National Institute of Standards and Technology における超伝導研究及び生活

Secrets and lies.

Prior studies have shown that the behaviours and attitudes of Internet users influence the likelihood of being victimised by phishing attacks. Many scammers design a step-by-step approach to phishing in order to gain the potential victim’s trust and convince them to take the desired actions. It is important to understand which behaviours and attitudes can influence following the attacker in each step of a phishing scam. This will enable us to identify the root causes of phishing and to develop specific mitigation plans for each step of the phishing process and to increase prevention points. This study investigates to what extent people’s risk-taking and decision-making styles influence the likelihood of phishing victimisation in three specific phishing steps. We asked participants to play a risk-taking game and to answer questions related to two psychological scales to measure their behaviours, and then conducted a simulated phishing campaign to assess their phishability throughout the three phishing steps selected. We find that the attitude to risk-taking and gender can predict users’ phishability in the different steps selected. There are however other possible direct and indirect behavioural factors that could be investigated in future studies. The results of this study and the model developed can be used to build a comprehensive framework to prevent the success of phishing attempts, starting from their root causes.

https://biblio.ugent.be/publication/8702902/file/8703487.pdf

Phishing Happens Beyond Technology: The Effects of Human Behaviors and Demographics on Each Step of a Phishing Process

From email to online banking, passwords are an essential component of modern internet use. Yet, users do not always have good password security practices, leaving their accounts vulnerable to attack. We conducted a study which combines self-report survey responses with measures of actual online behavior gathered from 134 participants over the course of six weeks. We find that people do tend to re-use each password on 1.7-3.4 different websites, they reuse passwords that are more complex, and mostly they tend to re-use passwords that they have to enter frequently. We also investigated whether self-report measures are accurate indicators of actual behavior, finding that though people understand password security, their self-reported intentions have only a weak correlation with reality. These findings suggest that users manage the challenge of having many passwords by choosing a complex password on a website where they have to enter it frequently in order to memorize that password, and then re-using that strong password across other websites.

Replication Materials for SOUPS 2016 paper "Understanding Password Choices: How Frequently Entered Passwords are Re-used Across Websites"

Toward a stage theory of the development of employees’ information security behavior

The end-user has frequently been identified as the weakest link; however, motivated by the fact that different users react differently to the same stimuli, identifying the reasons behind variations in security behavior and why certain users could be “at risk” more than others is a step toward protecting and defending users against security attacks. This paper aims to explore the effect of personality trait variations (through the Big Five Inventory [BFI]) on users’ risk level of their intended security behaviors. In addition, age, gender, service usage and information technology (IT) proficiency are analyzed to identify what role and impact they have on behavior.,The authors developed a quantitative-oriented survey that was implemented online. The bi-variate Pearson two-tailed correlation was used to analyze survey responses.,The results obtained by analyzing 538 survey responses suggest that personality traits do play a significant role in affecting users’ security behavior risk levels. Furthermore, the results suggest that BFI score of a trait has a significant effect as users’ online personality is linked to their offline personality, especially in the conscientiousness personality trait. Additionally, this effect was stronger when personality was correlated with the factors of IT proficiency, gender, age and online activity.,The contributions of this paper are two-fold. First, with the aid of a large population sample, end-users’ security practice is assessed from multiple domains, and relationships were found between end-users’ risk-taking behavior and nine user-centric factors. Second, based upon these findings, the predictive ability for these user-centric factors were evaluated to determine the level of risk a user is subject to from an individual behavior perspective. Of 28 behaviors, 11 were found to have a 60 per cent or greater predictive ability, with the highest classification of 92 per cent for several behaviors. This provides a basis for organizations to use behavioral intent alongside personality traits and demographics to understand and, therefore, manage the human aspects of risk.

