Adobe Security Survey

Transcription

1 Adobe Security Survey October 2016 Edelman + Adobe

2 INTRODUCTION Methodology Coinciding with National Cyber Security Awareness Month (NCSAM), Edelman Intelligence, on behalf of Adobe, conducted a nationally representative survey of ~2,000 computer-owning adults in the United States to gain insights into consumer behaviors around software updates, password control, and phishing. Who? Nationally representative sample of computer-owning adults How many? Total: 2,001 Margin of error: ±2.2% Millennials (636), Gen X (715), & Baby Boomers (650)*: Margin of error: ±3.9% Men (1,003) & Women (998) How? Online Quantitative Survey When? September 7, 2016 September 16, 2016 Margin of error: ±3.1% *For the purposes of this study, Millennials are ages 18-34, Gen Xers are ages 35-54, and Baby Boomers are 55 or older COPYRIGHT 2016 DANIEL J EDELMAN INC.

3 Key Findings Software Updates Almost two thirds of people update their software immediately Security and crash control are top reasons for updating software For those who do not update their software (a small subset), the top reason is they don t trust that the update is legitimate Perceptions around software updates are genuinely positive Passwords Fewer than one fourth of people use distinct passwords for each of their accounts Many people store their passwords where others can find them A majority of people do not update passwords regularly or frequently Phishing While almost three fourths of people say they can identify phishing s, more than one third believe they have been victims of phishing Four out of ten people would still open an from an unknown sender, with Millennials the most gullible

4 Software Updates COPYRIGHT 2016 DANIEL J EDELMAN INC. 4

5 Most people update their software when updates are first released 64% Tendency to Update Computer Software Showing total 30% 4% 1% Yes, I do It varies depending on what the update is/is for No, I don t I m not sure Q1: Do you typically update the software on your computer when new updates are released? A software update is a (generally free) download that provides fixes for features that aren't working as intended or for security issues, or that adds minor software enhancements or compatibility with other software or hardware. Software updates are typically available directly through the software program or via the software maker s website.

6 Among those who typically update their software, security and crash prevention are top determinants Reasons for Updating Software Showing those who typically update their software 68% 68% 62% 55% 36% 25% It is important to install updates to keep my computer safe and secure from hackers Updating ensures my software is free of bugs and runs more smoothly / crashes less often I want to make sure all my devices, softwares, programs, etc. remain compatible I want to make sure I have the latest and greatest features I assume I have to or else I I get sick of the reminders to would compromise the update my software effectiveness of my software Q3: You mentioned you typically update the software on your computer when new updates are released. Which, if any, are your reasons for doing so? Please select all that apply.

7 Among the 1 in 3 who update their software on a variable basis, the types of fixes/improvements provided in an update are a determining factor Decision-Making Criteria for Updating Software Showing those whose updating habits vary The fixes or improvements provided in the update 63% How busy I am at the time New features provided in the update 52% 52% The time it takes to download/install the update The software program The software functionality 47% 46% 46% The software provider 40% Other 4% Q2: What criteria do you consider when deciding whether or not to update your software? Please select all that apply.

8 Among the vast majority who typically update, a plurality choose to be prompted as updates become available Typical Software Update Methods Showing those who typically update their software I typically choose to be prompted when new software updates are available 41% If the software has the option to install updates automatically without me being prompted or having to take any action, I choose this option 34% It varies depending on the software I manually check for updates (e.g., via the menu option in the software itself or on the company's website) I didn t know there was more than one way to update software 3% 9% 12% Baby Boomers who typically update their software are more likely to choose automatic updates than Millennials (38% BB, 34% GX, 31% Mill) None of the above 0% Q5: How do you typically update your software?

