  Researchers are increasingly exploring how gender, culture, and other
sociodemographic factors correlate with user computer security and privacy
behaviors. To more holistically understand relationships between these factors
and behaviors, we make two contributions. First, we broadly survey existing
scholarship on sociodemographics and secure behavior (151 papers) before
conducting a focused literature review of 47 papers to synthesize what is
currently known and identify open questions for future research. Second, by
incorporating contemporary social and critical theories, we establish
guidelines for future studies of sociodemographic factors and security
behaviors that address how to overcome common pitfalls. We present a case study
to demonstrate our guidelines in action, at-scale, that conduct a measurement
study of the relationships between sociodemographics and de-identified,
aggregated log data of security and privacy behaviors among 16,829 users on
Facebook across 16 countries. Through these contributions, we position our work
as a systemization of a lack of knowledge (SoLK). Overall, we find
contradictory results and vast unknowns about how identity shapes security
behavior. Through our guidelines and discussion, we chart new directions to
more deeply examine how and why sociodemographic factors affect security
behaviors.
