Dixon Brown, Brigham Young University
Information Systems
Despite being a problem for more than two decades, malicious software (or malware) remains a serious threat to the information security of organizations. Increasingly, attackers target the computers of end users to gain a beachhead from which the network of a user’s organization can be surveilled and exploited. Given the growing threat of malware to end users and their or- ganizations, there is a need to understand how malware warnings can be made more effective to alert end users of potential threats. We address this need by performing a NeuroIS study to examine whether men and women process malware warnings in the brain differently (or whether men process them at all?). We conducted a laboratory study that employed electroencephalography (EEG), a proven method of measuring neurological activity in temporally sensitive tasks. We found that the amplitude of the P300, an ERP event-related potentialcomponent indicative of decision making ability, was higher for all participants when viewing malware warning screenshots relative to legitimate website shots. Additionally, we found that the P300 was greater for women than for men, indicating that women exhibit higher brain activity than men when viewing malware warnings. Our results demonstrate the value of applying NeuroIS methods to the domain of information security and point to several promising avenues for future research.