A Summary of Survey Methodology Best Practices for Security and Privacy Researchers

“Given a choice between dancing pigs and security, users will pick dancing pigs every time,” warns an oft-cited quote from well-known security researcher Bruce Schneier [132]. This issue of understanding how to make security tools and mechanisms work better for humans (often categorized as usability, broadly construed) has become increasingly important over the past 17 years [7], [159], as illustrated by the growing body of research. Usable security and privacy research has improved our understanding of how to help users stay safe from phishing attacks [12], [62], [77], [105], [109], [129], [138], create strong passwords [39], [73], [130], [152], and control access to their accounts [16], [33], [93], [139], as just three examples. One key technique for understanding and improving how human decision making affects security is the gathering of self-reported data from users. This data is typically gathered via survey and interview studies, and serves to inform the broader security and privacy community about user needs, behaviors, and beliefs. The quality of this data, and the validity of subsequent research results, depends on the choices researchers make when designing their experiments. Contained here is a set of essential guidelines for conducting self-report usability studies distilled from prior work in survey methodology and related fields. Other fields that rely on selfreport data, such as the health and social sciences, have established guidelines and recommendations for collecting high quality self-report data [10], [42], [55], [57], [70], [82], [98], [103], [119], [136], [148], [149].