DocumentCode :
659236
Title :
Applying the Lost-Letter Technique to Assess IT Risk Behaviour
Author :
Lastdrager, Elmer ; Montoya, Lorena ; Hartel, Pieter ; Junger, Marianne
Author_Institution :
Distrib. & Embedded Security Group, Univ. of Twente, Enschede, Netherlands
fYear :
2013
fDate :
29-29 June 2013
Firstpage :
2
Lastpage :
9
Abstract :
Information security policies are used to mitigate threats for which a technical prevention is not feasible. Compliance with information security policies is a notoriously difficult issue. Social sciences could provide tools to empirically study compliance with policies. We use a variation of the lost-letter technique to study IT risk behaviour, using USB keys instead of letters. The observational lost-letter study by Farrington and Knight (1979) was replicated in a university setting by dropping 106 USB keys. Labels on the USB keys were used to vary characteristics of the alleged victim. Observers noted characteristics of people who picked a USB key up and whether the USB key was returned. Results show that USB keys in their original box are stolen more than used ones and that people aged 30 or younger and those who place a found USB key in their pocket are more likely to steal. This suggests that the decision to steal a USB key is taken at the moment of pick up, despite ample opportunity to return it. The lost USB key technique proved to be a feasible method of data collection to measure policy compliance and thus also risk behaviour.
Keywords :
data acquisition; peripheral interfaces; psychology; risk analysis; security of data; social sciences computing; IT risk behaviour assessment; USB key stealing; USB key technique; data collection; information security policy; lost-letter technique; policy compliance measure; social sciences; threats mitigation; Buildings; Educational institutions; Information security; Legged locomotion; Predictive models; Universal Serial Bus;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Socio-Technical Aspects in Security and Trust (STAST), 2013 Third Workshop on
Conference_Location :
New Orleans, LA
Type :
conf
DOI :
10.1109/STAST.2013.15
Filename :
6691363
Link To Document :
بازگشت