2,025
Views
33
CrossRef citations to date
0
Altmetric
Empirical Research

An empirical study on the susceptibility to social engineering in social networking sites: the case of Facebook

, &
Pages 661-687 | Received 11 Jan 2016, Accepted 14 Jun 2017, Published online: 15 Feb 2018

References

  • Al Zamal F, Liu W and Ruths D (2012) Homophily and latent attribute inference: inferring latent attributes of Twitter users from neighbors. In Proceedings of the Sixth International AAAI Conference on Weblogs and Social Media (ICWSM), pp 387–390, Association for the Advancement of Artificial Intelligence, Dublin, Ireland.
  • AlbaumGThe Likert scale revisitedJournal-Market Research Society1997392331348
  • Algarni A, Xu Y and Chan T (2014a) Social engineering in social networking sites: the art of impersonation. In Proceedings of the 2014 IEEE International Conference on Services Computing (SCC), pp 797–804, IEEE Computer Society, Anchorage, Alaska, USA.
  • Algarni A, Xu Y, Chan T and Tian Y-C (2014b) Social Engineering in Social Networking Sites: How Good Becomes Evil. In Proceedings of the 18th Pacific Asia Conference on Information Systems (PACIS 2014), Association for Information Systems, Paper-271, Chengdu, China.
  • Algarni A, Xu Y, Chan T and Tian Y-C (2013a) Social engineering in social networking sites: affect-based model. In Proceedings of the 8th International Conference for Internet Technology and Secured Transactions (ICITST), pp 508–515, IEEE Computer Society.
  • AlgarniAXuYChanTTianY-CKierkegaardSToward understanding social engineeringLaw & Practice: Critical Analysis and Legal Reasoning2013CopenhagenInternational Association of IT Lawyers279300
  • AlowibdiJSBuyUAYuPSStennethLDetecting deception in online social networksProceedings of 2014 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM)2014BeijingIEEE383390
  • BaltazarJCostoyaJFloresRThe real face of Koobface: the largest Botnet ExplainedTrend Micro Research20095910
  • BaronRMKennyDAThe moderator–mediator variable distinction in social psychological research: conceptual, strategic, and statistical considerationsJournal of Personality and Social Psychology1986516117310.1037/0022-3514.51.6.1173
  • Baumhof V and Shipp A (2012) Zeus P2p Advancements and Mitb Attack Vectors. ThreatMetrix™ Labs Public Report. ThreatMetrix Inc., San Jose, CA.
  • BerloDKLemertJBMertzRJDimensions for evaluating the acceptability of message sourcesPublic Opinion Quarterly196933456357610.1086/267745
  • BraunREssweinWTowards a conceptualization of corporate risks in online social networks: a literature based overview of risksThe Proceedings of the 17th IEEE International Enterprise Distributed Object Computing Conference (EDOC)2013Vancouver, BCIEEE Computer Society267274
  • BrodyRGFlying under the radar: social engineeringInternational Journal of Accounting and Information Management201220433534710.1108/18347641211272731
  • BrownPLevinsonSCPoliteness: some universals in language usage1987CambridgeCambridge University Press
  • BurgoonJKThe ideal source: a reexamination of source credibility measurementCommunication Studies1976273200206
  • BurkeKLanguage as symbolic action: essays on life, literature, and method1966Oakland, CAUniversity of California Press
  • Cao J, Basoglu KA, Sheng H and Lowry PB (2015) A systematic review of social networking research in information systems. Communications of the Association for Information Systems 36(1), 1–40.
  • CastilloCMendozaMPobleteBInformation credibility on TwitterProceedings of the 20th International Conference on the World Wide Web2011New YorkACM675684
  • ChaiSKimMWhat makes bloggers share knowledge? An investigation on the role of trustInternational Journal of Information Management201030540841510.1016/j.ijinfomgt.2010.02.005
  • ChenY-HBarnesSInitial trust and online buyer behaviourIndustrial Management & Data Systems20071071213610.1108/02635570710719034
  • ChitreyASinghDSinghVA comprehensive study of social engineering based attacks in India to develop a conceptual modelInternational Journal of Information and Network Security (IJINS)201212455310.11591/ijins.v1i2.426
