Gaining access with social engineering: An empirical study of the threat

Information Systems Security

Volumn 16, Issue 6, 2007, Pages 315-331

  Workman, Michael ^a  

^a FLORIDA INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84995871700     PISSN: 1065898X     EISSN: None     Source Type: Journal    
DOI: 10.1080/10658980701788165     Document Type: Article

References (109)

1. Acquisti, A., & Grossklags, J. (2005). Privacy and rationality in individual decision making, IEEE Security and Privacy, 3: 26-33.
2. Ajzen, I. (2002). Perceived behavioral control, self-efficacy, locus of control, and the theory of planned behavior, Journal of Applied Social Psychology, 32: 665-683.
3. Albrechtsen, E. (2006). A qualitative study of users' view on information security, Computers & Security, 25: 6, 445-451.
4. Aldoory, L., & Van Dyke, M. A. (2006). The roles of perceived shared involvement and information overload in understanding how audiences make meaning of news about bioterrorism, Journalism & Mass Communication Quarterly, 83: 346-361.
5. Allen, N. J., & Meyer, J. P. (1990). The measurement and antecedents of affective, continuance and normative commitment to the organization, Journal of Occupational Psychology, 63: 1-18.
6. Arkes, H., & Blumer, C. (1985). The psychology of sunk cost, Organizational Behavior and Human Decision Process, 35: 124-140.
7. Asch, S. E. (1946). Forming impressions of personality, Journal of Abnormal and Social Psychology, 41: 258-290.
8. Beck, K., & Wilson, C. (2000). Development of affective organizational commitment: A cross-sectional examination of change with tenure, Journal of Vocational Behavior, 56: 114-136.
9. Bergman, M. E. (2006). The relationship between affective and normative commitment: Review and research agenda, Journal of Organizational Behavior, 27: 645-663.
10. Blass, T. (2000). Invited response to review of –Obedience to authority: Current perspectives on the Milgram paradigm,— British Journal of Educational Psychology, 70: 624-625.
11. Bommer, W. H., Johnson, J. L., Rich, G. A., Podsakoff, P. M., & MacKenzie, S. B. (1995). On the interchangeability of objective and subjective measures of employee performance: A meta-analysis, Personnel Psychology, 48: 587-605.
12. Brehm, J. W. (1966). A theory of psychological reactance. New York: Academic Press.
13. Brehm, J. W., & Cole, N. H. (1966). Effects of a favor that reduces freedom, Journal of Personality and Social Psychology, 3: 420-426.
14. Bresz, F. P. (2004). People-often the weakest link in security, but one of the best places to start, Journal of Health Care Compliance, July- August: 57-60.
15. Brill D. W., & Molton, P. (2006). Escalation of economic costs, sunk costs, and opportunity costs: A psychological investment perspective, International Journal of Human Decisioning, 12: 29-38.
16. Cacioppo, J. T., Petty, R. E., Kao, C. F., & Rodriguez, R. (1986). Central and peripheral routes to persuasion: An individual difference perspective, Journal of Personality and Social Psychology, 51; 1032-1043.
17. Calluzzo, V. J., & Cante, C. J. (2004). Ethics in information technology and software use. Journal of Business Ethics, 51(3): 301-312.
18. Casciaro, T., & Lobo, M. S. (2005). Competent jerks, lovable fools, and the formation of social networks, Harvard Business Review, 83: 92-99.
19. Charbaji, A., & Jannoun, S. E. L. (2005). Individuality, willingness to take risk, and use of a personal e-card, Journal of Managerial Psychology, 20: 51-58.
20. Chen, Y-H, & Barnes, S. (2007). Initial trust and online buyer behavior, Industrial Management and Data Systems, 107: 21-36.
21. Cialdini, R. B. (2001). Influence; Science and Practice. Boston, MA: Allyn & Bacon.
22. Debar, H., & Viinikka, J. (2006). Security information management as an outsourced service, Information Management & Computer Security, 14:5: 417-435.
23. Denis, T., Trobec, R., Pavei, N., & Tasi, J. F. (2007). Information system security and human behavior, Behavior & Information Technology, 26: 113-118.
24. Dodge, R. C., Carver, C., & Ferguson, A. J. (2007). Phishing for user security awareness, Computers & Security, 26: 73-80.
25. Donelson, E. (1973). Personality; A Scientific Approach. Pacific Palisades, CA: Goodyear Publishing.
26. Dotterweich, D. P., & Collins, K. S. (2006). The practically of super bowl advertising for new products and companies, Journal of Promotion Management, 11: 19-31.
27. Dowd, E. T., & Seibel, C. A. (1990). A cognitive theory of resistance and reactance: Implications for treatment, Journal of Mental Health Counseling, 12: 458-469.
