Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/13/2019
05:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Does Personality Make You Vulnerable to Cybercrime?

A new study explores the connections between personality traits and susceptibility to different cyberattacks.

Could extraversion make you more vulnerable to social engineering attacks? It's a possibility, as seen in research investigating links between personality traits and vulnerability to cybercrime.

The study, compiled by ESET and the Myers-Briggs company, drills down into the "human factor" responsible for many security breaches. Verizon's DBIR found 20% of security incidents originate from people within an organization; separate data from Dtex shows nearly two-thirds (64%) of insider threats come from people who put the company at risk with careless behavior.

Myers-Briggs' goal in this research is to determine whether individuals' personality traits make them more susceptible to different types of security threats. As part of an ongoing study, it has so far polled 520 respondents who had completed the Myers-Briggs Type Indicator (MBTI) questionnaire. John Hackston, head of thought leadership for the company, argues the MBTI is a practical starting point for personality-based research as many people and businesses already use it for self-development.

If you're not familiar, the MBTI quantifies "best-fit" personality type using four traits: extraversion/introversion (E/I), which shows where you get energy; sensing/intuition (S/N), which indicates how you learn information; thinking/feeling (T/F), which tells how you make decisions; and judging/perceiving (J/P), which indicates whether you prefer a more structured or open-ended lifestyle. For the security-focused study, respondents also answered questions about their jobs, biographical data, cybersecurity habits, phishing experiences, and overall security knowledge.

"Everybody in an organization is an insider risk when it comes to cybersecurity," says Hackston. "We want to look at how MBTI relates to those to give people guidelines … so they can have guidelines to say 'What things should I look out for?' and 'What things might be my particular downfalls if I'm not careful?'"

There is no single personality type that's more security-savvy than the others, he explains. Similarly, being security-savvy doesn't necessarily mean someone is a lower-risk employee. Oftentimes, security practices boil down to the two middle letters of the MBTI type, which are intended to dictate how an individual processes data and how they make decisions.

As an example, Hackson points to the personality type INTP: a logical, analytical, detail-oriented and introverted person. Myers-Briggs' research shows people who are INTPs score higher on questions about cybersecurity knowledge; unfortunately, they're also more likely to think rules don't apply to them. An ESTP, an extraverted type who focuses on facts and logic, is also likely to flout rules.

The way a phishing attack is communicated can make a difference in which types fall for it, Hackston adds. An email that seems factual and promises someone can save money or be more efficient, for example, will be more effective on the objective, analytical "ST" types. The trusting, loyal "SF" type may be more likely to respond to an email that claims to be from an authority figure, and the warm, altruistic "NF" may fall for a phishing attack disguised as a charity email.

In general, researchers found, extraverts are more likely to fall for social engineering attacks. Their need to stay in tune with the world is "both a boon and a curse," Hackston says. While they're informed of new threats, extraverts' tendency to focus on people puts them at risk. A desire to build a personal connection may lure an extravert into a social engineering trap.

The Big 5

Of course, the MBTI isn't the only way to classify personality. Dr. Margaret Cunningham, principal research scientist for human behavior with Forcepoint X-Labs, has explored security risk alongside the "Big 5" personality traits: neuroticism, extraversion, openness, agreeableness, and conscientiousness, and she agrees extraversion can prove risky.

"We find in the Big 5 personality [traits] that agreeable people tend to be more willing to share information, which makes them more susceptible to social engineering attacks," she adds. When asked what they're doing, an extravert is more likely to be immediately transparent.

Conscientious people lean toward the practical side and use greater caution, she says. "These are the people who read service agreements," she jokes. "They're going to check the settings on a cookie pop-up. Those people tend to be a little less likely to [fall for] phishing attempts."

At the same time, it's important to note personality is a spectrum, Cunningham emphasizes. It's the people who exhibit the extremes of different personality facets who are easiest to associate with predictive behavior. You can be a detail-oriented extravert, for example, or an introvert who accidentally spills too much information to an attacker or falls for a phishing email.

"Knowing that these are the things that push our buttons helps us to be more wary," says Hackston. Security awareness training isn't a "one size fits all" project, and while organizations can't be expected to build different training programs for each personality type, it helps to inform employees where their weaknesses may lie so they're attuned to potential threats. As Cunningham says, people will continue to make mistakes even if they are informed of the risk.

"No matter how aware we are, we will continue to make mistakes and be phished," she says. "We'll continue to click not because of personality, but the limitations we have in cognitive skills like memory and attention."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8818
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore...
CVE-2020-8819
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass ...
CVE-2020-9385
PUBLISHED: 2020-02-25
A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called from eanx in upcean.c during EAN barcode generation.
CVE-2020-9382
PUBLISHED: 2020-02-24
An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this extension) via MediaWiki's } parser function.
CVE-2020-1938
PUBLISHED: 2020-02-24
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that ...