Many phish in the : A coexisting-choice-criteria model of security behavior

Area of Science:

• Decision Theory
• Cybersecurity
• Behavioral Economics

Background:

• Normative decision theory fails to model human responses to advanced persistent threat (APT) social engineering.
• Behavioral decision theory is insufficient for capturing emotional and peripheral-route persuasion in social engineering.
• Existing signal detection theory (SDT) models inadequately represent phishing detection pathways.

Purpose of the Study:

• Introduce a generalized decision theory to model human responses to sophisticated social engineering.
• Provide a framework that accounts for multiple coexisting choice criteria in decision-making.
• Explicitly identify and represent different peripheral-route persuasion pathways in cybersecurity contexts.

Main Methods:

• Developed a generalized decision theory accommodating multiple choice criteria ($K$).
• Operationalized criterion selection using a probability distribution conditional on decision-maker traits and context.
• Extended signal detection theory (SDT) to explicitly model diverse persuasion pathways.

Main Results:

• The generalized model reduces to Expected Utility theory ($K=1$) and Dual-Process theory ($K=2$) as special cases.
• The model explains the 'stepping-stone' penetration pattern observed in APT attacks.
• Identified conditional security-breach risks and prerequisites for effective security training validation.

Conclusions:

• A generalized decision theory offers a more robust framework for understanding human behavior in cybersecurity.
• This approach improves modeling of social engineering tactics, particularly those leveraging emotion and peripheral persuasion.
• The model provides novel insights into APT attack methodologies and human vulnerability in cyber defense.