28. Federal Trade Commission. (2003). Complying with the telemarketing sales rule. Accessed January 29, 2007, from http://www.ftc.gov/bcp/ conline/pubs/buspubs/tsrcomp.htm
29. Fennis, B. M., Das, E., & Pruyn, A. Th. H. (2006). Interpersonal communication and compliance: The disrupt-then-reframe technique in dyadic influence settings, Communication Research, 33(2): 136-151.
30. Festinger, L., & Carlsmith, J. M. (1959). Cognitive consequences of forced compliance, Journal of Abnormal and Social Psychology, 58: 203-210.
31. Gao, W., & Kim, J. (2007). Robbing the cradle is like taking candy from a baby, Proceedings of the Annual Conference of the Security Policy Institute (GCSPI), October 4, Amsterdam, The Netherlands, 1, 23-37.
32. Gass, R. H., & Seiter, J. S. (1999). Persuasion, Social Influence, and Compliance Gaining. Needham Heights, MA: Allyn-Bacon.
33. Gendall, P. (2005). Can you judge a questionnaire by its cover? The effect of questionnaire cover design on mail survey response, International Journal of Public Opinion Research, 17: 346-361.
34. Giles, H., & Wiemann, J. M. (1987). Language, social comparison and power. In C. R. Berger and S. H. Chaffee (Eds.), The Handbook of Communication Science (pp. 350-384). Newbury Park, CA: Sage.
35. Grossklags, J., & Acquisti, A. (2007). When 25 cents is too much: An experiment on willingness-to-sell and willingness-to-protect personal information, Sixth Workshop on the Economics of Information Security (WEIS 2007), June 6, Pittsburgh, PA, 7-18.
36. Grothmann, T., & Reusswig, F. (2006). People at risk of flooding: Why some residents take precautionary action while others do not, Natural Hazards, 38: 101-120.
37. Grunig, J. E. (1997). A situational theory of publics: Conceptual history, recent challenges and new research. In D. Moss, T. MacManus, & D. Vercic (Eds.), Public Relations Research: An International Perspective (pp. 3-48). London: International Thomson Business Press.
38. Guadagno, R. E., & Cialdini, R. B. (2002). On-line persuasion: An examination of differences in computer-mediated interpersonal influence, Group Dynamics: Theory, Research and Practice, 6: 38-51.
39. Gundlach, G. T., Achrol, R. S., & Mentzer, J. T. (1995). The structure of commitment in exchange, Journal of Marketing, 59: 78-92.
40. Harrington, S. J. (1996). The effect of codes of ethics and personal denial of responsibility on computer abuse judgments and intentions, MIS Quarterly, 20(Sept.): 257-258.
41. Helm, C., & Morelli, M. (1985). Obedience to authority in a laboratory setting: Generalizability and context dependency, Political Studies, 14: 610-627.
42. Hochhauser, M. (2004). Smart executives, dumb decisions, Journal of Risk Management, 51: 64-73.
43. Horai, J., Naccari, N., & Fatoullah, E. (1974). The effects of expertise and physical attractiveness upon opinion agreement and liking, Sociometry, 37: 601-606.
44. Hsu, M-H., & Kuo, F-Y. (2003). An investigation of volitional control in information ethics, Behavior and Information Technology, 22: 53-62.
45. International Federation of Accountants. (2006). Intellectual assets and value creation: Implications for corporate reporting. Paris, France. Retrieved November 4, 2007, from: http://www.oecd.org/dataoecd/ 2/40/37811196.pdf
46. Janoff-Bulman, R., & Frieze, I. H. (1983). A theoretical perspective for understanding reactions to victimization, Journal of Social Issues, 39: 1-17.
47. Josephs, R. A., Larrick, R. P., Steele, M., & Nisbett, R. E. (1992). Protecting the self from the negative consequences of risky decisions, Journal of Personality and Social Psychology, 62: 26-37.
48. Keck, R. (2005). Disruptive technologies and the evolution of the law, Legal Briefs, 23(1): 22-49.
49. Kelley, H. H., & Thlbaut, J. (1978). Interpersonal Relations: A Theory of Interdependence. New York: Wiley.
50. Komlto, L. (1994). Communities of practice and communities of trust: Global culture and information technology, Journal of Anthropology, 4: 33-45.
51. Krishnan, R., & Martin, X. (2006). When does trust matter to alliance performance? The Academy of Management Journal, 49: 894-917.
52. Kurland, N. B. (1995). Ethical intentions and the theories of reasoned action and planned behavior. Journal of Applied Social Psychology, 25(4): 297-313.