  • ChuZGianvecchioSWangHJajodiaSDetecting automation of Twitter accounts: are you a human, bot, or cyborg?IEEE Transactions on Dependable and Secure Computing20129681182410.1109/TDSC.2012.75
  • CialdiniRBInfluence: Science and Practice20014BostonAllyn & Bacon
  • CialdiniRBWosinskaWBarrettDWButnerJGornik-DuroseMCompliance with a request in two cultures: the differential influence of social proof and commitment/consistency on collectivists and individualistsPersonality and Social Psychology Bulletin199925101242125310.1177/0146167299258006
  • Clark K (2013) Five notorious Facebook attacks (learn how to protect yourself). Social media Retrieved 2/3/2015, 2015, from http://www.hongkiat.com/blog/five-facebook-attacks/.
  • CoatesJFIn defense of Delphi: a review of Delphi assessment, expert opinion, forecasting, and group process by H. SackmanTechnological Forecasting and Social Change19757219319410.1016/0040-1625(75)90058-X
  • CohenJStatistical Power Analysis for the Behavioral Sciences1977New YorkAcademic Press
  • CorinaSMarketing communication in online social programs: Ohanian model of source credibilityJournal of Empirical Generalisations in Marketing200611778784
  • CouperMIs the sky falling? New technology, changing media, and the future of surveysSurvey Research Methods201373145156
  • CreswellJWQualitative Inquiry and Research Design: Choosing among Five Approaches2012Thousand Oaks, CASage Publications
  • CrisciRKassinoveHEffect of perceived expertise, strength of advice, and environmental setting on parental complianceThe Journal of Social Psychology197389224525010.1080/00224545.1973.9922597
  • CugelmanBThelwallMDawesPThe dimensions of web site credibility and their relation to active trust and behavioural impactCommunications of the Association for Information Systems200924126
  • D’ArcyJHovavAGallettaDUser awareness of security countermeasures and its impact on information systems misuse: a deterrence approachInformation Systems Research2009201799810.1287/isre.1070.0160
  • DalkeyNHelmerOAn experimental application of the Delphi method to the use of expertsManagement Science19639345846710.1287/mnsc.9.3.458
  • DamJ-Wvan de MichelVOnline profiling and clustering of Facebook usersDecision Support Systems201570607210.1016/j.dss.2014.12.001
  • DeVellisRFScale Development: Theory and Applications2012Thousand Oaks, CASage
  • DeyAOrthogonal Fractional Factorial Designs1985New YorkWiley
  • DhamijaRTygarJDHearstMWhy phishing worksProceedings of the 2006 SIGCHI Conference on Human Factors in Computing Systems, New York2006USAACM581590
  • Dimensional-Research (2011) The Risk of Social Engineering on Information Security: A Survey of It Professionals. Technical report, Long Beach, CA.
  • DinevTWhy spoofing is serious internet fraudCommunications of the ACM20064910768210.1145/1164394.1164398
  • DownsJSHolbrookMCranorLFBehavioral response to phishing riskProceedings of the Anti-Phishing Working Groups 2nd Annual eCrime Researchers Summit2007New YorkACM3744
  • EdwardsCSpencePRGentileCJEdwardsAEdwardsAHow much Klout do you have… A test of system generated cues on source credibilityComputers in Human Behavior2013295A12A1610.1016/j.chb.2012.12.034
  • EisendMSource credibility dimensions in marketing communication—a generalized solutionJournal of Empirical Generalizations in Marketing2006102133
  • EkmanPEmotions Revealed: Recognizing Faces and Feelings to Improve Communication and Emotional Life2007New YorkHenry Holt and Company
  • FireMGoldschmidtREloviciYOnline social networks: threats and solutionsCommunications Surveys & Tutorials, IEEE20141642019203610.1109/COMST.2014.2321628
  • FlickUTriangulation in Qualitative Research, A Companion to Qualitative Research2004LondonSage178183
  • FurnellSPhishing: can we spot the signs?Computer Fraud & Security200720073101510.1016/S1361-3723(07)70035-0
  • FurnellSClarkeNPower to the people? The evolving recognition of human aspects of securityComputers & Security201231898398810.1016/j.cose.2012.08.004
