Another Week at the Office (AWATO) – An Interactive Serious Game for Threat Modeling Human Factors

Ferro, Lauren S.; Sapio, Francesco

doi:10.1007/978-3-030-50309-3_9

Cited by 5 publications

(8 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Organizational safety culture, with its norms and values, guides employee behavior. Employees adapt their behavior by observing the actions and behaviors of others (Ferro and Sapio, 2020). For example, in a company where sharing passwords is common, an employee will typically accept this practice without questioning it and conform to the established norm.…”

Section: Socio-cultural Factorsmentioning

confidence: 99%

“…Playful approaches, or so-called gamification, are entertaining and, thus, increase motivation (Alsawaier, 2018), as employees receive direct feedback on their behavior. Various providers offer games (Ferro and Sapio, 2020) or so-called cybersecurity escape rooms (e.g. Infosequre, 2020;Sectricity, 2020).…”

Section: Implications For Practicementioning

confidence: 99%

“…A quarter of all small enterprises in Switzerland have already encountered cyberattacks (Peter et al, 2020). Cyber criminals infiltrate networks to cause damage, make financial gains, and/or steal sensitive data, and cyberattacks can lead to reputational damage, financial losses, or even the complete closure of an enterprise (Ferro and Sapio, 2020). Addressing the resulting damages requires significant effort.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Employee behavior: the psychological gateway for cyberattacks

Aschwanden,

Messner,

Höchli

et al. 2024

OCJ

View full text Add to dashboard Cite

PurposeCyberattacks have become a major threat to small and medium-sized enterprises. Their prevention efforts often prioritize technical solutions over human factors, despite humans posing the greatest risk. This article highlights the importance of developing tailored behavioral interventions. Through qualitative interviews, we identified three persona types with different psychological biases that increase the risk of cyberattacks. These psychological biases are a basis for creating behavioral interventions to strengthen the human factor and, thus, prevent cyberattacks.Design/methodology/approachWe conducted structured, in-depth interviews with 44 employees, decision makers and IT service providers from small and medium-sized Swiss enterprises to understand insecure cyber behavior.FindingsA thematic analysis revealed that, while knowledge about cyber risks is available, no one assumes responsibility for employees’ and decision makers’ behavior. The interview results suggest three personas for employees and decision makers: experts, deportees and repressors. We have derived corresponding biases from these three persona types that help explain the interviewees’ insecure cyber behavior.Research limitations/implicationsThis study provides evidence that employees differ in their cognitive biases. This implies that tailored interventions are more effective than one-size-fits7-all interventions. It is inherent in the idea of tailored interventions that they depend on multiple factors, such as cultural, organizational or individual factors. However, even if the segments change somewhat, it is still very likely that there are subgroups of employees that differ in terms of their misleading cognitive biases and risk behavior.Practical implicationsThis article discusses behavior directed recommendations for tailored interventions in small and medium-sized enterprises to minimize cyber risks.Originality/valueThe contribution of this study is that it is the first to use personas and cognitive biases to understand insecure cyber behavior, and to explain why small and medium-sized enterprises do not implement behavior-based cybersecurity best practices. The personas and biases provide starting points for future research and interventions in practice.

show abstract

Section: Socio-cultural Factorsmentioning

confidence: 99%

Section: Implications For Practicementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Employee behavior: the psychological gateway for cyberattacks

Aschwanden,

Messner,

Höchli

et al. 2024

OCJ

View full text Add to dashboard Cite

show abstract

“…Some recent examples of SGs, such as 'Riskio' [25], 'CybAR' [2], 'AWATO' [18] and 'PROTECT' [21] look to provide innovation, incorporate new technologies, or tackle areas of knowledge that have seen little attention in this form. CybAR utilises augmented reality within a mobile application to increase awareness of different cyber attack forms.…”

Section: Related Workmentioning

confidence: 99%

SCIPS: A serious game using a guidance mechanic to scaffold effective training for cyber security

O’Connor

Hasshu

Bielby

et al. 2021

Information Sciences

View full text Add to dashboard Cite

“…After examining and discussing the relevant literature, we theorized that human factors could be threat modeled in a similar way to how attackers behavior is. In this way, be began to consider types of behaviors that were discussed within the literature and how they may align with STRIDE elements, as presented in Table 1 taken from Ferro and Sapio [16].…”

Section: Stride-hfmentioning

confidence: 99%

A Human Factor Approach to Threat Modeling

Ferro

Marrella

Catarci

2021

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Cybersecurity has many challenges to address to ensure the protection of a system from an attacker. Consequently, strategies have been developed to address a system's weakness that an attacker may try to exploit. However, while these approaches may prevent an attacker getting in from the outside, they do not consider the user's actions from the inside and how their behavior may inadvertently allow an attack to take place. This paper presents a human-centered approach to threat modeling titled STRIDE-HF, which extends an existing threat modeling framework (STRIDE).

show abstract

Another Week at the Office (AWATO) – An Interactive Serious Game for Threat Modeling Human Factors

Cited by 5 publications

References 13 publications

Employee behavior: the psychological gateway for cyberattacks

Employee behavior: the psychological gateway for cyberattacks

SCIPS: A serious game using a guidance mechanic to scaffold effective training for cyber security

A Human Factor Approach to Threat Modeling

Contact Info

Product

Resources

About