9 Among those who typically update their software and choose to be prompted as updates become available, 1 in 3 update on the first notification; most require between 2 and 5 notifications Average Number of Notifications Needed Before Updating Showing those who typically update their software and choose to be prompted when updates are available 2-5 First notification 1 36% 2 39% Reminders 3 to 5 6 to 10 More than 10 I never update software on my computer I update software on my computer but I don't receive update notifications/prompts 2% 2% 0% 0% 21% Major generational decline in updating after one prompt: Millennials least likely to do so and Baby Boomers most likely (23% Mill vs 39% GX & 45% BB); Millennials are more likely to need 3-5 notifications than their older counterparts (30% Mill vs 21% GX & 12% BB) Q8: If you receive update notifications, approximately how many times (on average), do you need to see a prompt to update the software on your computer before you actually do it?

10 Of the small subset of respondents who do not typically update their software *, the # 1 reason cited is a concern an update may not be legitimate Reasons for Not Updating Software Showing those who do not typically update their software* I don't always know if an update is legitimate vs a virus/malware/from a hacker The timing of updates is often inconvenient (e.g., when I am in the middle of something) I don't understand what software updates do Updating takes too long / I don t have time Someone else updates my software for me I don t care about having up-to-date software I don't think there is a benefit to updating my software Installing updates can slow my computer down or make it crash I forget to actually install them I don't trust the software company providing the update 2% (2 respondents) 17% 17% 35% (31 respondents) 27% (24 respondents) 26% (23 respondents) 26% (23 respondents) 25% (22 respondents) 25% (22 respondents) 19% (17 respondents) (15 respondents) (15 respondents) Q6: You mentioned you typically don t update the software on your computer when new updates are released. Which, if any, are your reasons for not doing so? Please select all that apply. *Note: N is under 100, and therefore data is directional in nature

11 A majority are equally or more diligent in updating mobile devices vs computers Compared to their computer(s), consumers are 17% 35% More diligent Equally diligent 24% 18% Less diligent 48% Smartphone when it comes to installing updates on their Millennials are most likely to be more diligent in updating their smartphones (45% Mill, 34% GX, 20% BB) and more likely than Baby Boomers to be more diligent in updating their tablets (22% Mill vs 15% BB) 58% Tablet Q10: Compared to your computer(s), are you more or less diligent when it comes to installing updates on your?

12 People recognize the importance of software updates I Find Updating Software to be Showing total 78% value software updates Recognizing the value of updates is lowest among Millennials (72% Mill, 80% GX, 82% BB); 1 in 4 Millennials find updates somewhat inconvenient 3% 19% 20% 38% 21% A total nuisance. They interrupt my computer use, so I hardly ever accept software updates. Somewhat inconvenient. I usually delay software updates until it s absolutely necessary. Helpful. It reminds me that I need to update my software so I can continue to be productive. Important. Having up-to-date software helps me protect my files and personal identity. Q9: Please complete the following sentence with the answer that best matches your opinion: I find updating software to be? Absolutely critical. I never want to put my personal or professional information at risk.

13 But general knowledge is relatively low Baby boomers are less likely than their younger counterparts to know know how to check if software needs to be updated (49% BB, 55% GX, 58% Mill) Software Opinions Showing total Total Agree 54% 51% 48% 24% 22% Strongly agree Somewhat agree Neither agree nor disagree Somewhat disagree Strongly disagree 32% 22% 20% 26% 30% 16% 26% 25% 25% 23% 16% 14% 11% 7% 8% I know how to check if any of the software on a computer needs to be updated I have a clear understanding of what software updates do and what the benefits of updating are I update security software more often than other softwares 9% 8% 15% 14% 24% 33% 25% 27% I don t really understand how software works in general 25% 20% Downloading software updates can make my computer more vulnerable Q7: To what extent would you agree or disagree with each of the following statements?

14 Passwords COPYRIGHT 2016 DANIEL J EDELMAN INC.14

15 Consumers have lots of accounts to keep track of Number of Password-Protected Accounts Showing total 68% 21% 1% 9% None 1 to to 50+ Not sure I lost track! Q11: Approximately how many password-protected accounts do you have? Please consider accounts such as , banking, entertainment (e.g., Netflix, social media), shopping, etc.

16 3 in 4 recycle their passwords across various accounts Password Selection Method Showing those with password-protected accounts 28% 31% Millennials are least likely to use different passwords for each account (18% Mill, 26% GX, 27% BB) 24% 17% I generally use the same password everywhere I use unique passwords for my most sensitive accounts (e.g., banking, credit card accounts, etc.) but for the most part I use the same passwords for my passwordprotected accounts I may use the same password on a few sites, but for the most part, I have unique passwords for my password-protected accounts I use a different password for each of my online accounts Q12: When signing up for password-protected accounts, which of the following best characterizes how you choose your passwords?

17 More than half (53%) use note-based methods to keep track of passwords Ways of Keeping Track of Account Passwords Showing those with password protected accounts 50% Note-based methods 38% Note-based methods 12% 11% 10% Memory - I can easily remember my password(s) I keep a printed or handwritten list close to my computer I save my passwords in a document on my computer I use password management software I keep a list in the Notes app on my cell phone Q13: How do you keep track of the password(s) for your password-protected accounts? (Please select all that apply)

18 Millennials favor memory methods, while Baby Boomers favor note-based Ways of Keeping Track of Account Passwords Showing those with password-protected accounts by generations, significant differences only Millennials Gen X Baby Boomers 69% 52% 35% 56% 68% of Baby Boomers use note-based password management (a handwritten list, password document saved on their computer, or list in the notes app of their phone) vs 49% of Gen X and 42% of Millennials 29% 22% 17% 9% 5% Memory - I can easily remember my password(s) I keep a printed or handwritten list close to my computer I keep a list in the Notes app on my cell phone Q13: How do you keep track of the password(s) for your password-protected accounts? (Please select all that apply)

19 The most common criteria in selecting passwords is security Baby Boomers are most likely to rely on website and app requirements to select their passwords; Gen X is least likely, with Millennials falling in-between (44% Mill, 36% GX, 48% BB) Password-Selection Criteria Showing those with password-protected accounts 49% 43% 41% 40% 39% 6% 5% 5% Secure (e.g. a mixture of letters, numbers and special characters, and more than 10 characters) Meets the advice or requirements of the website or app Meaningful to me, but not to anyone else Hard for others to guess Easy to remember No special characters Sentences instead of words Short (no more than six characters) Q14: Which of the following criteria do you consider when selecting a new password? (Select all that apply)

20 But no matter the standard, the majority doesn t update passwords regularly or frequently Frequency of Password Changes Showing those with password-protected accounts 34% 28% Millennials are most likely to admit they rarely change their passwords (39% Mill, 29% GX, 33% BB); Gen X more likely to change passwords regularly than Millennials (31% GX, 24% Mill) 14% 10% 8% 1% 4% Rarely (less often than once a year on average) Regularly (on average at least once a year) Frequently (on average at least once every month) Only when prompted by the site Only if I forget my password and have to reset it It depends on the account Never Q15: On average, how often do you change your passwords?

21 Phishing COPYRIGHT 2016 DANIEL J EDELMAN INC.21

22 Most believe they can identify phishing Millennials are most confident Unsure No 11% 18% Millennials are considerably more likely to believe they can identify a phishing than their older counterparts (80% Mill, 69% GX, 63% BB) 70% Yes Perceived Ability to Identify Phishing s Showing total Q20: Do you believe you are generally able to tell a phishing from a legitimate ? Phishing is a form of fraud in which the attacker tries to learn information such as login credentials or account information by masquerading as a legitimate, reputable entity or person in , IM or other communication channels.

23 Yet nearly 4 in 10 believe they may have been victims of phishing 38% say YES Phishing Victimization Showing total Millennials are more likely than their older counterparts to say they have not been victimized (49% Mill, 41% GX, 40% BB) 43% 19% 19% 19% Yes, I know I have Yes, I believe I have but am not certain I have no idea No, I do not believe I have ever been a phishing victim Q22: Do you believe you have ever been the victim of phishing?

