Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Using Phishing Experiments and Scenario-based Surveys to Understand Security Behaviours in Practice
KTH, School of Electrical Engineering (EES), Industrial Information and Control Systems.
KTH, School of Electrical Engineering (EES), Industrial Information and Control Systems.
KTH, School of Electrical Engineering (EES), Industrial Information and Control Systems.
Svenska Kraftnät, Swedish National Grid.
2013 (English)In: Proceedings of the European Information Security Multi-Conference: (EISMC 2013), 2013, 79-90 p.Conference paper, Published paper (Refereed)
Abstract [en]

Threats from social engineering can cause organisations severe damage if they are not considered and managed. In order to understand how to manage those threats, it is important to examine reasons why organisational employees fall victim to social engineering. In this paper, the objective is to understand security behaviours in practice by investigating factors that may cause an individual to comply with a request posed by a perpetrator. In order to attain this objective, we collect data through a scenario-based survey and conduct phishing experiments in three organisations. The results from the experiment reveal that the degree of target information in an attack increases the likelihood that an organisational employee fall victim to an actual attack. Further, an individual’s trust and risk behaviour significantly affects the actual behaviour during the phishing experiment. Computer experience at work, helpfulness and gender (females tend to be less susceptible to a generic attack than men), has a significant correlation with behaviour reported by respondents in the scenario-based survey. No correlation between the performance in the scenario-based survey and experiment was found. We argue that the result does not imply that one or the other method should be ruled out as they have both advantages and disadvantages which should be considered in the context of collecting data in the critical domain of information security. Discussions of the findings, implications and recommendations for future research are further provided.

Place, publisher, year, edition, pages
2013. 79-90 p.
Keyword [en]
Social engineering, phishing, security behaviours, survey method, experiment.
National Category
Electrical Engineering, Electronic Engineering, Information Engineering
Identifiers
URN: urn:nbn:se:kth:diva-147377Scopus ID: 2-s2.0-84926144305ISBN: 978-1-84102-345-8 (print)OAI: oai:DiVA.org:kth-147377DiVA: diva2:729936
Conference
European Information Security Multi-Conference (EISMC 2013); Lisbon, Portugal, May 8-10, 2013
Note

QC 20140626

Available from: 2014-06-26 Created: 2014-06-26 Last updated: 2016-11-28Bibliographically approved
In thesis
1. Shaping information security behaviors related to social engineering attacks
Open this publication in new window or tab >>Shaping information security behaviors related to social engineering attacks
2016 (English)Doctoral thesis, comprehensive summary (Other academic)
Abstract [en]

Today, few companies would manage to continuously stay competitive without the proper utilization of information technology (IT). This has increased companies’ dependency of IT and created new threats that need to be addressed to mitigate risks to daily business operations. A large extent of these IT-related threats includes hackers attempting to gain unauthorized access to internal computer networks by exploiting vulnerabilities in the behaviors of employees. A common way to exploit human vulnerabilities is to deceive and manipulate employees through the use of social engineering. Although researchers have attempted to understand social engineering, there is a lack of empirical research capturing multilevel factors explaining what drives employees’ existing behaviors and how these behaviors can be improved. This is addressed in this thesis.

The contribution of this thesis includes (i) an instrument to measure security behaviors and its multilevel determinants, (ii) identification of multilevel variables that significantly influence employees’ intent for behavior change, (iii) identification of what behavioral governance factors that lay the foundation for behavior change, (iv) identification that national culture has a significant effect on how organizations cope with behavioral information security threats, and (v) a strategy to ensure adequate information security behaviors throughout an organization.

This thesis is a composite thesis of eight papers. Paper 1 describes the instrument measuring multilevel determinants. Paper 2 and 3 describes how security knowledge is established in organizations, and the effect on employee information security awareness. In Paper 4 the root cause of employees’ intention to change their behaviors and resist social engineering is described. Paper 5 and 8 describes how the instrument to measure social engineering security behaviors was developed and validated through scenario-based surveys and phishing experiments. Paper 6 and 7 describes experiments performed to understand reason to why employees fall for social engineering. Finally, paper 2, 5 and 6 examines the moderating effect of national culture.

Place, publisher, year, edition, pages
KTH Royal Institute of Technology, 2016. xv, 156 p.
Series
TRITA-EE, ISSN 1653-5146 ; 2016:061
Keyword
Information security, Behavioral information security, Social engineering, Phishing, Measuring information security behaviors, Information security governance, Experiments, National culture, Mixed method research design, Quantitative methods
National Category
Other Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Industrial Information and Control Systems
Identifiers
urn:nbn:se:kth:diva-186113 (URN)978-91-7595-969-6 (ISBN)
Public defence
2016-05-27, L1, Drottning Kristinas väg 30, KTH Campus, Stockholm, 10:00 (English)
Opponent
Supervisors
Note

QC 20160503

Available from: 2016-05-03 Created: 2016-05-02 Last updated: 2016-05-20Bibliographically approved

Open Access in DiVA

No full text

Scopus

Search in DiVA

By author/editor
Rocha Flores, WaldoHolm, HannesSvensson, Gustav
By organisation
Industrial Information and Control Systems
Electrical Engineering, Electronic Engineering, Information Engineering

Search outside of DiVA

GoogleGoogle Scholar

isbn
urn-nbn

Altmetric score

isbn
urn-nbn
Total: 115 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf