Explaining information seeking intentions: Insights from a Slovenian social engineering awareness campaign
Simon Vrhovec, Igor Bernik, Blaž Markelj
Abstract
The human factor remains one of the key challenges in cybersecurity despite effective technical countermeasures in place. This study aims to determine what motivates individuals to seek information about social engineering by investigating the determinants of behavioral intention to follow the materials of a social engineering awareness campaign in Slovenia. A quantitative survey of individuals in Slovenia (N=542) aged 15 or older was administered with participants recruited through University of Maribor students. Data were collected on constructs related to the protection motivation theory (PMT) and the theory of planned behavior (TPB) as well as privacy concerns and perceived performance of authorities. The survey instrument was validated with a confirmatory factor analysis. Covariance-based structural equation modeling (CB-SEM) was used to determine relationships between constructs and analysis of differences between students and employed individuals. Results indicate perceived threat, subjective norm, attitude toward behavior and authorities performance are all significant predictors of behavioral intention. The associations between perceived threat and behavioral intention, and privacy concern and attitude towards behavior was not significant among employed individuals. Among students, trust in authorities was not a significant predictor of authorities performance. This study has several implications. The results of this study suggest that fear appeals may be effective in motivating individuals to seek information about social engineering attacks thus improving the effectiveness of awareness campaigns. They also offer some insights into how to improve messaging towards the target populations. Messaging emphasizing perceived threat may directly increase information seeking intention while messaging emphasizing coping with social engineering may do so indirectly through attitude towards behavior. This study also indicates that messaging should be tailored to the target population (e.g., messaging emphasizing perceived threat may be much less effective for employed individuals than students).