Wisecrackers: A theory‐grounded investigation of phishing and pretext social engineering threats to information security

Abstract

The collection and dissemination of information about people by businesses and governments is ubiquitous. One of the main threats to people's privacy comes from human carelessness with this information, yet little empirical research has studied behaviors associated with information carelessness and the ways that people exploit this vulnerability. The studies that have investigated this important question have not been grounded in theory. In particular, the extant literature reveals little about social engineering threats and the reasons why people may or may not fall victim. Synthesizing theory from the marketing literature to explain consumer behavior, an empirical field study was conducted to see if factors that account for successful marketing campaigns may also account for successful social engineering attacks.

Predicting the performance of users as human sensors of security threats in social media

“…In this respect, the related work on user susceptibility to phishing and other semantic social engineering attacks is highly relevant. Predicting whether a user will be deceived into clicking on a fraudulent link or not has traditionally been studied in the realm of behavioural science, where different studies have found that higher degrees of normative, affective and continuance commitment, obedience to authority and trust (M. Workman, 2008), submissiveness (I. M. A. Alseadon, 2014), neurotic behaviour (T. Halevi, 2013) and conscientiousness (T. Halevi et al, 2015) all correlate with high susceptibility to phishing.…”

Social engineering in social networking sites: Affect-based model

“…The social engineer will determine which tactic would be most suitable and successful for tricking the victim. This task also involves developing a good plan to reach that goal, which can include "pretexting," in which a social engineer creates a setting designed to persuade the victim to fall for the trick [35]. It also involves determining which steps and phases should be taken to reach the goal, and determining the best time to launch each step.…”

Gestão da Informação e do Conhecimento no âmbito das práticas de Segurança da Informação: o fator humano nas organizações

“…Agindo dessa maneira todos são beneficiados, uma vez que da parte dos colaboradores haverá o compromisso com a proteção das informações sensíveis da organização; e da parte da organização haverá esforços para fornecer algum tipo de proteção (WORKMANN, 2007).…”

“…Conforme Workmann (2007), quando ocorre internamente o ato de percepção, as ações e reações podem ser alteradas e nesse caso o instrumento promotor da mudança é a comunicação persuasiva. Por isso mesmo, o fator persuasão é determinante do comportamento das pessoas frente a situações de ameaça.…”

“…Existem algumas características que são vinculadas à rota periférica de persuasão e podem ser descritas como reciprocidade (compromisso normativo), consistência (compromisso de continuidade), prova social (comprometimento efetivo), simpatia (ganho de confiança), autoridade (geração de medo) e escassez (percepção da falta de certos itens) (WORKMANN, 2007). Além da busca de sinais de comportamento adverso em potenciais invasores, a preocupação com ataques reais precisa sempre ser mantida.…”