Who Can Actually Follow IT-Security Advice? Exploring the Usability of IT-Security Advice

Individuals are increasingly expected to rely on publicly available IT-security advice to protect themselves against cyberattacks and data breaches. However, little is known about how usable such IT-security advice is in practice for ordinary users. In this paper, we empirically evaluate the perceived usability of IT-security advice drawn from multiple publicly available sources. Based on an adapted System Usability Scale survey and qualitative analysis, we explored the perceived usability of IT security advice. Our results show substantial variation in usability across pieces of advice. User characteristics such as age, education, and self-assessed IT-knowledge are associated with differences in perceived usability, whereas traditional text-metrics show limited explanatory power. We discuss implications for the user-centred design and evaluation of IT-security advice. This work contributes to the usable security literature by providing empirical evidence on policy usability and by highlighting the role of user differences in the perceived usability of IT-security advice.