Social engineering is a growing source of information security concern. Exploits appear to evolve, with increasing levels of sophistication, in order to target multiple victims. Despite increased concern with this risk, there has been little research activity focused upon social engineering in the potentially rich hunting ground of social networks. In this setting, factors that influence users’ proficiency in threat detection need to be understood if we are to build a profile of susceptible users, develop suitable advice and training programs, and generally help address this issue for those individuals most likely to become targets of social engineering in social networks. To this end, the present study proposes and validates a user-centric framework based on four perspectives: socio-psychological, habitual, socio-emotional, and perceptual. Previous research tends to rely on selected aspects of these perspectives and has not combined them into a single model for a more cohesive understanding of user’s susceptibility.

The popularity of social networking sites has attracted billions of users to engage and share their information on these networks. The vast amount of circulating data and information expose these networks to several security risks. Social engineering is one of the most common types of threat that may face social network users. Training and increasing users' awareness of such threats is essential for maintaining continuous and safe use of social networking services. Identifying the most vulnerable users in order to target them for these training programs is desirable for increasing the effectiveness of such programs. Few studies have investigated the effect of individuals' characteristics on predicting their vulnerability to social engineering in the context of social networks. To address this gap, the present study developed a novel model to predict user vulnerability based on several perspectives of user characteristics. The proposed model includes interactions between different social network-oriented factors such as level of involvement in the network, motivation to use the network, and competence in dealing with threats on the network. The results of this research indicate that most of the considered user characteristics are factors that influence user vulnerability either directly or indirectly. Furthermore, the present study provides evidence that individuals' characteristics can identify vulnerable users so that these risks can be considered when designing training and awareness programs.

The current research aims to gain insight on the role of the five personality traits (conscientiousness, neuroticism, extraversion, agreeableness, and openness to experience) in users' susceptibility to cyber-attack victimisation in the context of online social networks and investigates how different factors such as users' competence to deal with online threats, users' trust in other members in social network as well as trusting the network's service provider, users' motivation to engage in the network, and users' experience with cyber-crimes mediate and control this relationship. The effect of personality traits on user's online risky behaviour is still a controversial topic in cyber security research. Therefore, the present study proposes a mediation model that includes the five personality traits and the four mediators that together affect the user's likelihood of falling victim to cyberattacks. The study conducted a scenario-based experiment with 316 participants to test the study model and the hypotheses' significance. Empirical results indicate that all five personality traits, except openness, have significant indirect effect on users' susceptibility to cyber-attack victimisation.

No abstract

The Strathprints institutional repository (https://strathprints.strath.ac.uk) is a digital archive of University of Strathclyde research outputs. It has been developed to disseminate open access research outputs, expose data about those outputs, and enable the management and persistent access to Strathclyde's intellectual output.1 Abstract-The current research aims to gain insight on user competence in detecting security threats in the context of online social networks (OSNs) and investigates the multidimensional space that determines this user competence level. The role of user competence and its dimensions in facilitating the detection of online threats is still a controversial topic in the information security field. The dimensions used to measure the concept are self-efficacy, security awareness, privacy awareness, and cybercrime experience. The scales used to measure those factors can determine the level of user competence in evaluating risks associated with social network usage. The measurement scales employed here have been validated using an item-categorization approach that, to our knowledge, has never before been used in information security research. The result of this study provides evidence for the suitability and validity of the user competence dimensions and associated measurement scales.