Falling for Social Engineering: A Qualitative Analysis of Social Engineering Policy Recommendations

Abstract

The current study examines recommendations for addressing organizational members who fall prey to social engineering as a matter of organizational policy through a qualitative analysis of interviews with organizational IT security administrators, IT security auditors, and social engineers. The results of this analysis indicate that participants had an aversion to punitive approaches to security failures. Instead, they tended to favor education as a more pragmatic and humane solution. Others argued that emphasis should be given to rewarding positive security behavior over punishing lapses. Few participants contended that there is a time and place for harsher sanctions but generally only for repeat offenders. Implications for security policy, deterrence theory, and reintegrative shaming theory are considered.