Can Computer System Environments Influence System Trespassers’ Efforts to Cover Their Tracks In the Attacked System? Findings from Three Randomized Field Trials

• In Event: The Effect of Computing Environments and Network Configurations on Hackers’ Illegitimate Online Behaviors During the Progression of System Trespassing Events

Abstract

Can computing environments deter system trespassers and increase intruders’ likelihood to cover their tracks during the progression of a system trespassing event? We suspect that with the incorporation ofthat incorporating social dimensions into the computer environment, and particularly surveillance and sanction threats, can answer this question affirmatively. the answer to this question could be affirmative. To generate sufficient empirical evidence to answer this questiontest our suspicions, we conducted a series of randomized field trials in the U.S. and China, using a large set of target computers built for the sole purpose of being infiltrated. We configured these computers to present varying levels of ambiguity regarding the presence of surveillance in the system, and investigated how this ambiguity influenced system trespassers’ likelihood to issue “clean tracks” commands. Findings indicate that the presence of unambiguous signs of surveillance increases the probability of clean tracksthese commands being entered on the system. Nevertheless, even when they are given clear signs of detection, we find that intruders are less likely to use clean tracks commands in the absence of subsequent presentations of sanction threats.

Authors

• David Maimon, University of Maryland

• Alex Testa, University of Maryland

• Michel Cukier, University of Maryland

• Bertrand Sobestobso, University of Maryland

• Wuling Ren, Zhejiang Gongshang University