Hacking Humans? Social Engineering and the Construction of the "Deficient User" in Cybersecurity Discourses

Bibliographic Data

ID5337367
AuthorsNina Klimburg-Witjes (0000-0003-0583-8788, University of Vienna, corresponding author), Alexander Wentland (0000-0003-3080-8599, Technical University of Munich)
Year2021
Volume46
Issue6
Pages1316-1339
Publication date2021-11-01
Peer ReviewedYes
Open AccessYes
TypeARTICLE
VenueScience Technology & Human Values (JOURNAL)
Journal identifiersISSN: 0162-2439 • E-ISSN: 1552-8251
PublisherSAGE Publications Inc (PUBLISHER)
DOI10.1177/0162243921992844
OpenAlexW3133399946
LanguageEN
Citations received8
References cited45

Today, social engineering techniques are the most common way of committing cybercrimes through the intrusion and infection of computer systems. Cybersecurity experts use the term "social engineering" to highlight the "human factor" in digitized systems, as social engineering attacks aim at manipulating people to reveal sensitive information. In this paper, we explore how discursive framings of individual versus collective security by cybersecurity experts redefine roles and responsibilities at the digitalized workplace. We will first show how the rhetorical figure of the deficient user is constructed vis-à-vis notions of (in)security in social engineering discourses. Second, we will investigate the normative tensions that these practices create. To do so, we link work in science and technology studies on the politics of deficit construction to recent work in critical security studies on securitization and resilience. Empirically, our analysis builds on a multi-sited conference ethnography during three cybersecurity conferences as well as an extensive document analysis. Our findings suggest a redistribution of institutional responsibility to the individual user through three distinct social engineering story lines-"the oblivious employee," "speaking code and social," and "fixing human flaws." Finally, we propose to open up the discourse on social engineering and its inscribed politics of deficit construction and securitization and advocate for companies and policy makers to establish and foster a culture of collective cyber in/security and corporate responsibility

Business · Computer security · Critical security studies · Cyberwarfare · Hacker · Information security · Malware · Network security policy · Political science · Politics · Public relations · Rhetorical question · Securitization · Security service · Social media · Sociology · Computer Science · COVID-19 Digital Contact Tracing · Cybersecurity and Cyber Warfare Studies · Global Security and Public Health · Law

Tools

Open DOIOpen Access