ISU study: Low self-control linked to cyber fraud

Company concerns about technology security have spiked with hackers becoming more prevalent and scams on the rise. But a new study by Iowa State University researchers looks at what some suspect is the greatest threat to a corporation's secure information.

'Human agents inside an organization could be as dangerous as, and potentially more dangerous than, those outside the organization due to their intimate knowledge of the organizational information system and the access they receive,” according to the study, published Tuesday in the Journal of Management Information Systems.

The study explored those internal threats and possible methods to avert them by delving into the minds of potential employees.

It asked 40 male ISU students to put themselves in specific situations and answer questions about how they'd respond to temptations to violate company policy. Using brain imaging technology, researchers measured subjects' neural activity in hopes of establishing a correlation with their decision-making processes and determining what might motivate them.

Results showed individuals with low self-control made decisions faster than those with high self-control - meaning they spent less time considering the consequences of their actions.

That led analysts to conclude self-control plays a significant role in employees who, for example, might sell or trade sensitive information.

'People with high self-control tend to activate their executive function to suppress their inner desire to do something,” said Qing Hu, ISU professor in information systems and co-author of the study. 'Those who have low self-control, because they have a lower level of brain activity in their executive area, are not able to suppress their impulsive behavior and are more likely to commit opportunistic cyber security fraud.”

The number of security violations increased to nearly 43 million last year, up from about 29 million in 2013, according to the Global State of Information Security Survey 2015. The survey found employees - current and former - were cited as the top offenders.

The effects of poor self-control have been analyzed at length in connection with criminal or deviant behavior, according to Hu. But, he said, its effects on information systems security has been somewhat overlooked.

Of the research done on the topic, much has relied on interviews and self-reporting, 'which has been plagued with issues,” the study found.

'Brain imaging tools offer more objective or unbiased measurement of decision-making, cognitive, emotional, and social processes.”

Participants in the ISU study were asked to respond to 45 scenarios, and they were compelled to answer honestly by being led to believe a computer would analyze their truthfulness and they would be compensated accordingly.

But, Hu said, 'There was no such technology.”

'This is what we call design deception,” he said.

The method was approved by the university's Institutional Review Board, and all participants were debriefed after the study. Even though some subjects still might not have been totally honest, Hu said, the deception gave the research a greater level of validity.

Although the differences were significant between subjects of high and low self-control, Hu said that doesn't mean those lacking self-control are unemployable.

'This study confirms that people with low self-control might not be a good fit for positions that have access to highly sensitive data,” he said. 'But we speculate that people with low self-control, because they are less inhibited, might be better in other positions - like those interacting with people or in sales.”

Hu suggests employers learn more about job candidates' self-control abilities by giving them a psychology assessment.

'If I'm hiring an IT database manager, I better not put a low self-control person in that position,” he said. 'But if they're going to be interacting with customers and need to be outgoing … I might want him to have the other qualifications.”

And although Hu said he is not a geneticist, he said research indicates self-control is an attribute that can be acquired through learned behavior in the formative years - between age 1 and the late teenage years.

'It depends on how you were brought up and the disciplines from your family and environment,” he said. 'People who have a tendency to say, ‘This is what I want, and I want it now,' those people become lower self-control people.”