The field of information security is a fast-growing discipline. Even though the effectiveness of security measures to protect sensitive information is increasing, people remain susceptible to manipulation and thus the human element remains a weak link. A social engineering attack targets this weakness by using various manipulation techniques to elicit sensitive information. The field of social engineering is still in its early stages with regard to formal definitions, attack frameworks and templates of attacks. This paper proposes detailed social engineering attack templates that are derived from real-world social engineering examples. Current documented examples of social engineering attacks do not include all the attack steps and phases. The proposed social engineering attack templates attempt to alleviate the problem of limited documented literature on social engineering attacks by mapping the real-world examples to the social engineering attack framework. Mapping several similar real-world examples to the social engineering attack framework allows one to establish a detailed flow of the attack whilst abstracting subjects and objects. This mapping is then utilised to propose the generalised social engineering attack templates that are representative of real-world examples, whilst still being general enough to encompass several different real-world examples. The proposed social engineering attack templates cover all three types of communication, namely bidirectional communication, unidirectional communication and indirect communication. In order to perform comparative studies of different social engineering models, processes and frameworks, it is necessary to have a formalised set of social engineering attack scenarios that are fully detailed in every phase and step of the process. The social engineering attack templates are converted to social engineering attack scenarios by populating the template with both subjects and objects from real-world examples whilst still maintaining the detailed flow of the attack as provided in the template. Furthermore, this paper illustrates how the social engineering attack scenarios are applied to verify a social engineering attack detection model. These templates and scenarios can be used by other researchers to either expand on, use for comparative measures, create additional examples or evaluate models for completeness. Additionally, the proposed social engineering attack templates can also be used to develop social engineering awareness material.

No abstract

ABSTRACT-Performing a digital forensic investigation (DFI) requires a standardized and formalizedprocess. There is currently neither an international standard nor does a global, harmonized DFI process (DFIP) exist. The authors studied existing state-of-the-art DFIP models and concluded that there are significant disparities pertaining to the number of processes, the scope, the hierarchical levels and concepts applied. This paper proposes a comprehensive model that harmonizes existing models. An effort was made to incorporate all types of processes proposed by the existing models, including those aimed at achieving digital forensic readiness. The authors introduce a novel class of processes called concurrent processes. This is a novel contribution that should, together with the rest of the model, enable more efficient and effective DFI, while ensuring admissibility of digital evidence. Ultimately, the proposed model is intended to be used for different types of DFI and should lead to standardization.Keywords: forensic science, digital forensics, digital evidence, investigation, process, model, harmonization, standardization 3 Digital forensics gained importance rapidly over the past number of years. Information security incidents are constantly on the rise and are becoming more and more versatile. The fact that societies depend heavily on information technology, contributes to the importance of digital forensics.Dealing with digital evidence requires a standardized and formalized process in order for digital evidence to be accepted in a court of law. For example, consider the Daubert rule (1), which is most prominently used in the USA for expert witness testimony in digital forensic investigation cases. The Daubert rule clearly states that theories and techniques used to draw conclusions in a case must result in positive answers to a number of questions, notably the question that asks whether the theories and techniques are subject to standards governing their application. Methods and process models for the digital forensic investigation process have been -more often than not-developed mostly by practitioners and digital forensic investigators based on personal experience and expertise, on an ad hoc bases, without the main aim to reach harmonization and standardization within in the field. In the past decade, there were also a number of academic research projects conducted in order to establish a digital forensic investigation process model. By the time of writing this paper, there currently exists no international standard formalizing the digital forensic investigation process. An effort to standardize the process has, however, started within the International Standardization Organization (ISO), by the authors (2). In their previous work, the authors proposed a comprehensive and harmonized digital forensic investigation process model (3,4).The model proposed in this paper represents further work in achieving comprehensiveness and harmonization. It is important to note that the proposed process model includes pro...

The human is often the weak link in the attainment of Information Security due to their susceptibility to deception and manipulation. Social Engineering refers to the exploitation of humans in order to gain unauthorised access to sensitive information. Although Social Engineering is an important branch of Information Security, the discipline is not well defined; a number of different definitions appear in the literature. Several concepts in the domain of Social Engineering are defined in this paper. This paper also presents an ontological model for Social Engineering attack based on the analysis of existing definitions and taxonomies. An ontology enables the explicit, formal representation of the entities and their interrelationships within a domain. The aim is both to contribute towards commonly accepted domain definitions, and to develop a representative model for a Social Engineering attack. In summary, this paper provides concrete definitions for Social Engineering, Social Engineering attack and social engineer.

No abstract