Can social influence be exploited to compromise security: An online\n experimental evaluation

Social media has enabled users and organizations to obtain information about\ntechnology usage like software usage and even security feature usage. However,\non the dark side it has also allowed an adversary to potentially exploit the\nusers in a manner to either obtain information from them or influence them\ntowards decisions that might have malicious settings or intents. While there\nhave been substantial efforts into understanding how social influence affects\none's likelihood to adopt a security technology, especially its correlation\nwith the number of friends adopting the same technology, in this study we\ninvestigate whether peer influence can dictate what users decide over and above\ntheir own knowledge. To this end, we manipulate social signal exposure in an\nonline controlled experiment with human participants to investigate whether\nsocial influence can be harnessed in a negative way to steer users towards\nharmful security choices. We analyze this through a controlled game where each\nparticipant selects one option when presented with six security technologies\nwith differing utilities, with one choice having the most utility. Over\nmultiple rounds of the game, we observe that social influence as a tool can be\nquite powerful in manipulating a user's decision towards adoption of security\ntechnologies that are less efficient. However, what stands out more in the\nprocess is that the manner in which a user receives social signals from its\npeers decides the extent to which social influence can be successful in\nchanging a user's behavior.\n