/pdf/identifying-and-predicting-the-factors-affecting-end-users-2zoeorgz4t.pdf

Identifying and predicting the factors affecting end-users’ risk-taking behavior

With the wide spread use of Internet, comes an increase in Information Security threats. To protect against these threats, technology alone have been found not enough as it can be misused by users and become vulnerable to various threats, thus, losing its usefulness. This is evident as users tend to use weak passwords, open email attachments without checking and do not set correct security settings. However, especially with the continuously evolving threat landscape, one cannot assume that users are always motivated to learn about Information Security and practice it. Actually, there are situations of an aware user who knows how to protect himself but, simply, chooses not to, because they do not care, usability problems or because they do not consider themselves as targets. Thus, understanding human security behavior is vital for ensuring an efficient Information Security environment that cannot depend on technology only. Although a number of psychological theories and models, such as Protection Motivation Theory and Technology Acceptance Model, were used in the literature to interpret these behaviors, they tend to assess users' intensions rather than actual behavior. The aim of this paper is to understand and assess these behaviors from a holistic view by finding the significant factors that influence them and how to best assist users to protect themselves. To accomplish this, a systematic literature review was conducted where relevant literature was sought in a number of academic digital databases. As a result, several key behavioral influencers were identified to be essential to consider when educating and directing users' security behavior. Further to that, a number of Information Security awareness approaches were proposed that may transform the user from being ill-informed into a security-minded user who is able to make an informed decision.

Information security behavior: Recognizing the influencers

The risk of sensitive information disclosure and modification through the use of online services has increased considerably and may result in significant damage. As the management and assessment of such risks is a well-known discipline for organizations, it is a challenge for users from the general public. Users have difficulties in using, understanding and reacting to security-related threats. Moreover, users only try to protect themselves from risks salient to them. Motivated by the lack of risk assessment solutions and limited impact of awareness programs tailored for users of the general public, this paper aims to develop a structured approach to help in protecting users from threats and vulnerabilities and, thus, reducing the overall information security risks. By focusing on the user and that different users react differently to the same stimuli, the authors developed a user-centric risk assessment and response framework that assesses and communicates risk on both user and system level in an individualized, timely and continuous way. Three risk assessment models were proposed that depend on user-centric and behavior-related factors when calculating risk. This framework was evaluated using a scenario-based simulation of a number of users and results analyzed. The analysis demonstrated the effectiveness and feasibility of the proposed approach. Encouragingly, this analysis provided an indication that risk can be assessed differently for the same behavior based upon a number of user-centric and behavioral-related factors resulting in an individualized granular risk score/level. This granular risk assessment, provided a more insightful evaluation of both risk and response. The analysis of results was also useful in demonstrating how risk is not the same for all users and how the proposed model is effective in adapting to differences between users offering a novel approach to assessing information security risks.

/pdf/the-design-and-evaluation-of-a-user-centric-information-y25v5o2000.pdf

The Design and Evaluation of a User-Centric Information Security Risk Assessment and Response Framework

Due to the advancements of high-speed networks, mobile edge computing (MEC) has received significant attention to bring processing and storage resources in client’s proximity. The MEC is also a form of Edge Network or In-network computing where the resources are brought closer to the user end (edge) of the network while increasing QoE. On the other hand, the increase in the utilization of the internet of things (IoT) gadgets results in the generation of cybersecurity issues. In recent times, the advent of machine learning (ML) and deep learning (DL) techniques paves way in the detection of existing traffic conditions, data offloading, and cyberattacks in MEC. With this motivation, this study designs an effective deep learning based data offloading and cyberattack detection (DL-DOCAD) technique for MEC. The goal of the DL-DOCAD technique is to enhance the QoE in MEC systems. The proposed DL-DOCAD technique comprises traffic prediction, data offloading, and attack detection. The DL-DOCAD model applies a gated recurrent unit (GRU) based predictive model for traffic detection. In addition, an adaptive sampling cross entropy (ASCE) approach is employed for the maximization of throughput and decision making for offloading users. Moreover, the birds swarm algorithm based feed forward neural network (BSA-FFNN) model is used as a detector for cyberattacks in MEC. The utilization of BSA to appropriately tune the parameters of the FFNN helps to boost the classification performance to a maximum extent. A comprehensive set of simulations are performed and the resultant experimental values highlight the improved performance of the DL-DOCAD technique with the maximum detection accuracy of 0.992.

Manal Alohali

Papers

Identifying and predicting the factors affecting end-users’ risk-taking behavior

Information security behavior: Recognizing the influencers

The Design and Evaluation of a User-Centric Information Security Risk Assessment and Response Framework

Enhancing quality of experience in mobile edge computing using deep learning based data offloading and cyberattack detection technique

Identifying the Factors Affecting End-Users’ Risk-Taking Behavior.