Individual information security, user behaviour and cyber victimisation: An empirical study of social networking users

Abstract

While extant literature on privacy in social networks is plentiful, issues pertaining to information security remain largely unexplored. This paper empirically examines the relationship between online victimisation and users' activity and perceptions of personal information security on social networking services (SNS). Based on a survey of active users, we explore how behavioural patterns on social networks, personal characteristics and technical efficacy of users impact the risk of facing online victimisation. Our results suggest that users with high-risk propensity are more likely to become victims of cybercrime, whereas those with high perceptions of their ability to control information shared on SNS are less likely to become victims. The study shows that there is a negative and statistically significant association between multipurpose dominant SNS (e.g. Facebook, Google+) usage and victimisation. However, activity on the SNS for knowledge exchange (e.g. LinkedIn, Blogger) has a positive and statistically significant association with online victimisation. Our results have implications for practice as they inform the social media industry that protection of individual information security on SNS cannot be left entirely to the user. The importance of user awareness in the context of social technologies plays an important role in preventing victimisation, and social networking services should provide adequate controls to protect personal information.

User characteristics that influence judgment of social engineering attacks in social networks

“…4). Yet, among many studies [12,23,24,26,30] that have empirically tested the impact of the Internet and computer knowledge in preventing users from getting phished, only two studies [12,30] found this relation to be significant. This contradictory result might imply that user internet or computer knowledge is a very general concept whose impact on safe or risky behaviour could be hard to measure.…”

“…Notably, some research found no correlation between perceived risk and users' behaviour toward either email phishing [30], or social network victimisation [26]. This contradicts the view that the individual's perceived severity of negative consequences predicts their detection or avoidance behaviour of online threats.…”

“…The individual's level of network engagement can be determined by a number of factors such as number of friendship connections [7], or time spent in the network [26]. High levels of social media usage have been found to make users more exposed to online threats in knowledge exchange networks [26].…”

“…It was found recently that among many examined demographic features, computer usage experience, as well as gender, are the most significant predictors of user's detection ability of webbased phishing attacks [12]. Yet, in the context of victimisation in social networks, selfconfidence in computer skills might lead to risky behaviour as a positive relationship has been found between higher computer skills and user victimisation [26].…”

Recommendations Based on Social Links

“…However, the fun, useful and innovative nature of social media frequently makes the users to ignore various risks about revealing their personal and social information online. Several studies [47,1,104] reported that online users are becoming more and more conscious and protective about their privacy. A study conducted in 2005 [47] used a sample of 4540 users who shared identifiable names, phone numbers, personal images and characteristics (e.g.…”