Survey of daily information security 2020

1. Introduction

This survey is part of a long-standing study that looks at how information security ('infosec') shows in people's daily lives and how it could be supported. The focus is on mobile devices outside of work and study, but other data processing is also considered. The questions usually only mention a phone, or smartphone. If another similar device, such as a tablet, almost always follows with you, take that into account in your answers.

You have received a link from a student on an infosec course at Tampere university, and hopefully you have also agreed on an time for an interview. The student will

Your answers are anonymous already when you save them, and only the student knows who you are. The answers can be quoted when the survey results are published.

In the introductory questions infosec is viewed in general, and not only on smartphones. By the way, take a look at the clock when you start, so you know how much time it took at the end.

(1)   How much do you know about the threats to your own information security? (Note that it is enough to click the text instead of the button. ICS = I can't say.)

(2)   How much do the infosec threats worry you?

(2ax)   Has a piece of news about infosec still caused some worry in you? What was it about? Recent news can be seen in the tweet list of the student group. The answer can be supplemented in the open question 8.10x.

(2bx)   "If yes, did those news have consequences in your daily life?"

(3)   In how good state do you think your information security is? (Regardless of whether it is taken care of by you, someone else, or you together.)

(5x)   Find out in your own words how important the respondent’s electronic information, media, connections, etc. are to him or her and categorize the response. The goal is only an overview of the respondent's attitude and is not limited to a smartphone. You need this kind of information in your risk assessment.

(6x)   This and the next two questions deal specifically with the smartphone. The goal is still an overview of the respondent\'s awareness, not exact descriptions of events.

"How much do you monitor or guard your environment when you enter data, especially a password?"

(7x)   "Do you think you have ever fallen victim to malware? If so, what made you think so?" (Note: on the phone!)

(8x)   Is the respondent sometimes concerned about the possible independent operations of the phone's microphone or camera?

(9x)   If yes, which is of higher concern?

2. Background

(1)   Gender

(2)   Age in years

(3)   Are you primarily

(4)   If you are mainly occupied by work or studies, how big portion of your tasks do you carry out by using computers? Answer with one approximate number, between 0 and 100 percent (without the % sign though).

(5)   How active user of computers are you outside work and study? Answer with one approximate number, between 0 and 100 percent, where 100 would represent the situation where you use all your spare time to social media, internet calls, web browsing, image processing, computer games or similar.

(6)   Your educational background, generally:

(7)   Your education in information technology (IT):

(8)   How many years have you been using a smartphone, approximately?

3. What else than a smartphone?

(1x)   Record here your main observations related to the use of other information technologies that affect the risk assessment of the smartphone. You can start with the two questions below and complete in writing if something important appears in other devices, hobbies, security programs, assisting neighbours, etc.

(2x)   What proportion of out-of-work computing occurs on a mobile device (i.e., a phone or tablet, but not a laptop.) Express the proportion with one approximate percentage from 0 to 100.

(3x)   Does the respondent maintain his or her own equipment (including the phone) and is he or she able to do so?

4. Generally on your smartphone

(1)   What operating system does your phone have?

(2)   Your phone naturally stores contact data, that are needed for its immediate use. Do you have in your phone some other data, which you mainly use via the phone? (Ignore here the passwords - they will be dealt with later.)

(3)   Are there sensitive data on your phone, i.e. such data, that you would not like others to see—not even all your close ones? (We'll deal with protections later, so answer here as if those data were not protected.)

(4)   If there are such data, are they

(5)   What connections do you usually have on your phone constantly open, i.e. accessible without logging in to them? (but still possibly behind your screen lock.)

5. Use of internet services

(1x)   First, check that the respondent has correctly understood question 4.5 above and try to refine the answer if he or she did not want to tell. “Without logging in” is related to what a user of the device can do after passing any security code.
The purpose of this section 5 is to establish a “profile” of the respondent as a mobile user of the internet services. In the same style as in Section 3, you can start with the following three dimensional questions and supplement them by writing here things that will help in understanding the risk assessment. For example, there is no direct question about reusing passwords over time or over different accounts, but the issue may indirectly pop up here.

2x The respondent uses the data network (i.e. reads, watches, communicates, stores; having just the mobile data open is not considered))

3x The number of services and applications in use is

4x In terms of services and applications, the respondent is

6. Some general opportunities and threats

(1ax)   Discuss different situations in which the mobile device is at risk of being lost or broken. Find out if the respondent is aware of the dangers and how well prepared he or she is.

