Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Theory X and Theory Y are two models of human motivation, often used when discussing people-management in business. In short, Theory X postulates people are lazy, will avoid work, and require incentives, whereas Theory Y postulates that people are ambitious, motivated and creative.

The consensus in general management is that Theory X is more counter-productive, and that Theory Y is a more accurate depiction of human behaviour. Do the same conclusions hold for social engineering?

I propose the following:

  • Theory X of social engineering is that people are likely to conform to your requests when presented with threats, scare tactics and authority. An example of this is the recent Microsoft call-centre scam.
  • Theory Y of social engineering is that people are likely to conform to your requests when presented with opportunities, positive reinforcement, and emotional appeals. An example of this is the Nigerian 419 scam.

Is there any evidence that one theory is more accurate than the other? Are there any papers that analyse the effectiveness of these tactics?

share|improve this question
3  
Are you asking about the relative effectiveness of scams that claim authority "Log in here to change your password now or you will lose access" vs. ones that claim to have similar altruistic goals "Download this software and Bill Gates will make a donation to hurricane relief on your behalf"? –  Mike Samuel Aug 14 '12 at 16:16
    
@MikeSamuel That's one way to look at it. Essentially it's scare tactics and negative reinforcement (e.g. "you are being sued, send us $x for an advance copy of the lawsuit") versus appeals to emotion and positive reinforcement (e.g. "we've got $10m for you, but cannot release the fees until certain arrears are settled, please send us $1000.") –  Polynomial Aug 14 '12 at 17:47
    
So, "fear" and "greed"? Trigger either the right way to anyone and they will respond. I do not think you can put generalizations on people as either one way or another. It has more to do with how they feel about themselves in the environment they are in. If they feel secure, they will respond to "greed" triggers. If they feel insecure, they will respond to "fear" triggers. Manipulate their feelings of (in)security, and follow-up with the corresponding trigger. –  schroeder Aug 15 '12 at 15:20

3 Answers 3

up vote 5 down vote accepted

I'd say you're pushing Theory X and Theory Y too far away from their original position. The original posit of the theories relates to a relationship between people and authority. The people are in a system in which the manager has a significant degree of control over employment conditions and outcomes.

The social engineering concepts and strategies run counter to the idea that the social engineer has a position of direct authority over his victims. Very much the opposite - the social engineer is getting something out of the victim that the social engineer has no right, authority or need to have. Also, since the purpose is fraudulent, I'm not sure that you can make the same assumptions about self-motivation playing the same role in the relationship. The comparison of Theory X vs. Y is typically selfishness vs. self-motivation.

In many cases, social engineering can probably work either way. For example - I'd see Phishing working either way - in a Theory X situation, the victim might be motivated to respond to phishing queries because he wants to avoid punishment or reap monetary reward, in a Theory Y situation the victim might be working towards some shared goal that provides intrinsic motivation. Either way, the social engineering side is that the victim doesn't know that the attacker's purposes run counter to the victim's best-interest so the nature of his motivation is not nearly so important.

share|improve this answer

I fundamentally disagree with the theory X/theory Y models as they are way too cut and dried. The simple truth is that on any given day people can be motivated by different things. One one day a person may be ambitious and ready to please while another day the same person may be in work avoidance mode. Or that person may working 2 projects and be ambitious for one and lazy on the other because they perceive that one is run by a heavy-hitter and the other is a waste of time.

From a social engineering perspective your Theory X and Theory Y may work on the same person, or neither may work. It's rare that you get someone who is motivated by threats but not by gain. It's too simplistic I'm afraid.

share|improve this answer

I would tend to say that the X/Y theory is not very relevant to scamming. Let me quote an expert at understanding people, namely Terry Pratchett:

There is a saying "You can't fool an honest man" which is much quoted by people who make a profitable living by fooling honest men. Moist never knowingly tried it, anyway. If you did fool an honest man, he tended to complain to the local Watch, and these days they were harder to buy off. Fooling dishonest men was a lot safer and, somehow, more sporting. And, of course, there were so many more of them. You hardly had to aim.

(from the novel "Going Postal")

This is a concise expression of how Nigerian scams operate: they turn the victim into an accomplice. They begin by expressing a need to move around a substantial amount of money from one country to another, discreetly and without fuss. The prospective victim is lured into a scheme which the said victim fuzzily believes to be somewhat dishonest at some point. The scammers are very careful never to say it plainly, of course. This is part of the act, the victim feeling all the more witty and self-confident by having deduced by himself that some foul play was at hand. Self-confidence, and being uprooted from his usual, comfortable life of basic honesty, make the victim more prone to accept outrageous claims and irrational twists.

So I would say that Nigerian scams work because people are greedy, excitable and trespassers of moral boundaries. They crave the thrill of dabbling in crime and this makes them forget all cautiousness.

On the other hand, the "Microsoft call-centre scam" relies on people being timid, anxious and natural followers. Most people utterly fear having to assume the consequences of their choices. So, in times of disquiet due to a (perceived) threat, especially one involving guilt (in the scam, the first thing that the scammer says is "there is a problem coming from your computer"(*)), they will be ready to follow to the letter the nearest authority figure, which the scammer tries hard to incarnate.

As Benjamin Franklin, another smart guy good at dealing with people, famously said:

Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety.

and while old Benji tries to put it under a disapproving moral light, he mechanically stresses the point, which is that people will give up quite a lot to purchase a little temporary safety, even if they have to purchase it from the very man who plunged them into danger. That's the Microsoft call centre scam all right: the victim complies to the whims of the scammer because they try to buy his indulgence (for an imaginary crime !) by their subservience.

(*) I have been phone-called by these scammers every fortnight or so, since at least last year. As a joke, it grows old.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.