Abstract
Social engineering is a form of attack trying to manipulate employees to make them disclose confidential information or perform actions that threatens the security of organizations. The goal of this paper is to study both individual and organizational factors that affect information security awareness of employees and how this leads to intention to resist social engineering attacks. The proposed research model is validated using survey data of 136 employees. The empirical results suggest that leadership and the tendency toward risky behavior are influencing information security awareness of employees. Information security awareness was confirmed as a central factor for information security, whereby the promotion of awareness for information security is indicated as an important aspect to protect a company from potential attacks. The impact of information security awareness on attitude, perceived behavior control and subjective norm in addition to the indirect effect on the intention to resist social engineering, underline the importance of this factor.
1. Introduction
The growing importance of digital information presents not only opportunities but also security risks. The spread of social networking platforms enables attackers to collect personal data of employees via their online footprints. The information obtained in this manner can then be used to facilitate attacks on an organization [1]. As humans make decisions and bear responsibility, the human factor is making an important contribution to the aspect of information security [2]. Even the strongest technical protective measures are useless if an attacker can successfully influence employees [3]. Social engineering is a form of attack in which people are deliberately manipulated to divulge confidential information or to perform actions desired by the attacker that threaten the security of the person or the company [4]. Social engineering attacks include physical, social and technical aspects that are used in the various phases of an attack. Even if such an attack is initially unsuccessful, any insight into individual and organizational security processes can be used for future attacks. This phenomenon is called harvesting [5]. Social engineers use techniques such as (spear) phishing [6–8], pretexting [6,9], dumpster diving [7], shoulder surfing [7,9], reverse (social) engineering [6,7], waterholing [7], baiting [7], or staff impersonation [6,9] to gain access to personal data or secured systems. Employees with a lack of knowledge about such security risks are among the biggest risks in the company [10]. To ensure information security, measures are necessary to promote employees‘ information security awareness [3,11–13].