  • GarlandRA comparison of three forms of the semantic differentialMarketing Bulletin1990111924
  • GazianoCMcGrathKMeasuring the concept of credibilityJournalism Quarterly198663345146210.1177/107769908606300301
  • GibbinsMDeception: a tricky issue for behavioral research in accounting and auditingAuditing1992112113
  • Gragg D (2003) A multi-level defense against social engineering. SANS Reading Room, March (13).
  • GrazioliSWhere did they go wrong? An analysis of the failure of knowledgeable internet consumers to detect deception over the internetGroup Decision and Negotiation200413214917210.1023/B:GRUP.0000021839.04093.5d
  • GunstRFMasonRLFractional factorial designWiley Interdisciplinary Reviews: Computational Statistics20091223424410.1002/wics.27
  • HadnagyCSocial Engineering: The Art of Human Hacking2010New YorkWiley
  • HairJFBlackWCBabinBJAndersonRETathamRLMultivariate Data Analysis2006Upper Saddle River, NJPearson Prentice Hall
  • HaneyCBanksCZimbardoPInterpersonal Dynamics in a Simulated PrisonInternational Journal of Criminology and Penology1973197316997
  • HerathTChenRWangJBanjaraKWilburJRaoHRSecurity Services as Coping Mechanisms: an Investigation into User Intention to Adopt an Email Authentication ServiceInformation Systems Journal2014241618410.1111/j.1365-2575.2012.00420.x
  • HooperDCoughlanJMullenMStructural Equation Modelling: guidelines for Determining Model FitElectronic Journal of Business Research Methods2008615360
  • HovlandCIJanisILKelleyHHCommunication and Persuasion; Psychological Studies of Opinion Change1953New Haven, CTYale University Press
  • HovlandCIWeissWThe Influence of Source Credibility on Communication EffectivenessPublic Opinion Quarterly195115463565010.1086/266350
  • HuberMKowalskiSNohlbergMTjoaSTowards automating social engineering using social networking sitesThe Proceedings of 2009 International Conference on Computational Science and Engineering2009MiamiIEEE117124
  • JagaticTNJohnsonNAJakobssonMMenczerFSocial phishingCommunications of the ACM200750109410010.1145/1290958.1290968
  • JeckerJLandyDLiking a person as a function of doing him a favourHuman Relations196922437137810.1177/001872676902200407
  • JohnsonHHIzzettRRRelationship between authoritarianism and attitude change as a function of source credibility and type of communicationJournal of Personality and Social Psychology196913431710.1037/h0028440
  • JohnstonACWarkentinMSiponenMAn enhanced fear appeal rhetorical framework: leveraging threats to the human asset through sanctioning rhetoricMIS Quarterly201539111313410.25300/MISQ/2015/39.1.06
  • JosephWBThe credibility of physically attractive Communicators: a ReviewJournal of Advertising1982113152410.1080/00913367.1982.10672807
  • KaneGCAlaviMLabiancaGJBorgattiSPWhat’s different about social media networks? A framework and research agendaMIS Quarterly201438127530410.25300/MISQ/2014/38.1.13
  • Kelman HC and Hovland CI (1953) ‘Reinstatement’ of the communicator in delayed measurement of opinion change. The Journal of Abnormal and Social Psychology48(3), 327.
  • KerenGKerenGLewisCBetween or within subjects design: A methodological dilemmaA Handbook for Data Analysis in the Behaviorial Sciences1993New YorkPsychology Press257
  • KimmelAJDeception in Marketing Research: Ethical, Methodological, and Disciplinary Implications2000LondonLondon Business School
  • KirkREExperimental Design1982LondonWiley
  • KlebbaJMUngerLSThe impact of negative and positive information on source credibility in a field settingAdvances in Consumer Research19831011116
  • KoslinBLStoopsJWLohWDSource characteristics and communication discrepancy as determinants of attitude change and conformityJournal of Experimental Social Psychology19673323024210.1016/0022-1031(67)90025-X
  • KumaraguruPCranshawJAcquistiACranorLFHongJBlairMAPhamTSchool of phish: a real-word evaluation of anti-phishing trainingProceedings of the 5th Symposium on Usable Privacy and Security, New York2009USAACM112
  • KvedarDNettisMFultonSPThe use of formal social engineering techniques to identify weaknesses during a computer vulnerability competitionJournal of Computing Sciences in Colleges20102628087
