Does Personality Make You Vulnerable to Cybercrime?

A new study explores the connections between personality traits and susceptibility to different cyberattacks.

Could extraversion make you more vulnerable to social engineering attacks? Its a possibility, as seen in research investigating links between personality traits and vulnerability to cybercrime.
The study, compiled by ESET and the Myers-Briggs company, drills down into the human factor responsible for many security breaches. Verizons DBIR found 20% of security incidents originate from people within an organization; separate
data
from Dtex shows nearly two-thirds (64%) of insider threats come from people who put the company at risk with careless behavior.
Myers-Briggs goal in this research is to determine whether individuals personality traits make them more susceptible to different types of security threats. As part of an ongoing study, it has so far polled 520 respondents who had completed the Myers-Briggs Type Indicator (MBTI) questionnaire. John Hackston, head of thought leadership for the company, argues the MBTI is a practical starting point for personality-based research as many people and businesses already use it for self-development.
If youre not familiar, the MBTI quantifies best-fit personality type using four traits: extraversion/introversion (E/I), which shows where you get energy; sensing/intuition (S/N), which indicates how you learn information; thinking/feeling (T/F), which tells how you make decisions; and judging/perceiving (J/P), which indicates whether you prefer a more structured or open-ended lifestyle. For the security-focused study, respondents also answered questions about their jobs, biographical data, cybersecurity habits, phishing experiences, and overall security knowledge.
Everybody in an organization is an insider risk when it comes to cybersecurity, says Hackston. We want to look at how MBTI relates to those to give people guidelines … so they can have guidelines to say What things should I look out for? and What things might be my particular downfalls if Im not careful?
There is no single personality type thats more security-savvy than the others, he explains. Similarly, being security-savvy doesnt necessarily mean someone is a lower-risk employee. Oftentimes, security practices boil down to the two middle letters of the MBTI type, which are intended to dictate how an individual processes data and how they make decisions.
As an example, Hackson points to the personality type INTP: a logical, analytical, detail-oriented and introverted person. Myers-Briggs research shows people who are INTPs score higher on questions about cybersecurity knowledge; unfortunately, theyre also more likely to think rules dont apply to them. An ESTP, an extraverted type who focuses on facts and logic, is also likely to flout rules.
The way a phishing attack is communicated can make a difference in which types fall for it, Hackston adds. An email that seems factual and promises someone can save money or be more efficient, for example, will be more effective on the objective, analytical ST types. The trusting, loyal SF type may be more likely to respond to an email that claims to be from an authority figure, and the warm, altruistic NF may fall for a phishing attack disguised as a charity email.
In general, researchers found, extraverts are more likely to fall for social engineering attacks. Their need to stay in tune with the world is both a boon and a curse, Hackston says. While theyre informed of new threats, extraverts tendency to focus on people puts them at risk. A desire to build a personal connection may lure an extravert into a social engineering trap.
The Big 5
Of course, the MBTI isnt the only way to classify personality. Dr. Margaret Cunningham, principal research scientist for human behavior with Forcepoint X-Labs, has explored security risk alongside the Big 5 personality traits: neuroticism, extraversion, openness, agreeableness, and conscientiousness, and she agrees extraversion can prove risky.
We find in the Big 5 personality [traits] that agreeable people tend to be more willing to share information, which makes them more susceptible to social engineering attacks, she adds. When asked what theyre doing, an extravert is more likely to be immediately transparent.
Conscientious people lean toward the practical side and use greater caution, she says. These are the people who read service agreements, she jokes. Theyre going to check the settings on a cookie pop-up. Those people tend to be a little less likely to [fall for] phishing attempts.
At the same time, its important to note personality is a spectrum, Cunningham emphasizes. Its the people who exhibit the extremes of different personality facets who are easiest to associate with predictive behavior. You can be a detail-oriented extravert, for example, or an introvert who accidentally spills too much information to an attacker or falls for a phishing email.
Knowing that these are the things that push our buttons helps us to be more wary, says Hackston. Security awareness training isnt a one size fits all project, and while organizations cant be expected to build different training programs for each personality type, it helps to inform employees where their weaknesses may lie so theyre attuned to potential threats. As Cunningham says, people will continue to make mistakes even if they are informed of the risk.
No matter how aware we are, we will continue to make mistakes and be phished, she says. Well continue to click not because of personality, but the limitations we have in cognitive skills like memory and attention.
Related Content:
2019 Pwnie Award Winners (And Those Who Wish They Werent)
History Doesnt Repeat Itself in Cyberspace
New Vulnerability Risk Model Promises More-Efficient Security
Modern-Day SOCs: People, Process & Technology

Last News
▸ Commercial cyber attacks from India target U.S., Pakistan, China. ◂ Discovered: 26/12/2024 Category: security	▸ Yahoo Japan Data Breach: 22M Accounts Hacked ◂ Discovered: 26/12/2024 Category: security	▸ Black Hat 2013 trainings focus on Incident Response and Malware. ◂ Discovered: 26/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps