Human Aspects of Information Security and Assurance

Nathan Clarke, Steven Furnell

► To cite this version:

Nathan Clarke, Steven Furnell. Human Aspects of Information Security and Assurance: 14th IFIP WG 11.12 International Symposium, HAISA 2020, Mytilene, Lesbos, Greece, July 8-10, 2020, Proceedings. Springer International Publishing, AICT-593, 2020, IFIP Advances in Information and Communication Technology, 978-3-030-57403-1. 10.1007/978-3-030-57404-8. hal-03657705

HAL Id: hal-03657705

https://inria.hal.science/hal-03657705

Submitted on 3 May 2022

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Editor-in-Chief

Kai Rannenberg, Goethe University Frankfurt, Germany

Editorial Board Members

TC 1 – Foundations of Computer Science
Luís Soares Barbosa①, University of Minho, Braga, Portugal

TC 2 – Software: Theory and Practice
Michael Goedicke, University of Duisburg-Essen, Germany

TC 3 – Education
Arthur Tatnall①, Victoria University, Melbourne, Australia

TC 5 – Information Technology Applications
Erich J. Neuhold, University of Vienna, Austria

TC 6 – Communication Systems
Burkhard Stiller, University of Zurich, Zürich, Switzerland

TC 7 – System Modeling and Optimization
Fredi Tröltzsch, TU Berlin, Germany

TC 8 – Information Systems
Jan Pries-Heje, Roskilde University, Denmark

TC 9 – ICT and Society
David Kreps①, University of Salford, Greater Manchester, UK

TC 10 – Computer Systems Technology
Ricardo Reis①, Federal University of Rio Grande do Sul, Porto Alegre, Brazil

TC 11 – Security and Privacy Protection in Information Processing Systems
Steven Furnell①, Plymouth University, UK

TC 12 – Artificial Intelligence
Eunika Mercier-Laurent①, University of Reims Champagne-Ardenne, Reims, France

TC 13 – Human-Computer Interaction
Marco Winckler①, University of Nice Sophia Antipolis, France

TC 14 – Entertainment Computing
Rainer Malaka, University of Bremen, Germany
# IFIP – The International Federation for Information Processing

IFIP was founded in 1960 under the auspices of UNESCO, following the first World Computer Congress held in Paris the previous year. A federation for societies working in information processing, IFIP's aim is two-fold: to support information processing in the countries of its members and to encourage technology transfer to developing nations. As its mission statement clearly states:

> IFIP is the global non-profit federation of societies of ICT professionals that aims at achieving a worldwide professional and socially responsible development and application of information and communication technologies.

IFIP is a non-profit-making organization, run almost solely by 2500 volunteers. It operates through a number of technical committees and working groups, which organize events and publications. IFIP's events range from large international open conferences to working conferences and local seminars.

The flagship event is the IFIP World Computer Congress, at which both invited and contributed papers are presented. Contributed papers are rigorously refereed and the rejection rate is high.

As with the Congress, participation in the open conferences is open to all and papers may be invited or submitted. Again, submitted papers are stringently refereed.

The working conferences are structured differently. They are usually run by a working group and attendance is generally smaller and occasionally by invitation only. Their purpose is to create an atmosphere conducive to innovation and development. Refereeing is also rigorous and papers are subjected to extensive group discussion.

Publications arising from IFIP events vary. The papers presented at the IFIP World Computer Congress and at open conferences are published as conference proceedings, while the results of the working conferences are often published as collections of selected and edited papers.

IFIP distinguishes three types of institutional membership: Country Representative Members, Members at Large, and Associate Members. The type of organization that can apply for membership is a wide variety and includes national or international societies of individual computer scientists/ICT professionals, associations or federations of such societies, government institutions/government related organizations, national or international research institutes or consortia, universities, academies of sciences, companies, national or international associations or federations of companies.

More information about this series at http://www.springer.com/series/6102
Nathan Clarke · Steven Furnell (Eds.)