24 With s, people are suspicious of many different items; whether or not the sender is known is a key indicator Criteria Used to Determine Legitimacy Showing those who believe they can identify a phishing 67% 66% 63% 58% 58% 54% 50% 49% 46% Whether or not I know the sender address of sender requests personal information Subject line Name or title of sender discusses money, banking, or finances Presence of unrequested attachments Presence of unrequested links Address of unrequested links Q21: What criteria do you use to determine whether an is legitimate or not? Please select all that apply.

25 But 4 in 10 would open an from an unknown sender Millennials are most likely to take actions that may put them at risk 41% say YES Behavior Around Opening s From Unknown Senders Showing total 44% 22% 8% 10% 15% 1% Yes, I always open the s I receive Yes, but only if the subject line or preview content interests me Yes, but only if the appears legitimate despite the fact that I do not personally know the sender Q16: Do you typically open s you receive from unknown senders? Yes, for another reason Only by mistake No, I never open s from unknown senders More than half of Millennials open s from unknown senders (52% Mill, 38% GX, 33% BB); Half of Baby Boomers never open s from unknown senders, even by mistake (34% Mill, 46% GX, 50% BB)

26 1 in 3 would be more likely to open an if it appeared to be from a service they use a common ploy among phishers Scenarios That Would Increase Likelihood of Opening s From Unknown Senders Showing total If the sender appeared to be affiliated with a service I already use (e.g., my bank, a social media site I belong to, etc.) 33% If the sender seemed important (for example, s from job recruiters, etc.) 25% If the subject was about re-setting an account password I want to make sure no one has hacked my accounts. If the subject line or preview discussed financial matters I want to make sure I don t accidentally ignore something important. If it were sent to my work I want to be sure I m on top of all my work correspondence.* It was sent to my personal I m always connecting with new people and want to make sure I don t miss any opportunities. 10% 10% 9% 15% If there was an attachement included 4% None of the above 41% Q17: What would make you more likely to open an from an unknown sender? Please select all that apply *Answer choice asked of those who work full or part time only

27 Millennials are the most likely to open from an unknown sender Scenarios That Would Increase Likelihood of Opening s From Unknown Senders Showing total by generations Millennials Gen X Baby Boomers 53% 39% 37% 43% 30% 29% 24% 21% 26% 14% 12% 12% 13% 8% 8% 15% 11% 4% 12% 9% 8% 8% 4% 2% If the senderif the sender seemedif the subject wasif the subject line orif it was sent to myif it was sent to myif there was an appeared to beimportant about re-setting an previewwork * personal attachment included affiliated with a account password discussed financial service I already use matters None of the above Q17: What would make you more likely to open an from an unknown sender? Please select all that apply

28 Nearly half of those who would open an from an unknown sender would also click on a link in the This rises to more than half of Millennials 47% say YES Behavior Around Clicking Links in s From Unknown Senders Showing those who open s from unknown senders Among those who open s from unknown senders, Millennials are most likely to click links present (54% Mill, 49% GX, 37% BB) 27% 39% 13% 13% 7% Yes, I always click on the links in s I receive Yes, but only if the linked site or content interests me Yes, but only if the appears legitimate despite the fact that I do not personally know the sender Only by mistake No, I never click on links in s from unknown senders Q18: Do you typically click on links in s you receive from unknown senders?

29 4 in 10 would open an attachment Again, half amongst Millennials Behavior Around Opening Attachments in s From Unknown Senders Showing those who open s from unknown senders 40% say YES Among those who open s from unknown senders, Millennials are nearly twice as likely as Baby Boomers to open attachments present (50% Mill, 42% GX, 26% BB) 50% 24% 6% 10% 10% Yes, I always open the attachments in s I receive Yes, but only if the subject line, the file name or the attachment description interests me Yes, but only if the appears legitimate despite the fact that I do not personally know the sender Only by mistake No, I never open attachments in s from unknown senders Q19: Do you typically open attachments you receive in s from unknown senders?

30 Thank You