  • Lane D (2001) Spring 2001 Theory Workbook.
  • LiuWRuthsDWhat’s in a name? Using first names as features for gender inference in TwitterAAAI Spring Symposium: Analyzing Microtext2013DublinAssociation for the Advancement of Artificial Intelligence1016
  • LunJSinclairSWhitchurchERGlennC(Why) do I think what you think? Epistemic social tuning and implicit prejudiceJournal of Personality and Social Psychology200793695710.1037/0022-3514.93.6.957
  • LuoXRZhangWBurdSSeazzuAInvestigating phishing victimization with the heuristic-systematic model: a theoretical framework and an explorationComputers & Security20123812838
  • MacKinnonDPKrullJLLockwoodCMEquivalence of the mediation, confounding and suppression effectPrevention Science20001417318110.1023/A:1026595011371
  • MarkhamDThe dimensions of source credibility of television newscastersJournal of Communication1968181576410.1111/j.1460-2466.1968.tb00055.x
  • MartinDWDoing Psychology Experiments2007BostonCengage Learning
  • MaruscaLWhat every body is saying. An ex-FBI agent’s guide to speed-reading peopleJournal of Media Research2014738990
  • MatookSBrownSARolfJForming an intention to act on recommendations given via online social networksEuropean Journal of Information Systems2015241769210.1057/ejis.2013.28
  • Mazzuca T (2014) 7 scary findings from the 2014 Symantec internet security threat report. Property & Casualty 360.
  • McCordMChuahMSpam detection on Twitter using traditional classifiersAutonomic and Trusted Computing, Berlin2011HeidelbergSpringer175186
  • McCroskeyJCHoldridgeWToombJKAn instrument for measuring the source credibility of basic speech communication instructorsCommunication Education19742312633
  • MetzgerMJFlanaginAJEyalKLemusDRMcCannRMCredibility for the 21st century: integrating perspectives on source, message, and media credibility in the contemporary media environmentCommunication Yearbook20032729333610.1207/s15567419cy2701_10
  • MisloveALehmannSAhnY-YOnnelaJ-PRosenquistJNUnderstanding the demographics of Twitter usersProceedings of the Fifth International AAAI Conference on Weblogs and Social Media2011BarcelonaAssociation for the Advancement of Artificial Intelligence14
  • MitnickKDSimonWLThe Art of Deception: Controlling the Human Element of Security2001New YorkWiley
  • MixonDInstead of deceptionJournal for the Theory of Social Behaviour19722214517810.1111/j.1468-5914.1972.tb00309.x
  • MosierNRAhlgrenACredibility of precision journalismJournalism & Mass Communication Quarterly1981583375518
  • MyersMDQualitative research in information systemsManagement Information Systems Quarterly199721224124210.2307/249422
  • NagyJPechoPSocial networks securityProceedings of the Third International Conference on Emerging Security Information, Systems and Technologies2009Athens, GlyfadaIEEE321325
  • O’ConnorJSeymourJIntroducing Nlp: Psychological Skills for Understanding and Influencing People2011San FranciscoConari Press
  • O’LearyCJWillisFNTomichEConformity under deceptive and non-deceptive techniquesThe Sociological Quarterly1970111879310.1111/j.1533-8525.1970.tb02077.x
  • OhanianRConstruction and validation of a scale to measure celebrity endorsers’ perceived expertise, trustworthiness, and attractivenessJournal of Advertising1990193395210.1080/00913367.1990.10673191
  • OlsonTChristiansenGThirty-One Hours: The Grindstone Experiment1966TorontoCanadian Friends Service Committee
  • OsborneJWatersEFour assumptions of multiple regression that researchers should always testPractical Assessment, Research & Evaluation20028219
  • ParksRXuHChuCLowryPExamining the intended and unintended consequences of organisational privacy safeguards enactment in healthcare: a grounded theory investigationEuropean Journal of Information Systems2017261376510.1057/s41303-016-0001-6
  • ParrishJLJrBaileyJLCourtneyJFA personality based model for determining susceptibility to phishing attacks2009Little RockUniversity of Arkansas285296
