Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/13/2019
05:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Does Personality Make You Vulnerable to Cybercrime?

A new study explores the connections between personality traits and susceptibility to different cyberattacks.

Could extraversion make you more vulnerable to social engineering attacks? It's a possibility, as seen in research investigating links between personality traits and vulnerability to cybercrime.

The study, compiled by ESET and the Myers-Briggs company, drills down into the "human factor" responsible for many security breaches. Verizon's DBIR found 20% of security incidents originate from people within an organization; separate data from Dtex shows nearly two-thirds (64%) of insider threats come from people who put the company at risk with careless behavior.

Myers-Briggs' goal in this research is to determine whether individuals' personality traits make them more susceptible to different types of security threats. As part of an ongoing study, it has so far polled 520 respondents who had completed the Myers-Briggs Type Indicator (MBTI) questionnaire. John Hackston, head of thought leadership for the company, argues the MBTI is a practical starting point for personality-based research as many people and businesses already use it for self-development.

If you're not familiar, the MBTI quantifies "best-fit" personality type using four traits: extraversion/introversion (E/I), which shows where you get energy; sensing/intuition (S/N), which indicates how you learn information; thinking/feeling (T/F), which tells how you make decisions; and judging/perceiving (J/P), which indicates whether you prefer a more structured or open-ended lifestyle. For the security-focused study, respondents also answered questions about their jobs, biographical data, cybersecurity habits, phishing experiences, and overall security knowledge.

"Everybody in an organization is an insider risk when it comes to cybersecurity," says Hackston. "We want to look at how MBTI relates to those to give people guidelines … so they can have guidelines to say 'What things should I look out for?' and 'What things might be my particular downfalls if I'm not careful?'"

There is no single personality type that's more security-savvy than the others, he explains. Similarly, being security-savvy doesn't necessarily mean someone is a lower-risk employee. Oftentimes, security practices boil down to the two middle letters of the MBTI type, which are intended to dictate how an individual processes data and how they make decisions.

As an example, Hackson points to the personality type INTP: a logical, analytical, detail-oriented and introverted person. Myers-Briggs' research shows people who are INTPs score higher on questions about cybersecurity knowledge; unfortunately, they're also more likely to think rules don't apply to them. An ESTP, an extraverted type who focuses on facts and logic, is also likely to flout rules.

The way a phishing attack is communicated can make a difference in which types fall for it, Hackston adds. An email that seems factual and promises someone can save money or be more efficient, for example, will be more effective on the objective, analytical "ST" types. The trusting, loyal "SF" type may be more likely to respond to an email that claims to be from an authority figure, and the warm, altruistic "NF" may fall for a phishing attack disguised as a charity email.

In general, researchers found, extraverts are more likely to fall for social engineering attacks. Their need to stay in tune with the world is "both a boon and a curse," Hackston says. While they're informed of new threats, extraverts' tendency to focus on people puts them at risk. A desire to build a personal connection may lure an extravert into a social engineering trap.

The Big 5

Of course, the MBTI isn't the only way to classify personality. Dr. Margaret Cunningham, principal research scientist for human behavior with Forcepoint X-Labs, has explored security risk alongside the "Big 5" personality traits: neuroticism, extraversion, openness, agreeableness, and conscientiousness, and she agrees extraversion can prove risky.

"We find in the Big 5 personality [traits] that agreeable people tend to be more willing to share information, which makes them more susceptible to social engineering attacks," she adds. When asked what they're doing, an extravert is more likely to be immediately transparent.

Conscientious people lean toward the practical side and use greater caution, she says. "These are the people who read service agreements," she jokes. "They're going to check the settings on a cookie pop-up. Those people tend to be a little less likely to [fall for] phishing attempts."

At the same time, it's important to note personality is a spectrum, Cunningham emphasizes. It's the people who exhibit the extremes of different personality facets who are easiest to associate with predictive behavior. You can be a detail-oriented extravert, for example, or an introvert who accidentally spills too much information to an attacker or falls for a phishing email.

"Knowing that these are the things that push our buttons helps us to be more wary," says Hackston. Security awareness training isn't a "one size fits all" project, and while organizations can't be expected to build different training programs for each personality type, it helps to inform employees where their weaknesses may lie so they're attuned to potential threats. As Cunningham says, people will continue to make mistakes even if they are informed of the risk.

"No matter how aware we are, we will continue to make mistakes and be phished," she says. "We'll continue to click not because of personality, but the limitations we have in cognitive skills like memory and attention."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Another COVID-19 Side Effect: Rising Nation-State Cyber Activity
Stephen Ward, VP, ThreatConnect,  7/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15600
PUBLISHED: 2020-07-07
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVE-2020-15599
PUBLISHED: 2020-07-07
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
CVE-2020-8916
PUBLISHED: 2020-07-07
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to res...
CVE-2020-12821
PUBLISHED: 2020-07-07
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
CVE-2020-15008
PUBLISHED: 2020-07-07
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user su...