Social engineering is the acquisition of informationabout computer systems by methods that deeply include non-technical means. While technical security of most critical systemsis high, the systems remain vulnerable to attacks from socialengineers. Social engineering is a technique that: (i) does notrequire any (advanced) technical tools, (ii) can be used by anyone,(iii) is cheap. Traditional security requirements elicitation approaches oftenfocus on vulnerabilities in network or software systems. Fewapproaches even consider the exploitation of humans via socialengineering and none of them elicits personal behaviours of indi-vidual employees. While the amount of social engineering attacksand the damage they cause rise every year, the security awarenessof these attacks and their consideration during requirementselicitation remains negligible. We propose to use a card game to elicit these requirements, which all employees of a company can play to understand thethreat and document security requirements. The game considersthe individual context of a company and presents underlyingprinciples of human behaviour that social engineers exploit, aswell as concrete attack patterns. We evaluated our approachwith several groups of researchers, IT administrators, andprofessionals from industry.

Purpose: This paper aims to outline strategies for defence against social engineering that are missing in the current best practices of information technology (IT) security. Reason for the incomplete training techniques in IT security is the interdisciplinary of the field. Social engineering is focusing on exploiting human behaviour, and this is not sufficiently addressed in IT security. Instead, most defence strategies are devised by IT security experts with a background in information systems rather than human behaviour. The authors aim to outline this gap and point out strategies to fill the gaps.Design/methodology/approach: The authors conducted a literature review from viewpoint IT security and viewpoint of social psychology. In addition, they mapped the results to outline gaps and analysed how these gaps could be filled using established methods from social psychology and discussed the findings.Findings: The authors analysed gaps in social engineering defences and mapped them to underlying psychological principles of social engineering attacks, for example, social proof. Furthermore, the authors discuss which type of countermeasure proposed in social psychology should be applied to counteract which principle. The authors derived two training strategies from these results that go beyond the state-of-the-art trainings in IT security and allow security professionals to raise companies’ bars against social engineering attacks.Originality/value: The training strategies outline how interdisciplinary research between computer science and social psychology can lead to a more complete defence against social engineering by providing reference points for researchers and IT security professionals with advice on how to improve training.

The augmented reality smartphone game Pokémon Go is one of the biggest commercial successes in the last years, posing the question concerning the factors contributing to the game’s success. An apparent distinction to other games is the strong brand Pokémon. We derive a research model based on the established theory of technology acceptance, which includes an established construct for nostalgic feelings – childhood brand nostalgia – and theorise on how it is related to beliefs about technology characteristics and the intention to play the game. For this purpose, we adapt one of the most prominent technology acceptance models for the consumer context and for hedonic information systems, the UTAUT2 model. Based on our model, we conduct a study with 418 active German players aged between 18 and 35. Our results indicate that the effect of childhood brand nostalgia on behavioural intention is fully mediated by the belief constructs. Thus, nostalgic feelings about Pokémon influence the intention of users through altering beliefs concerning Pokémon. We include nostalgic feelings in a technology acceptance model for the first time, therefore contributing to the theoretical advance in the IS domain. The results can be used to enhance the technology acceptance of newly designed products.

We present and validate a German translation of the questionnaire of the Unified Theory of Acceptance and Use of Technology 2 (UTAUT2). For this case, we surveyed participants on the location-based mobile augmented reality game Pokémon Go. We conducted the translation with the help of two independent and certified translators and tested the validity and reliability of the constructs by analysing a partial least squares structural equation model. The analysis is based on a sample of 681 active players of the game. The participants were acquired with the help of a certified German panel provider. The results indicate the validity and reliability of the German translation of the constructs for the case of Pokémon Go. Professional translations of existing constructs are necessary to apply established models and associated questionnaires in other countries. In particular, because language may influence survey responses, especially with regard to attitudes. However, these translations are associated with high monetary costs and efforts and seldom published. Therefore, with this work we provide opportunities for future work by making our valid and reliable German translation of the UTAUT2 questionnaire accessible to interested researchers.