Understanding Expert and End User Behavior in IT Security

The widespread usage of Information Technology (IT) and the increased connectivity of devices made the systems more attractive for attackers. To keep up with technical developments, users not only have to keep up with the current hard- and software trends but also have to be aware of the IT security threats. Experts therefore conduct “awareness campaigns” to support the users facing these threats. In the first part of this thesis, we analyze the experts’ opinions concerning what these campaigns should achieve. While some argue that knowledge of the threats is enough, others see correct behavior as essential. We then present a user study on how experts behave in the presence of threats. In particular, we compared the behavior of students from technical faculties when trying to understand clear and obfuscated code. Obfuscation is of importance in this context since attackers often apply these transformations of source code on their malware, to make it more difficult for security analysts to detect the malicious code. Our study shows that even experienced software analysts have to change their analysis methods to overcome the influence of code obfuscation on the understandability of code. This study further shows that there might be differences concerning which type of obfuscation method was applied to the code. This study supports the findings of Ceccato et al. (Empirical Software Engineering 2014) and gives a first empirical proof that the differentiation of resilience and potency of obfuscating transformations proposed by Collberg et al. (Technical Report 148) might be adequate. Turning to non-expert users, we first investigate buying behavior on eBay. Based on 34 semi-structured interviews, we show which factors of a listing users take into account when buying. Further, we also show which part of the buying processes is affected by the different factors. Our results show that although some users try to prevent fraud by only buying products from “trustworthy” sellers, others completely rely on secure buying options ignoring indicators for the trustworthiness of a seller. This is because some users find it too hard to spot fraud using the current reputation system of eBay. We then show how severe this problem is and how the situation might be improved. In a user- experiment with 40 UK and 41 German participants using an eBay-like reputation system and an interactive visualization by Sanger and Pernul (ARES 2014) we investigated how well users can spot fraudulent sellers. Our results show that the interactive visualization helps users to spot fraud better and has no significant decreases in usability. After analyzing how users evaluate threats based on data about other users, we investigate how users present themselves online. We researched how Online Social Networks (OSNs) are being used. A new ephemeral way of posting called “Stories” has been integrated to several of these systems lately. Using a survey as well as 22 interviews, we show how users adapted this feature into their everyday posting behavior. This research uncovers the necessary prerequisites for users to post a Story. Further, we detect four types of Story posts which differ in the reasons why and how users post them. Based on utility and privacy concerns of users, we then describe how the past, present and future of users influence their posting behavior, explaining differences concerning the popularity of the OSNs for Story posting.