In an empirical user study, we assessed two approaches to ranking the results from a keyword search using semantic contextual match based on Latent Semantic Analysis. These techniques involved ...searches initiated from words found in a seed document within a corpus. The first approach used the sentence around the search query in the document as context while the second used the entire document. With a corpus of 20,000 documents and a small proportion of relevant documents (<0.1%), both techniques outperformed a conventional keyword search on a recall-based information retrieval (IR) task. These context-based techniques were associated with a reduction in the number of searches conducted, an increase in users' precision and, to a lesser extent, an increase in recall. This improvement was strongest when the ranking was based on document, rather than sentence, context. Individuals were more effective on the IR task when the lists returned by the techniques were ranked better. User performance on the task also correlated with achievement on a generalized IQ test but not on a linguistic ability test.
It is increasingly acknowledged that many threats to an organisation's computer systems can be attributed to the behaviour of computer users. To quantify these human-based information security ...vulnerabilities, we are developing the Human Aspects of Information Security Questionnaire (HAIS-Q). The aim of this paper was twofold. The first aim was to outline the conceptual development of the HAIS-Q, including validity and reliability testing. The second aim was to examine the relationship between knowledge of policy and procedures, attitude towards policy and procedures and behaviour when using a work computer. Results from 500 Australian employees indicate that knowledge of policy and procedures had a stronger influence on attitude towards policy and procedure than self-reported behaviour. This finding suggests that training and education will be more effective if it outlines not only what is expected (knowledge) but also provides an understanding of why this is important (attitude). Plans for future research to further develop and test the HAIS-Q are outlined.
The main purpose of this study was to examine the relationship between individuals' Information Security Awareness (ISA) and individual difference variables, namely age, gender, personality and ...risk-taking propensity. Within this study, ISA was defined as individuals' knowledge of what policies and procedures they should follow, their understanding of why they should adhere to them (their attitude) and what they actually do (their behaviour). This was measured using the Human Aspects of Information Security Questionnaire (HAIS-Q). Individual difference variables were examined via a survey of 505 working Australians. It was found that conscientiousness, agreeableness, emotional stability and risk-taking propensity significantly explained variance in individuals’ ISA, while age and gender did not. Findings highlighted the need for future research to examine individual differences and their impact on ISA. Results of the study can be applied by industry to develop tailored InfoSec training programs.
•Emotional stability was positively associated with Information Security Awareness (ISA).•Conscientiousness and agreeableness were positively associated with ISA.•Individuals with a propensity to take fewer risks scored higher on ISA.
•A total of 985 participants completed a role play scenario-based phishing study.•The presence of social influence principles influenced phishing susceptibility.•Phishing emails using consistency and ...reciprocity were most successful.•Phishing emails using scarcity and social proof were least successful.•Individual susceptibility to persuasion could predict susceptibility to phishing.
To reduce the threat caused by phishing attacks, it is vital to investigate why some phishing attacks are successful, and why some people are more susceptible to them than others. To examine this, we used a social influence framework, and applied the Susceptibility to Persuasion Strategies scale within a dual-process model of persuasion framework. A total of 985 participants took part in a role-play scenario-based phishing study. Results indicated that phishing emails utilising scarcity and social proof principles were least successful, whereas those applying consistency and reciprocity principles were most successful. The same principles were also considered least and most persuasive according to the Susceptibility to Persuasion Strategies scale. For the majority of principles, participants who were susceptible to a specific principle were significantly more susceptible to emails containing that principle. Further results revealed that age; the percentage of time spent using a computer; susceptibility to the social proof principle; and, both dispositional and situational impulsivity, were significant predictors in people's ability to detect phishing emails. Practical implications of these findings as well as future directions are discussed.
Lack of personalisation and poor mechanics (e.g., grammar, spelling and punctuation) are commonly cited as cues of deception that people can use to identify phishing emails. However, in an online ...email classification experiment (N = 472), we found no empirical evidence that the presence of these features was associated with better phishing email discrimination. We also manipulated time pressure and found that it significantly reduced detection accuracy. Participants rarely inspected the URLs associated with links in the phishing emails but, when they did, their detection performance improved. Better performance in distinguishing between genuine and phishing emails was linked to lower levels of an intuitive decision-making style and relatively lower education levels amongst a highly educated sample. Older participants and those with greater computer proficiency and stronger email habit showed a slight increase in tendency to judge emails as suspicious. The results are discussed in terms of intervention strategies such as cyber security training to improve resilience to phishing attacks.