53. Leach, J. (2003). Improving user security behavior, Computers & Security, 22: 685-691.
54. Lejeune, R., & Alex, N. (1973). On being mugged: The event and its aftermath, Urban Life and Culture, 2: 259-287.
55. Leyden, J. (2004). Clueless office workers help spread computer viruses, The Register, February 6: 17-21.
56. Lindsey, L. L. M. (2005). Anticipated guilt as behavioral motivation: An examination of appeals to help unknown others through bone marrow donation, Human Communication Research, 31: 453-481.
57. Losey, R. C. (1998). The electronic communications privacy act: United States Code. Orlando, FL: The Information Law Web. Accessed November 5, 2007, at http://fioridalawfirm.com/privacy.html
58. Lynn, M. (1992). Scarcity's enhancement of desirability, Basic and Applied Social Psychology, 13: 67-78.
59. McCaul, H. S., Hinsz, V. B., & McCaul, K. D. (1995). Assessing organizational commitment: An employee's global attitude toward the organization, Journal of Applied Behavioral Science, 31: 80-90.
60. Melamed, Y., Szor, H., Barak, Y., & Elizur, A. (1998). Hoarding: What does it mean? Comprehensive Psychiatry, 39: 400-402.
61. Milgram, S. (1983). Obedience to Authority: An Experimental View. New York: Harper-Collins.
62. Miller, K. (2005). Communication Theories: Perspectives, Processes, and Contexts. New York: McGraw-Hill.
63. Milne, S., Sheeran, P., & Orbell, S. (2000). Prediction and intervention in health-related behavior: A meta-analytic review of protection motivation theory, Journal of Applied Social Psychology, (30): 106-143.
64. Mitnick, K., & Simon, W. L. (2002). The Art of Deception: Controlling the Human Element of Security. New York: John Wiley & Sons.
65. Mowday, R. T., Steers, R. T., & Porter, L. W. (1979). The measurement of organizational commitment, Journal of Vocational Behavior, 14: 224-247.
66. Ong, T. H., Tan, C. P., Tan, Y. T., & Ting, C. (1999). SNMS - Shadow network management system, Symposium on Network Computing and Management, Singapore, May 21, 1-9.
67. Panko, R., DeFries, J. C., & McClearn, G. E. (1990). Behavioral Genetics. New York: W.H. Freeman.
68. Panko, R. R. (2004). Corporate Computer and Network Security. Upper Saddle River, NJ: Pearson/Prentice-Hall.
69. Pechmann, C., Zhao, G., Goldberg, M., & Reibling E. T. (2003). What to convey in antismoking advertisements of adolescents: The use of protection motivation theory to identify effective message themes, Journal of Marketing, 67(2): 1-18.
70. Pennebaker, J. W., & Sanders, D. Y. (1976). American graffiti: Effects of authority and reactance arousal, Personality and Social Psychology Bulletin, 2: 264-267.
71. Pennington, N., & Hastie, R. (1986). Evidence evaluation in complex decision making, Journal of Personality and Social Psychology, 51: 242-258.
72. Petty, R. E., Brinol, P., & Tormala, Z. L. (2002). Thought confidence as a determinant of persuasion: The self-validation hypothesis, Journal of Personality and Social Psychology, 82: 722-741.
73. Petty, R. E., & Cacioppo, J. T. (1986). Communication and Persuasion: Central and Peripheral Routes to Attitude Change. New York: Springer-Verlag.
74. Petty, R. E., Cacioppo, J. T., & Schumann, D. W. (1983). Central and peripheral routes to advertising effectiveness: The moderating role of involvement, Journal of Consumer Research, 10: 135-146.
75. Plomin, R., DeFries, J. C., McClearn, G. E., & McGuffin, P. (2001). Behavioral Genetics (4th ed.). New York: Worth Publishers.
76. Pyszczynski, T., Greenberg, J., & Solomon, S. (1997). Why do we need what we need? A terror management perspective on the roots of human social motivation," Psychological Inquiry, 8: 1-20.
77. Roe-Berning, S., & Straker, G. (1997). The association between illusions of invulnerability and exposure to trauma, Journal of Traumatic Stress, 10: 319-327.
78. Rogers, R. W. (1975). A protection motivation theory of fear appeals and attitude change, Journal of Psychology, 91: 93-114.
79. Rosenstock, I. M. (1974). Historical origins of the health belief model, Health Education Monograph, 2: 328-335.
80. Ruighaver, A. B., Maynard, S. B., & Chang, S. (2007). Organizational security culture: Extending the end-user perspective, Computers and Security, 26(1): 56-62.
81. Rusch, J. J. (1999). The social engineering of Internet fraud. Report of the U.S. Department of Justice, INET'99 Conference. Retrieved February 6, 2007, from: http://www.isoc.org/inet99/proceedings/3g/3g_2.htm
82. Rutte, C. G., Wilke, H. A. M., & Messick, D. M. (1987). Scarcity or abundance caused by people or the environment as determinants of behavior in the resource dilemma, Journal of Experimental Social Psychology, 23: 208-216.
