Using Anonymous Discussion Platforms to Support Open Conversations about Cybersecurity in Organisations

Research Background and Issues

• What problems or challenges did the authors identify?

  • Although humans are critical to cybersecurity, employees often perceive security measures as cumbersome burdens. Within organizations, employees frequently fail to comply with information security policies and may even develop a "shadow security" culture. This phenomenon undermines the effectiveness of an organization's cybersecurity culture.
  • Current approaches (e.g., training and phishing simulations) have limited effectiveness in significantly improving employees' security awareness and behavior.
  • Employees are hesitant to discuss cybersecurity or report incidents due to fears of punitive consequences, which restricts organizations' ability to gather genuine feedback.

• Why is this issue important?

  • 90% of cyberattacks originate from human actions, highlighting the critical importance of improving employees' cybersecurity awareness and behavior to reduce security risks.
  • Technological security measures cannot fully replace employee engagement, necessitating new approaches to enhance employees' understanding and acceptance of cybersecurity policies.

• Research Motivation and Related Work

  • Most existing work lacks scalable tools to assess an organization's cybersecurity culture.
  • Instead of viewing humans as the problem, efforts should focus on developing a supportive cybersecurity culture through the lens of "humans as the solution."
  • Anonymous discussion platforms have shown utility in other workplace contexts, but their application in the cybersecurity domain remains unexplored.

Solution

• What methods or solutions did the authors propose?

  • The authors proposed designing and testing an anonymous online discussion platform that allows employees to freely discuss cybersecurity-related topics, including policies, training, and incidents.
  • Anonymity was used to alleviate employees' concerns and encourage open and honest dialogue.

• What is innovative about this solution?

  • This is the first initiative to design and deploy an anonymous employee voice platform specifically for cybersecurity.
  • The platform focuses on enabling employees to share opinions, learn from experiences, and provide direct feedback to management on existing cybersecurity policies and culture through anonymous discussions.

• What are the implementation steps and key technologies used?

  • Platform Design: The platform assigns random usernames and uses one-time login links to ensure complete anonymity. Posts are manually reviewed by the research team to prevent inappropriate content.
  • Deployment: The platform was piloted for two weeks at a large academic institution in the UK, with new discussion prompts posted daily to encourage participation.
  • Data Collection and Analysis: Content from 129 posts was collected and analyzed using a reflexive thematic analysis approach to identify key themes and trends in the discussions.

Research Outcomes

• What specific outcomes were achieved?

  • Discussion Topics:
    • Users focused on topics such as cybersecurity training, policies like two-factor authentication (2FA), email warning banners, and the impact of these measures on daily work.
    • Discussions also covered employees' behavioral deviations from cybersecurity policies, such as using unauthorized software or unapproved cloud storage.
  • Importance of Anonymity:
    • Participants felt that anonymity made it easier to ask seemingly "stupid" questions or share honest opinions.
    • However, some participants noted that complete anonymity limited discussions of specific incidents and follow-up actions.
  • Management's Response:
    • Management found the open discussions helpful for identifying issues within the cybersecurity culture. For example, some training programs were deemed ineffective, and certain policies were seen as hindering work efficiency.
    • Based on anonymous feedback, management took specific actions, such as sharing new information about past security incidents.

• What advantages does it have compared to existing solutions?

  • Compared to traditional face-to-face workshops or surveys, the platform is more scalable and can collect diverse employee feedback across the organization.
  • It fosters cross-hierarchical dialogue, enabling employees to discuss openly and allowing management to gain a clearer understanding of employees' security culture and behavior patterns.

• What were the experimental or evaluation results?

  • The platform facilitated valuable discussions and raised the priority of cybersecurity awareness among employees.
  • It successfully prompted management to reflect on communication strategies and improve specific policies (e.g., addressing 2FA issues).

• Limitations and Future Directions

  • Limitations:
    • Complete anonymity limited the ability to follow up on specific incidents or individual feedback.
    • The trial's scalability may be constrained by the unique characteristics of the academic institution, making it challenging to generalize to other industries.
  • Future Directions:
    • Explore hybrid anonymity models that allow users to choose between anonymous or identifiable posts based on the context, balancing open discussion with problem-solving needs.
    • Expand deployment to other organizations or industries to further validate the platform's applicability and effectiveness.
    • Investigate the potential social learning impacts of anonymous discussions, particularly in shaping norms around cybersecurity behavior.

Conclusion:

This study demonstrates the potential of anonymous online discussion platforms to support open cybersecurity dialogue, enhance employees' cybersecurity awareness, and provide management with genuine feedback. The findings reveal that while anonymity fosters openness, it also imposes certain limitations on actionable interventions. Future research could explore hybrid platform designs and larger-scale deployment experiments.