Information security awareness (ISA) is integral to protecting an organisation from cyber threats. The aim of this paper is to further establish the validity of the Human Aspects of Information ...Security Questionnaire (HAIS-Q), as an effective instrument for measuring ISA. We present two studies to further establish the construct validity of this instrument. In Study 1, 112 university students completed the HAIS-Q and also took part in an empirical lab-based phishing experiment. Results indicated that participants who scored more highly on the HAIS-Q had better performance in the phishing experiment. This means the HAIS-Q can predict an aspect of information security behaviour, and provides evidence for its convergent validity. In Study 2, the HAIS-Q was administered to a larger and more representative population of 505 working Australians to further establish the construct validity of the instrument. The results of a factor analysis and other statistical techniques provide evidence for the validity of the HAIS-Q as a robust measure of ISA. We also describe the practical implications of the HAIS-Q, particularly how it could be used by information security practitioners.
Purpose The purpose of this study is to investigate the extent to which a sample of the Australian cybersecurity industry is impacted by burnout. Design/methodology/approach Based on the review of ...the literature, this research investigates the following three hypotheses. Gender will significantly predict burnout scores. Those who identify as women will score higher on average than those who identify as men (because of being in a male-dominated industry). Self-reported burnout will differ across job roles. In addition, the authors expect these relationships to hold across the three dimensions of burnout, namely, emotional exhaustion, depersonalisation and professional efficacy. Sleep quality will be associated with burnout. Findings Gender and job role were significant predictors of emotional exhaustion, but not depersonalisation or professional efficacy. The interaction between gender and job role was also significant. Senior managers experienced poorer quality sleep, and poorer sleep quality was associated with greater reported emotional exhaustion at work. For emotional exhaustion, female respondents who worked in security consultant roles tended to score higher than their male counterparts. Practical implications Left unaddressed, the high level of workplace burnout may add to the well-being and retention problems developing within the cybersecurity community. These results indicate that organisations should look to measure the well-being of their own cyber workforce and implement meaningful changes if they wish to keep their cyber talent and enable them to thrive at work. Originality/value This research paper is an extension of a previous paper by the same authors which is titled “Is Your CISO Burnt Out Yet”. This paper examined the demographic differences in workplace burnout among cybersecurity professionals.
Two experiments were conducted examining the effectiveness of visualizations of unstructured texts. The first experiment presented transcriptions of unrehearsed dialog and the second used emails. ...Both experiments showed an advantage in overall performance for semantically structured two-dimensional (2D) spatialized layouts, such as multidimensional scaling (MDS), over structured and non-structured list displays. The second experiment also demonstrated that this advantage is not simply due to the 2D nature of the display, but the combination of 2D display and the semantic structure underpinning it. Without this structure, performance fell to that of a Random List of documents. The effect of document type in this study and in Butavicius and Lee's (2007) study on visualizations of news articles may be partly described by a change in bias on a speed-accuracy trade-off. At one extreme, users were accurate but slow in answering questions based on the dialog texts while, at the other extreme, users were fast but relatively inaccurate when responding to queries about emails. Similarly, users could respond accurately using the non-structured list interface; however, this was at the cost of very long response times and was associated with a technique whereby participants navigated by clicking on neighboring document representations. Implications of these findings for real-world applications are discussed.
► Two user studies assessed list and spatialized displays (structured and unstructured). ► The first study used emails and the second used transcriptions of spontaneous speech. ► Overall, spatialized displays outperformed list-based displays. ► Without content-based structuring, the spatialized display had no advantage over a list. ► Users could be very accurate with an unstructured list but only at the cost of speed.
Accurate matching of unfamiliar faces is vital in security and forensic applications, yet previous research has suggested that humans often perform poorly when matching unfamiliar faces. Hairstyle ...and facial hair can strongly influence unfamiliar face matching but are potentially unreliable cues. This study investigated whether increased attention to the more stable internal face features of eyes, nose, and mouth was associated with more accurate face‐matching performance. Forty‐three first‐year psychology students decided whether two simultaneously presented faces were of the same person or not. The faces were displayed for either 2 or 6 seconds, and had either similar or dissimilar hairstyles. The level of attention to internal features was measured by the proportion of fixation time spent on the internal face features and the sensitivity of discrimination to changes in external feature similarity. Increased attention to internal features was associated with increased discrimination in the 2‐second display‐time condition, but no significant relationship was found in the 6‐second condition. Individual differences in eye‐movements were highly stable across the experimental conditions.
PDF