83. SANS. (2005). The SANS Security Policy Project. Bethesda, MD.
84. Sagie, A. (1998). Employee absenteeism, organizational commitment, and job satisfaction: Another look, Journal of Vocational Behavior, 52: 156-171.
85. Sasse, M. A., Brostoff, S., & Weirich, D. (2004). Transforming the weakest link-A human/computer interaction approach to usable and effective security, BT Technology Journal, 19(3): 122-131.
86. Scholz, J. T. (1997). Enforcement policy and corporate misconduct: The changing perspective of deterrence theory, Law and Contemporary Problem, (60): 153-268.
87. Schumann, D. W., Hathcote, J. M., & West, S. (1991). Corporate advertising in America: A review of published studies on use, measurement, and effectiveness, Journal of Advertising September: 35-55.
88. Severin, W. J., & Tankard, J. W. (1997). Communication Theories: Origins, Methods, and Uses in the Mass Media. New York: Addison-Wesley.
89. Sherif, J. S., Ayers, R., & Dearmond, T. G. (2003). Intrusion detection: The art and the practice, Information Management and Computer Security, 11(4): 175-186.
90. Shreve, M. (2004). The office now a major place for identity theft, Crains, (Sept.): 1-4.
91. Staw, B. M. (1981). The escalation of commitment to a course of action, The Academy of Management Review, 6: 577-587.
92. Stephenson, K. (2008). The Quantum Theory of Trust: Power, Networks, and the Secret Life of Organizations. New York: Prentice-Hall.
93. Stevens, J. (1989). Intermediate Statistics: A Modern Approach. Hillsdale, NJ: Lawrence-Erlbaum.
94. Straub, D. W., & Nance, W. D. (1990). Discovering and disciplining computer abuse in organizations: A field study, MIS Quarterly, March 14: 45-62.
95. Straub, D. W., & Welke, R. J. (1998). Coping with systems risk: Security planning models for management decision-making, MIS Quarterly, 22: 441-469.
96. Tajfel, H., & Turner, J. C. (1986). The social identity theory of inter-group behavior. In S. Worchel & L. W. Austin (Eds.), Psychology of Intergroup Relations. Chicago, IL: Nelson-Hall.
97. Theoharidou, M., Kokolakis, S., Karyda, M., & Kiountouzis, E. (2005). The insider threat to information systems and the effectiveness of ISO17799, Computers and Security, 24: 472-484.
98. Thomas, T. M. (2004). Network Security First-Step. Indianapolis, IN: Cisco Press.
99. U.S. Department of Justice. (2004). Violation of 18 USC. Gaining unauthorized access. Information Security Report of the GAO, 17: 188-219.
100. von Solms, B., & von Solms, R. (2004). The 10 deadly sins of information security management, Computers & Security, 23: 371-376.
101. Wakefield, R. L., & Whitten, D. (2006). Examining user perceptions of third-party organization credibility and trust in an e-retailer, Journal of Organizational and End User Computing, 18: 1-19.
102. Walczuch, R., & Lundgren, H. (2004). Psychological antecedents of institution-based consumer trust in e-retailing, Information & Management, 42(1): 159-177.
103. Wang, Y. D., & Emurian, H. H. (2005). An overview of online trust: Concepts, elements, and implications, Journal of Computers in Human Behavior, 21: 105-125.
104. Weatherly, J. N., Miller, K., & McDonald, T. W. (1999). Social influence as stimulus control, Behavior and Social Issues, 9: 25-46.
105. Wilson, R. (2004). Understanding the offender/environment dynamic for computer crimes: Assessing the feasibility of applying criminology theory to the IS security context, Proceedings from the 37th Hawaii International Conference on System Sciences (HICSS), January 5, Waikoloa, Hawaii, 1-10.
106. Workman, M., & Gathegi, J. (2005). Observance and contravention of information security measures, Proceedings of the World Conference on Security Management and Applied Computing, SAM01 June 16, Las Vegas, NV, 241-247.
107. Workman, M., & Gathegi, J. (2007). Punishment and ethics deterrents: A comparative study of insider security contravention, Journal of the American Society for Information Science and Technology, 58: 212-222.
108. Yakov, B., Shankar, V., Sultan, F., & Urban G. L. (2005). Are the drivers and role of online trust the same for all web sites and consumers?: A large scale exploratory empirical study, Journal of Marketing, 69 (4): 133-152.
109. Yang, S., Hung, W., Sung, K., & Farn, C. (2006). Investigating initial trust toward e-tailers from the elaboration likelihood model perspective, Psychology and Marketing, 23: 429-445.