影響使用者遭受社交工程誘導因素之研究

A Study on the Factors Influencing Individuals Succumb to Social Engineering

胡聖良(Hu Sheng Liang)

指導教授 ： 阮金聲

國立中正大學/管理學院/資訊管理學系/碩士(2012年)

摘要

隨著資訊科技的日益普遍，人們對於資訊安全的警覺心也逐漸提昇，雖然可以靠一些資訊安全的實體設備來加強企業內的防護以降低資訊安全的威脅，但是資訊安全的漏洞大部分都是來自於人為地疏失。鑑於透過網路的社交工程對人們有著強大的威脅，本研究以使用者資訊安全的自我效能上之相關因素來分析人們可能遭受社交工程誘導的原因，本研究的結果顯示，使用者是否會被社交工程誘導與使用者對於Email 的認知風險高低有很大的關聯性，而與資訊安全的自我效能較無關聯性。在目前各界漸漸重視資訊安全的環境中，組織的管理者除了要讓使用者瞭解各種如何保護資訊安全的行為外，亦需要讓終端使用者瞭解Email 所來帶之風險，進而保護組織內之資訊安全。

關鍵字

資安威脅 ； 資訊安全自我效能 ； SPAM ； 社交工程 ； 認知風險

並列摘要

As information technology becomes increasingly common, the vigilance people have toward information security has also heightened gradually. Though there are physical devices for information security that can be relied on to strengthen protection within an enterprise in order to reduce threats to information security, the loopholes of information security are mostly caused by human negligence. Seeing that social engineering via the Internet is strongly threatening the information security of individuals, in this study, we analyze the possible reasons why individuals are seduced via social engineering, using the related factors of users’ self-efficacy in information security. The results of this study indicate that whether users are seduced via social engineering is substantially correlated to the risk they perceive in e-mails. Nowadays, as people from all fields have gradually put more emphasis on information security, in addition to helping users to understand all kinds of ways to enhance the security of information, organizational managers must also let end-users understand the risks in using e-mail, thereby securing information within their organizations.

並列關鍵字

Self-Efficacy ； SPAM ； Social Engineering ； Information Security Threat ； Perceived Risk

參考文獻

1. Aarts, H., Verplanken, B., and A. V. Knippenberg, “Predicting Behaviour from Actions in the Past: Repeated Decision Making or a Matter of Habit?,” Journal of Applied Social Psychology,Vol. 28, 1998, pp. 1355-1374.

3. Acquisti, A. and J. Grossklags, “Privacy and Rationality in Individual Decision Making,” IEEE Security and Privacy, Vol. 3, 2005, pp. 26-33.

6. Arpan, J., “Escalation of commitment in troubled IT projects: Influence of project risk factors and self-efficacy on the perception of risk and the commitment to a failing project,” International Journal of Project Management, Vol. 29, Iss. 7, 2011, pp. 934-945.

7. Bagozzi, R. P., “Attitudes, Intention, and Behaviour: A Test of Some Key Hypotheses,” Journalof Personality and Social Psychology, Vol. 41, 1981, pp. 607-627.

8. Bandura, A. “Self-Efficacy: Toward a Unifying Theory of Behavioral Change,” Psychological Review, Vol. 84, Iss. 2, 1977, pp. 191-215.