  • PattinsonMJerramCParsonsKMcCormacAButaviciusMWhy do some people manage phishing e-mails better than others?Information Management & Computer Security2012201182810.1108/09685221211219173
  • PennacchiottiMPopescuA-MA machine learning approach to Twitter user classificationProceedings of the Fifth International AAAI Conference on Weblogs and Social Media2011BarcelonaAssociation for the Advancement of Artificial Intelligence281288
  • PettyRECacioppoJTPettyRECacioppoJTThe elaboration likelihood model of persuasionCommunication and Persuasion1986New YorkSpringer124
  • PlappTWernerUUnderstanding risk perception from natural hazards: examples from GermanyRisk200621101108
  • PornpitakpanCThe persuasiveness of source credibility: a critical review of five decades’ evidenceJournal of Applied Social Psychology200434224328110.1111/j.1559-1816.2004.tb02547.x
  • PorterSRWhitcombMEThe impact of lottery incentives on student survey response ratesResearch in Higher Education200344438940710.1023/A:1024263031800
  • PoseyCRobertsTLowryPBBennettBCourtneyJInsiders’ protection of organizational information assets: development of a systematics-based taxonomy and theory of diversity for protection-motivated behaviorsMIS Quarterly20133741189121010.25300/MISQ/2013/37.4.09
  • PoseyCRobertsTLLowryPBHightowerRTBridging the divide: a qualitative comparison of information security thought patterns between information security professionals and ordinary organizational insidersInformation & Management201451555156710.1016/j.im.2014.03.009
  • PyszczynskiTGreenbergJSolomonSWhy do we need what we need? A terror management perspective on the roots of human social motivationPsychological Inquiry19978112010.1207/s15327965pli0801_1
  • Qi T (2007) An investigation of heuristics of human judgment in detecting deception and potential implications in countering social engineering. In Intelligence and Security Informatics, 2007 IEEE, pp 152–159, IEEE.
  • Rao D, Yarowsky D, Shreevats A, Gupta M (2010) Classifying latent user attributes in Twitter. In Proceedings of the 2nd International Workshop on Search and Mining User-Generated Contents, Toronto, Canada, pp 37–44.
  • ReckerJScientific Research in Information Systems: A Beginner’s Guide2012BerlinSpringer
  • RosenstockIMHistorical origins of the health belief modelHealth Education & Behavior197424328335
  • RuckerDDPreacherKJTormalaZLPettyREMediation analysis in social psychology: current Practices and New RecommendationsSocial and Personality Psychology Compass20115635937110.1111/j.1751-9004.2011.00355.x
  • RyanTPMorganJPModern experimental designJournal of Statistical Theory and Practice200713–450150610.1080/15598608.2007.10411855
  • Sadeghian A, Zamani M and Shanmugam B (2013) Security threats in online social networks. In 2013 International Conference on Informatics and Creative Multimedia (ICICM), pp 254–258, IEEE.
  • SalwenMBCredibility of newspaper opinion polls: source, source intent and precisionJournalism & Mass Communication Quarterly1987644813819
  • SeiterRGassJPersuasion, Social Influence, and Compliance Gaining2010BostonAllyn & Bacon
  • ShengSHolbrookMKumaraguruPCranorLFDownsJWho falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventionsProceedings of the 2010 SIGCHI Conference on Human Factors in Computing Systems, New York2010USAACM373382
  • SherifMHovlandCISocial Judgment: Assimilation and Contrast Effects in Communication and Attitude Change1961OxfordYale University Press
  • ShroutPEBolgerNMediation in experimental and nonexperimental studies: new procedures and recommendationsPsychological Methods20027442210.1037/1082-989X.7.4.422
  • SinghPVSahooNMukhopadhyayTHow to attract and retain readers in enterprise blogging?Information Systems Research2014251355210.1287/isre.2013.0509
  • SingletaryMWComponents of credibility of a favorable news sourceJournalism & Mass Communication Quarterly1976532316319
  • SivoSASaundersCChangQJiangJJHow low should you go? Low response rates and the validity of inference in is questionnaire researchJournal of the Association for Information Systems200676351414
  • StringhiniGKruegelCVignaGDetecting spammers on social networksProceedings of the 26th Annual Computer Security Applications Conference2010AustinACM19
