Privacy + Security
to Design for ‘Cyber Health’
Cori Faklaris | March 29, 2019
Lightning talk for the 2019 Women in Cybersecurity conference (WiCyS 2019), Pittsburgh, Penn., USA
Human-Computer Interaction Institute

2. Takeaways:
● Health as a lens for security design
● Design model adapts the
Transtheoretical Model of (Health)
Behavior Change
● How to use this model in practice
2

3. 3

4. 4
Social contagion
Herd immunity
Viral hoaxes

5. Source: “The Transtheoretical Model ( Stages of Change)”. 2016. Boston University School of Public Health. Last visited Feb. 7, 2018
at http://sphweb.bumc.bu.edu/otlt/MPH-Modules/SB/BehavioralChangeTheories/BehavioralChangeTheories6.html
(Awareness)
(Motivation)
(Knowledge)
(Resistance)
(Reinforcement)
(Denial)
5

6. Pre-Contemplation
AW
ARENESS
MOTIVATION
Contemplation
Preparation
(Determination)Action
M
aintenance
-Regulations
-Government
-Society
-Culture
Relapse
-Larger
system
environment
-Global
internet
infrastructure
SELF-EFFICACY
TEMPTATION
KNOWLEDGE
REINFORCEMENT
R
ESISTAN
C
E
DENIAL
SITUATIONAL FACTORS
SOCIAL FACTORS
OTHER
INDIVIDUAL
FACTORS
EXTERNAL
FACTORS
EXTERNAL
FACTORS
6Cori Faklaris - July 2018 - Carnegie Mellon Univ. - Page 6

7. 7
Get from this …
“I don’t need to
use/have time to
use/ these privacy
and security
practices.”
Stage 1: Precontemplation (or “Resistance to Change”)
… To this ...
“It may be a good
idea to use these
privacy and
security
practices.”
Create Awareness
… Using these:
● Feedback
● Education
● Reading materials
● Storytelling
● Media campaigns
● Empathy training

8. 8
Get from this …
“I worry that I don’t
use these privacy
and security
practices.”
… To this ...
“I will regret it if I
do not start using
these privacy and
security practices.”
Create Motivation
… Using these:
● “Family interventions”
● Role playing
● Documentaries
● Imagery
● Value reflection and
clarification
Stages 2-3: Contemplation/Preparation (“Receptiveness”)

9. 9
Stages 2-3: Contemplation/Preparation (“Receptiveness”)
Get from this …
“I want to
change/need to
change my privacy
and security
practices.”
… To this ...
“I feel better for
commiting to my
chosen privacy
and security
practices.”
Agency/Knowledge
… Using these:
● Empowerment
procedures + policies
● Public testimonials
● Providing choices among
2-3 alternatives
● Advocacy at the margins

10. 10
Stages 4-5: Action + Maintenance (“Engagement”)
Get from this …
“I intend to
use/am actively
using/am
committed to
these privacy and
security
practices.”
… To this ...
“I ask for help with
using/am
successful with
using/keep
improving my use
of privacy and
security practices.”
Reinforce Behavior
… Using these:
● Rewards and
punishments
● Controlling stimuli to
nudge behaviors
● Environmental changes
● Groups and coaching

11. ● Lens: Security as health
● Design model adapts TTM
● How to use the model
Any questions?
You can find me at
○ Twitter: @heycori | Email: heycori @cmu.edu
○ Website: http://corifaklaris.com
11