Note that there are two types of danger:
 * the physical event itself, and
 * its consequences for data and connections in the form of
    -- loss, or
    -- disclosure and misuse.

Try to summarize awareness with respect to both types, and then do the same for preparedness. You have learned the responder's baseline in these matters already from the prior answers in section 7.

- Awareness:

(1bx)   - Preparedness:

(2x)   Personal data of people registered to a network service can leak as a result of a security break-in and also otherwise. Has the respondent prepared herself or himself to such by:

- the use of pseudonyms, or something similar?

(3x)   - not telling personal data to services?

(4x)   - completely abstaining from the use of services?

(5x)   From other questions, you have already got an idea,

• what sensitive information the respondent may have on the phone (4.2 & 4.4),
• how “large and hot contact surface” the respondent has with the internet (Section 5),
• how the respondent uses the device and accounts (first part of this section),
• and what technical protections the respondent has (Section 7).

(6x)   Estimating the probability above is already part of the risk analysis and almost the same is repeated in 8.8A3x. While being a real thing this evaluation is an exercise, where you observe that a reasonable estimate still requires you to ask some details from the respondent.
Write down here what you asked and what you got in response. No matter how you discussed the issue, try to make your note here in such a way that the same question could have been on the respondent’s own form, possible even with answer options. (While thinking in this way you might gain a little insight on what it would require to build an infosec app to do automatic risk assessments for users.)

7. Security practices

(1)   Which of the following have you taken into use?

(2)   Where do you copy data from your phone?

(3)   If you copy, how do you do it?

(4)   If you use a back-up program, what is it like?

(4x)   More specifically: how regular and covering is the back-up procedure? Give a combined estimate after discussion, with respect to quality, quantity and volatility of data, and characteristics of the copying:

(5)   Have you stored the IMEI number (phone serial number) somewhere, where you can find it?

(6)   Does your phone have a remote or theft management system?

(7)   If there is, what can you do with it?

(8)   How do you react when the downloaded applications request access rights to various resources on the phone?

(9)   Is your (or your relative's) contact information visible on the phone? That is, also when the phone is locked.

(10)   Do you have passwords stored in you phone?

(11)   If you have, how have you protected them?

(12)   Have you protected other data on your phone?

(13)   What have you done to protect your phone from malware?

(14x)   To what extent has the respondent restricted applications from accessing location?

(15x)   What additions does the interview bring to the above? It could be e.g. a specific way to use the smartphone or a situation, which leads to the answers giving a wrong whole picture. For instance, would it be more illustrative to say in question 7.8 that the respondent adjusts the limits to the rights of applications?

8. Evaluation of your information security

There are no questions to be answered in advance in this section. Instead, the student gives a summary of evaluating your daily mobile infosec based on your previous answers, and you can adjust it together: What risk category do you belong to, what kind of security do you need and is the current level appropriate?

(1x)   To what extent does the respondent want to protect personal data (i.e. data about him/herself)?

(2x)   Does the respondent have data to protect, other than personal data?

(3x)   Are there vulnerabilities in the respondent's mobile information processing?

(4x)   Is the respondent aware of IS threats and the need of protections against them?

(5x)   Has the respondent taken protections into use?

(6x)   Has the respondent also invested money in protections, possibly in the price of the internet or phone connection?

(7x)   How tempting target is the respondent to an attacker, who is attempting to get financial gain through cheating, malware, or capture of the device?

(7Bx)   Was there need to adjust your preliminary interpretations? If yes what kind of additional information was needed? (Try to answer this in the same spirit as question 6.6x above.)


Next, the student presents the actual risk analysis, i.e. evaluates

The student will do this with respect to the following infosec goals:

(8A1x)   Problem with availability and integrity. (A) Probability:

(8B1x)   (B) Seriousness:

(8A2x)   Problem with secrecy. (A) Probability:

(8B2x)   (B) Seriousness:

(8A3x)   Problem with personal data. (A) Probability:

(8B3x)   (B) Seriousness:

(9x)   What are the biggest infosec risks in the respondent's daily life? Something is possibly found, even if all of the above had been just negligible. Only mention issues about the mobile everyday. Of course, you can discuss much more in the interview.

(10x)   What are your main tips for improving the respondent's mobile infosec? Conversely, if the risks are very small, could the respondent operate with fewer restrictions, for example in the internet? Also, write here if you think the respondent should improve his or her security awareness - or should be more / less concerned about infosec issues.

The research form only needs a very short answer in this and the preceding question. In the interview, however, both issues may need a lot of time.

(13x)   "Are there still some infosec issues related to smartphones, not covered above?"

9. Context