Human Aspects of
Information Security
and Assurance

14th IFIP WG 11.12 International Symposium, HAISA 2020
Mytilene, Lesbos, Greece, July 8–10, 2020
Proceedings

<figure><img src="image_2.png" /></figure>

Springer
Editors

Nathan Clarke

University of Plymouth
Plymouth, UK

Steven Furnell

University of Plymouth
Plymouth, UK

ISSN 1868-4238

ISSN 1868-422X (electronic)

IFIP Advances in Information and Communication Technology

ISBN 978-3-030-57403-1

ISBN 978-3-030-57404-8 (eBook)

https://doi.org/10.1007/978-3-030-57404-8

© IFIP International Federation for Information Processing 2020

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
# Preface

It is now widely recognized that technology alone cannot provide the answer to security problems. A significant aspect of protection comes down to the attitudes, awareness, behavior, and capabilities of the people involved, and they often need support in order to get it right. Factors such as lack of awareness and understanding, combined with unreasonable demands from security technologies, can dramatically impede their ability to act securely and comply with policies. Ensuring appropriate attention to the needs of users is therefore a vital element of a successful security strategy, and they need to understand how the issues may apply to them and how to use the available technology to protect their systems.

With the above in mind, the Human Aspects of Information Security and Assurance (HAISA) symposium series specifically addresses information security issues that relate to people. It concerns the methods that inform and guide users' understanding of security, and the technologies that can benefit and support them in achieving protection.

This book presents the proceedings from the 2020 event, held virtually due to the COVID-19 pandemic, during July 2020. A total of 27 reviewed papers are included, spanning a range of topics including issues related directly to the pandemic and the impacts on contact-tracing applications and privacy, education and awareness, and management and modeling of security. All of the papers were subject to double-blind peer review, with each being reviewed by at least two members of the International Program Committee. We are grateful to all of the authors for submitting their work and sharing their findings.

The HAISA symposium is the official event of IFIP Working Group 11.12 on Human Aspects of Information Security and Assurance, and we would like to thank Prof. Kerry-Lynn Thomson for supporting the event as Working Group chair. We would also like to acknowledge the significant work undertaken by our International Program Committee and recognize their efforts in reviewing the submissions and ensuring the quality of the resulting event and proceedings. Finally, we would like to thank Dr. Christos Kalloniatis and the organizing team for making all the necessary arrangements to enable this symposium to take place.

July 2020

Nathan Clarke

Steven Furnell
# Organization

## General Chairs

<table><tr><td>Nathan Clarke</td><td>University of Plymouth, UK</td></tr><tr><td>Steven Furnell</td><td>University of Plymouth, UK</td></tr></table>

## IFIP TC11.12 Conference Chair

<table><tr><td>Kerry-Lynn Thomson</td><td>Nelson Mandela University, South Africa</td></tr></table>

## Local Organizing Chair

<table><tr><td>Christos Kalloniatis</td><td>University of the Aegean, Greece</td></tr></table>

## Publicity Chair

<table><tr><td>Fudong Li</td><td>University of the Portsmouth, UK</td></tr></table>

## International Program Committee

<table><tr><td>Sal Aurigemma</td><td>University of Tulsa, USA</td></tr><tr><td>Maria Bada</td><td>University of Cambridge, UK</td></tr><tr><td>Peter Bednar</td><td>University of Portsmouth, UK</td></tr><tr><td>Matt Bishop</td><td>UC Davis, USA</td></tr><tr><td>Patrick Bours</td><td>Norwegian University of Science and Technology, Norway</td></tr><tr><td>William Buchanan</td><td>Edinburgh Napier University, UK</td></tr><tr><td>Mauro Cherubini</td><td>University of Lausanne, Switzerland</td></tr><tr><td>Jeff Crume</td><td>IBM, USA</td></tr><tr><td>Adele Da Veiga</td><td>University of South Africa, South Africa</td></tr><tr><td>Ronald Dodge</td><td>Palo Alto Networks, USA</td></tr><tr><td>Paul Dowland</td><td>Edith Cowan University, Australia</td></tr><tr><td>Jan Eloff</td><td>University of Pretoria, South Africa</td></tr><tr><td>Simone Fischer-Huebner</td><td>Karlstad University, Sweden</td></tr><tr><td>Stephen Flowerday</td><td>Rhodes University, South Africa</td></tr><tr><td>Lynn Futcher</td><td>Nelson Mandela University, South Africa</td></tr><tr><td>Sarah Gordon</td><td>USA</td></tr><tr><td>Stefanos Gritzalis</td><td>University of Piraeus, Greece</td></tr><tr><td>Karen Hedström</td><td>Örebro University, Sweden</td></tr><tr><td>Yuxiang Hong</td><td>Hangzhou Dianzi University, China</td></tr><tr><td>John Howie</td><td>Cloud Security Alliance, USA</td></tr><tr><td>Kévin Huguenin</td><td>University of Lausanne, Switzerland</td></tr></table>
<table>
  <tr>
    <td>William Hutchinson</td>
    <td>Edith Cowan University, Australia</td>
  </tr>
  <tr>
    <td>Murray Jennex</td>
    <td>San Diego State University, USA</td>
  </tr>
  <tr>
    <td>Andy Jones</td>
    <td>University of Suffolk, UK</td>
  </tr>
  <tr>
    <td>Christos Kalloniatis</td>
    <td>University of the Aegean, Greece</td>
  </tr>
  <tr>
    <td>Fredrik Karlsson</td>
    <td>Örebro University, Sweden</td>
  </tr>
  <tr>
    <td>Vasilios Katos</td>
    <td>Bournemouth University, UK</td>
  </tr>
  <tr>
    <td>Sokratis Katsikas</td>
    <td>Open University of Cyprus, Cyprus</td>
  </tr>
  <tr>
    <td>Joakim Kavrestad</td>
    <td>University of Skövde, Sweden</td>
  </tr>
  <tr>
    <td>Stewart Kowalski</td>
    <td>Norwegian University of Science and Technology, Norway</td>
  </tr>
  <tr>
    <td>Hennie Kruger</td>
    <td>North-West University, South Africa</td>
  </tr>
  <tr>
    <td>Costas Lambrinoudakis</td>
    <td>University of Piraeus, Greece</td>
  </tr>
  <tr>
    <td>Michael Lavine</td>
    <td>Johns Hopkins University, USA</td>
  </tr>
  <tr>
    <td>Gabriele Lenzini</td>
    <td>University of Luxembourg, Luxembourg</td>
  </tr>
  <tr>
    <td>Shujun Li</td>
    <td>University of Kent, UK</td>
  </tr>
  <tr>
    <td>Javier Lopez</td>
    <td>University of Malaga, Spain</td>
  </tr>
  <tr>
    <td>George Magklaras</td>
    <td>University of Oslo, Norway</td>
  </tr>
  <tr>
    <td>Herb Mattord</td>
    <td>Kennesaw State University, USA</td>
  </tr>
  <tr>
    <td>Haris Mouratidis</td>
    <td>University of Brighton, UK</td>
  </tr>
  <tr>
    <td>Marcus Nohlberg</td>
    <td>University of Skövde, Sweden</td>
  </tr>
  <tr>
    <td>Jason Nurse</td>
    <td>University of Kent, UK</td>
  </tr>
  <tr>
    <td>Malcolm Pattinson</td>
    <td>The University of Adelaide, Australia</td>
  </tr>
  <tr>
    <td>Jacques Ophoff</td>
    <td>Abertay University, UK</td>
  </tr>
  <tr>
    <td>Nathalie Rebe</td>
    <td>University of Burgundy, France</td>
  </tr>
  <tr>
    <td>Karen Renaud</td>
    <td>Abertay University, UK</td>
  </tr>
  <tr>
    <td>Nader Sohrabi Safa</td>
    <td>Coventry University, UK</td>
  </tr>
  <tr>
    <td>Rossouw Von Solms</td>
    <td>Nelson Mandela University, South Africa</td>
  </tr>
  <tr>
    <td>Theo Tryfonas</td>
    <td>University of Bristol, UK</td>
  </tr>
  <tr>
    <td>Aggeliki Tsohou</td>
    <td>Ionian University, Greece</td>
  </tr>
  <tr>
    <td>Kerry-Lynn Thomson</td>
    <td>Nelson Mandela University, South Africa</td>
  </tr>
  <tr>
    <td>Ismini Vasileiou</td>
    <td>De Montfort University, UK</td>
  </tr>
  <tr>
    <td>Jeremy Ward</td>
    <td>Security Consultant, UK</td>
  </tr>
  <tr>
    <td>Merrill Warkentin</td>
    <td>Mississippi State University, USA</td>
  </tr>
  <tr>
    <td>Zihang Xiao</td>
    <td>Palo Alto Networks, USA</td>
  </tr>
  <tr>
    <td>Wei Yan</td>
    <td>Trend Micro, USA</td>
  </tr>
  <tr>
    <td>Ibrahim Zincir</td>
    <td>İzmir University of Economics, Turkey</td>
  </tr>
</table>
# Contents

