MIS Distinguished Speaker Series

Temple University

You are here: Home / Archives for Cyber Security

Cyber Security

Oct 2 – Ryan Wright to present “A Multi-level Contextualized View of Phishing Susceptibility”

By

A Multi-level Contextualized View of Phishing Susceptibility

by

Ryan Wright

C. Coleman McGehee Professor of Commerce
Director, Certificate in Cybersecurity
Associate Director, Center for the Management of Information Technology
McIntire School of Commerce
University of Virginia

Friday, Oct 2

9 – 10 am | Zoom

Abstact:

With billions of dollars in annual IT security-related damages, organizations are well aware of the critical need for protection from phishing attacks with IT security policies and best practices. However, after decades of academic research and industry interventions, phishing remains one of the top cybersecurity threats to organizations. This significant effort to combat phishing by both practitioners and academics has largely focused on three factors: 1) individual characteristics, 2) message characteristics, and 3) interventions. We advocate for moving beyond this predominant focus to encompass a context-driven understanding of phishing susceptibility. We develop a phishing susceptibility model that includes how contextual factors, including workgroup characteristics and an individual’s position in organizational social networks, can be used to predict susceptibility to phishing messages. We show the utility of this approach through a field study of the ability to detect deception email communication using a multi-wave phishing simulation in the finance division of a large university in the US. Our findings extend the understanding of phishing susceptibility through a model that incorporates variation in the workgroup and network-based factors. In addition, this research generates practical insights regarding how organizations may identify and support employees that are likely to be susceptible to phishing attacks.

March 30 – H. Raghav Rao to Present “A Longitudinal Study of Unauthorized Access Attempts on Information Systems: The Role of Opportunity Contexts”

By

A Longitudinal Study of Unauthorized Access Attempts on Information Systems: The Role of Opportunity Contexts

by

H. Raghav Rao

AT&T Distinguished Chair in Infrastructure Assurance and Security
Department of Information Systems and Cyber Security
College of Business, University of Texas at San Antonio

Friday, March 30, 2018

10:30 AM – noon

Speakman Hall Suite 200

 

Abstract

This study investigates employees’ unauthorized access attempts on information systems (IS) applications in a financial institution and how opportunity contexts impact such attempts. By contextualizing multilevel criminal opportunity theory, we develop a model that considers both employee- and department-level opportunity contexts. At the employee level, we hypothesize that the number of IS apps an employee has legitimately accessed and the level of confidentiality of those apps, together with the time when and the location where the employee initiated the access, affect the likelihood of unauthorized attempts. At the department level, we hypothesize that department size moderates the impact of employee-level contextual variables on the likelihood of unauthorized attempts occurring. To test the hypotheses, we collected six months of access log data from an enterprise single sign-on system of a financial institution. We find the hypothesized main effects of all employee-level contextual variables are supported. In addition, department size reinforces the effects of off-hour access, off-site access, and their interaction term. Robustness analyses indicate that the results do not align with employees who do not know the systems well enough and may be making mistakes. We also discuss the theoretical and practical implications of the study.