  • SussmanSWSiegalWSInformational influence in organizations: an integrated approach to knowledge adoptionInformation Systems Research2003141476510.1287/isre.14.1.47.14767
  • TabachnickBGFidellLSUsing Multivariate Statistics20014BostonAllyn and Bacon
  • TashakkoriATeddlieCHandbook of Mixed Methods in Social & Behavioral Research2003Thousand Oaks, CASage
  • ThomasKMcCoyDGrierCKolczAPaxsonVTrafficking fraudulent accounts: the role of the underground market in Twitter spam and abuseProceedings of the 22nd Annual USENIX Security Symposium (Usenix Sec 2013)2013Washington, DCCiteseer195210
  • ThomasKNicolDMThe Koobface Botnet and the rise of social malwareProceedings of the 5th International Conference on Malicious and Unwanted Software (MALWARE)2010Nancy LorraineIEEE6370
  • ThornburghTSocial engineering: the dark artProceedings of the 1st Annual Conference on Information Security Curriculum Development2004New YorkACM133135
  • TsengSFoggBCredibility and computing technologyCommunications of the ACM1999425394410.1145/301353.301402
  • UrquhartCLehmannHMyersMDPutting the ‘theory’ back into grounded theory: guidelines for grounded theory studies in information systemsInformation Systems Journal201020435738110.1111/j.1365-2575.2009.00328.x
  • VanceAAndersonBBKirwanCBEargleDUsing measures of risk perception to predict information security behavior: insights from electroencephalography (EEG)Journal of the Association for Information Systems20141510679722
  • VanceAElie-Dit-CosaqueCStraubDWExamining trust in information technology artifacts: the effects of system quality and cultureJournal of Management Information Systems20082447310010.2753/MIS0742-1222240403
  • VishwanathADiffusion of deception in social media: social contagion effects and its antecedentsInformation Systems Frontiers2014176115
  • WangAHDon’t follow me: spam detection in TwitterThe Proceedings of the 2010 International Conference on Security and Cryptography (SECRYPT), Athens2010IEEEGreece110
  • WangJGuptaMRajRInsider threats in a financial institution: analysis of attack-proneness of information systems applicationsManagement Information Systems Quarterly20153919111210.25300/MISQ/2015/39.1.05
  • WestermanDSpencePRHeideBSocial media as information source: recency of updates and credibility of informationJournal of Computer-Mediated Communication201419217118310.1111/jcc4.12041
  • WillisonRWarkentinMBeyond deterrence: an expanded view of employee computer abuseMIS Quarterly201337112010.25300/MISQ/2013/37.1.01
  • WorkmanMGaining access with social engineering: an empirical study of the threatInformation Systems Security200716631533110.1080/10658980701788165
  • WorkmanMWisecrackers: a theory-grounded investigation of phishing and pretext social engineering threats to information securityJournal of the American Society for Information Science and Technology200859466267410.1002/asi.20779
  • WrightRTJensenMLThatcherJBDingerMMarettKResearch note—influence techniques in phishing attacks: an examination of vulnerability and resistanceInformation Systems Research201425238540010.1287/isre.2014.0522
  • Yardley-MatwiejczukKMRole play: theory and practice1997LondonSage
  • ZhaoXLynchJGChenQReconsidering Baron and Kenny: myths and truths about mediation analysisJournal of Consumer Research201037219720610.1086/651257

Reprints and Corporate Permissions

Please note: Selecting permissions does not provide access to the full text of the article, please see our help page How do I view content?

To request a reprint or corporate permissions for this article, please click on the relevant link below:

Academic Permissions

Please note: Selecting permissions does not provide access to the full text of the article, please see our help page How do I view content?

Obtain permissions instantly via Rightslink by clicking on the button below:

If you are unable to obtain permissions via Rightslink, please complete and submit this Permissions form. For more information, please visit our Permissions help page.