## Privacy and COVID-19

Australian Attitudes Towards Privacy of Information: Will COVID-19 Make a Difference? 3
*Leah Shanley, Michael N. Johnstone, Michael Crowley, and Patryk Szewczyk*

Concern for Information Privacy: A Cross-Nation Study of the United Kingdom and South Africa. 16
*Adéle Da Veiga and Jacques Ophoff*

A Review of Information Security Aspects of the Emerging Covid-19 Contact Tracing Mobile Phone Applications. 30
*Georgios Magklaras and Lucia N. López-Bojórquez*

## Awareness and Training

Towards a Cross-Cultural Education Framework for Online Safety Awareness 47
*R. Herkanaidu, S. M. Furnell, and M. Papadaki*

Towards an Heuristic Approach to Cybersecurity and Online Safety Pedagogy 58
*Simon Marsden*

ContextBased MicroTraining: A Framework for Information Security Training 71
*Joakim Kävrestad and Marcus Nohlberg*

## Social Engineering

Employees' Interest in Professional Advancement on LinkedIn Increases Susceptibility to Cyber-Social Engineering: An Empirical Test 85
*Mohammed Khaled N. Alotaibi*

Does Ubuntu Influence Social Engineering Susceptibility? 97
*Ntsewa B. Mokobane and Reinhardt A. Botha*

Quantifying Susceptibility to Spear Phishing in a High School Environment Using Signal Detection Theory 109
*P. Unchit, S. Das, A. Kim, and L. J. Camp*
## Security Behaviour

KidsDoodlePass: An Exploratory Study of an Authentication Mechanism for Young Children
Esra Alkhamis, Helen Petrie, and Karen Renaud
123

Information Security Behavioural Threshold Analysis in Practice: An Implementation Framework
D. P. Snyman and H. A. Kruger
133

Information Security Behavior: Development of a Measurement Instrument Based on the Self-determination Theory
Yotamu Gangire, Adéle Da Veiga, and Marlien Herselman
144

## Education

Addressing SME Characteristics for Designing Information Security Maturity Models
Bilge Yigit Ozkan and Marco Spruit
161

Cyber Security Education and Training Delivering Industry Relevant Education and Skills via Degree Apprenticeships
Ismini Vasileiou
175

Internet Self-regulation in Higher Education: A Metacognitive Approach to Internet Addiction
Dean John von Schoultz, Kerry-Lynn Thomson, and Johan Van Niekerk
186

## End-User Security

Bayesian Evaluation of User App Choices in the Presence of Risk Communication on Android Devices
B. Momenzadeh, S. Gopavaram, S. Das, and L. J. Camp
211

Exploring Information Security and Domestic Equality
Marcus Nohlberg and Joakim Kävrestad
224

Responding to KRACK: Wi-Fi Security Awareness in Private Households
Jan Freudenreich, Jake Weidman, and Jens Grossklags
233

## Usable Security

Exploring the Meaning of “Usable Security”
Markus Lennartsson, Joakim Kävrestad, and Marcus Nohlberg
247

Dyslexia and Password Usage: Accessibility in Authentication Design
Karen Renaud, Graham Johnson, and Jacques Ophoff
259
Securing User eXperience: A Review for the End-Users'

<table><tr><td>Software Robustness</td><td>269</td></tr><tr><td>Panagiotis Zagouras and Christos Kalloniatis</td><td></td></tr></table>

## Security Policy

SMEs' Confidentiality Concerns for Security Information Sharing. 289
Alireza Shojaifar and Samuel A. Fricker

Validation of an Information Privacy Perception Instrument
at a Zimbabwean University. 300
Kudakwashe Maguraushe, Adéle Da Veiga, and Nico Martins

Are We Really Informed on the Rights GDPR Guarantees? 315
Maria Sideri and Stefanos Gritzalis

## Attitudes and Perceptions

"Most Companies Share Whatever They Can to Make Money!":
Comparing User's Perceptions with the Data Practices of IoT Devices. 329
Mahdi Nasrullah Al-Ameen, Apoorva Chauhan, M. A. Manazir Ahsan,
and Huzeyfe Kocabas

Analysis of the 'Open Source Internet Research Tool':
A Usage Perspective from UK Law Enforcement 341
Joseph Williams and Paul Stephens

Critical Analysis of Information Security Culture Definitions 353
Zainab Ruhwanya and Jacques Ophoff

Author Index 367