Online social network security awareness: mass interpersonal persuasion using a Facebook app

an article by Ehinome Ikhalia, Alan Serrano, David Bell and Panos Louvieris (Brunel University London, Uxbridge, UK) published in Information Technology & People Volume 32 Issue 5 (2019)

Abstract

Purpose
Online social network (OSN) users have a high propensity to malware threats due to the trust and persuasive factors that underpin OSN models. The escalation of social engineering malware encourages a growing demand for end-user security awareness measures. The purpose of this paper is to take the theoretical cybersecurity awareness model TTAT-MIP and test its feasibility via a Facebook app, namely social network criminal (SNC).

Design/methodology/approach
The research employs a mixed-methods approach to evaluate the SNC app. A system usability scale measures the usability of SNC. Paired samples t-tests were administered to 40 participants to measure security awareness – before and after the intervention. Finally, 20 semi-structured interviews were deployed to obtain qualitative data about the usefulness of the App itself.

Findings
Results validate the effectiveness of OSN apps utilising a TTAT-MIP model – specifically the mass interpersonal persuasion (MIP) attributes. Using TTAT-MIP as a guidance, practitioners can develop security awareness systems that better leverage the intra-relationship model of OSNs.

Research limitations/implications
The primary limitation of this study is the experimental settings. Although the results testing the TTAT-MIP Facebook app are promising, these were set under experimental conditions.

Practical implications
SNC enable persuasive security behaviour amongst employees and avoid potential malware threats. SNC support consistent security awareness practices by the regular identification of new threats which may inspire the creation of new security awareness videos.

Social implications
The structure of OSNs is making it easier for malicious users to carry out their activities without the possibility of detection. By building a security awareness programme using the TTAT-MIP model, organisations can proactively manage security awareness.

Originality/value
Many security systems are cumbersome, inconsistent and non-specific. The outcome of this research provides organisations and security practitioners with a framework for designing and developing proactive and tailored security awareness systems.

---

Persuasion: How phishing emails can influence users and bypass security measures

an article by AnaFerreira and SoraiaTeles (University of Porto, Portugal) published in International Journal of Human-Computer Studies Volume 125 (May 2019)

Highlights

• Phishing email subject lines contain high and diverse persuasive power in just a few words.
• The paper builds on the well-known and foundational work of Cialdini's (2007), Gragg's (2003) and Stajano and Wilson (2011) to derive a unique list of Principles of Persuasion in social engineering, resulting from the application of the relational method by two independent researchers.
• The study of the relations between existing persuasion principles was applied to the content analysis, by two independent researchers, of a random sample of phishing emails subject lines (N = 194), dated from 2008 to 2017. A thematic content analysis and a sample characterization in terms of visual elements and targeted content, revealed that the most prominent persuasion principles were ‘Authority’, ‘Strong Affect’, ‘Integrity’ and ‘Reciprocation’. The persuasion principle ‘Strong Affect’ was the one containing the larger percentage of references with the presence of visual elements. The use of the pronoun ‘you’ and ‘your’ was more evident for the categories ‘Strong Affect’ and ‘Authority’, while the employment of the pronouns ‘we, us, our’ was more expressive in the ‘Reciprocation’ principle.
• This paper presents a method on the way to define a tool for automated identification of principles of human persuasion in social engineering, within phishing emails. Future solutions should focus on the use of socio-technical aspects related mainly to a small number of persuasion principles (‘Authority’ and ‘Distraction – Strong Affect’), which seem to be the most commonly used in phishing emails.

Abstract

Phishing is a very dangerous form of social engineering with the aim to deceive people into disclosing private/confidential information.

Despite widespread warnings and means to educate users to identify phishing messages, these are still a prevalent practice and a lucrative business.

The authors believe that persuasion, as a style of human communication designed to influence others, has a central role in successful digital scams. Research on persuasion applied to phishing emails is scarce and tends to build on Cialdini's work alone.

Only a single study has proposed a list of merged principles from three different perspectives but it has methodological limitations regarding the analysis’ performance by a single researcher and the testing of principles in a small, not validated sample of phishing emails. This paper aims to fill those gaps by building on Cialdini's, Gragg's and Stajano & Wilson's works to derive a unique list of Principles of Persuasion in Social Engineering (PPSE), resulting from the application of the relational method by two independent researchers.

The PPSE are identified, by two independent researchers (Kappa > 0.789) on a sample of phishing email subject lines (N = 194), dated from 2008 to 2017 and randomly selected from a reliable phishing archive (millersmiles.co.uk).

A thematic content analysis, together with the sample characterization in terms of visual elements and targeted content, revealed that the most prominent principles of persuasion in phishing emails were ‘Authority’, ‘Strong Affect’, ‘Integrity’ and ‘Reciprocation’. The larger percentage of references with the presence of visual elements was found for the ‘Strong Affect’ principle. The use of the pronouns ‘you' and ‘your’ was more evident for the categories ‘Strong Affect’ and ‘Authority’, while the employment of the pronouns ‘we, us, our’ was more frequent in the ‘Reciprocation’ principle.

This paper constitutes a step further in understanding the use of principles of persuasion in phishing emails with future applications on how their recognition can be automated.

---