Impact of Social Engineering Attacks: A Literature Review

Fuertes, Walter; Arévalo, Diana; Castro, Joyce Denisse; Ron, Mario; Estrada, Carlos Andrés; Andrade, Roberto; Peña, Felix Fernández; Benavides, Eduardo

doi:10.1007/978-981-16-4884-7_3

Cited by 11 publications

(5 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The stated characteristics of phishing emails include the sender address (47), followed by the language (35), links (34), specific content (25), urgency (20), request for data (19), salutation (28), and layout (17). Additionally, attachment (8), subject (6), spam filter (4), technical details such as error messages (3), receiving address (2), mass email (1), and gut feeling (1) were named. On average, the participants knew four characteristics.…”

Section: Study Resultsmentioning

confidence: 99%

“…According to Verizon's Data Breach Report 2022 [2], 82% of breaches involve the human element, with phishing being the second-most common entry point into an organization. The subsequent incidents have various impacts ranging from financial to reputational damage [8], as these attacks are often one step towards the goal within the cyber kill chain [5,22,27]. For example, MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) assigns spear-phishing the IDs T1566.001-003 (with attachment, via a link, or via a service) within the phase initial access [16].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Study of Different Awareness Campaigns in a Company

Gamisch,

Pöhn

2023

Proceedings of the 18th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Phishing is a major cyber threat to organizations that can cause financial and reputational damage, threatening their existence. The technical measures against phishing should be complemented by awareness training for employees. However, there is little validation of awareness measures. Consequently, organizations have an additional burden when integrating awareness training, as there is no consensus on which method brings the best success. This paper examines how awareness concepts can be successfully implemented and validated. For this purpose, various factors, such as requirements and possible combinations of methods, are taken into account in our case study at a small-and medium-sized enterprise (SME). To measure success, phishing exercises are conducted. The study suggests that pleasant campaigns result in better performance in the simulated phishing exercise. In addition, significant improvements and differences in the target groups could be observed. The implementation of awareness training with integrated key performance indicators can be used as a basis for other organizations. CCS CONCEPTS• Security and privacy → Phishing; Human and societal aspects of security and privacy; Security services.

show abstract

Section: Study Resultsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

A Study of Different Awareness Campaigns in a Company

Gamisch,

Pöhn

2023

Proceedings of the 18th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

show abstract

“…A systematic literature review was carried out to identify and categorize the best methods for studying attacks based on social engineering on social networks. This review process includes the collection and analysis of existing research using specific evaluation criteria, which provides insights into the current state of knowledge in this particular area of study (Fuertes et al, 2022). The data from primary sources are methodically organized and examined.…”

Section: Methodsmentioning

confidence: 99%

A comprehensive survey on social engineering-based attacks on social networks

Naz,

Sarwar,

Kaleem

et al. 2024

Int. j. adv. appl. sci.

View full text Add to dashboard Cite

Threats based on social engineering in social networks are becoming a more common problem. Social engineering is a type of attack that relies on trickery and exploiting human psychology to gain access to confidential information or resources. It involves deceptive techniques like phishing, pretexting, and baiting, tricking individuals into revealing sensitive information or performing specific actions. These tactics can lead to unauthorized access to user accounts, identity theft, or the distribution of harmful content. This study offers a detailed review of threats related to social engineering on social networks. It explores various social engineering attacks, the methods used to execute these threats, and measures that can be adopted to minimize the risk of becoming a victim. The research aimed to develop a new, broad classification of social engineering attacks and strategies for responding to them. It also examines the challenges that social engineering poses to algorithms on social media platforms and highlights the need for more research. The study concludes by pointing out the shortcomings of current approaches and suggesting future research directions, stressing the importance of standardized protective measures and increasing awareness among potential victims. This thorough examination improves our understanding of social engineering attacks and encourages the development of innovative solutions and ethical practices, contributing to a more secure digital environment.

show abstract

“…Also, according to Fuertes et al, (2022), who examined the impacts of social engineering attacks; The main findings are concentrated in companies, financial institutions, and even vehicle vulnerabilities, which have caused economic losses and a decrease in the image and reputation loss damage of individuals and companies. Most of the causes are related to human behaviour, such as innocence, unconsciousness, and lack of training or capacity.…”

Section: Empirical Literature Reviewmentioning

confidence: 99%

Evaluation of Measures Taken by Telecommunication Companies in Preventing Social Engineering Attacks in Tanzania

Muzigura,

Casmir

2023

ejtas

View full text Add to dashboard Cite

This study aimed to evaluate the measures taken by telecommunication companies in preventing social engineering attacks in Tanzania. The study was guided by the deception theory, the researcher employed a descriptive research design and quantitative approach to conduct this study. Data was collected by using a questionnaire administered to the selected telecommunication companies in Tanzania. Furthermore, the obtained findings were as follows; most of the respondents who participated in this study are aware of social engineering and that they experienced social engineering. The study also revealed that there are common social engineering attacks experienced by the respondents such as business collaboration benefits, alleged wrong remittance of money, sim swaps, SMS phishing and fraudulent SMS from lost or stolen phones, password requisitions and links sharing. The findings of this study went further to reveal that social engineering has effects such as loss of sensitive data, financial loss, reputational damage, disruption of operations as well as legal and compliance issue. The general findings of this study show that most of the respondents said that there is a presence of security measures to prevent social engineering such as the provision of the awareness program, enabling the use of multifactor authentication, there is implementation of policies around social media usage, provision of regular software updates, regular review of security protocols, provision of well-known customer care services number. On the other hand, the study also revealed that telecommunication companies use the following ways to minimize social engineering attacks, provision of security awareness training for employees, implementing security policies and procedures, regularly reviewing and updating security protocols, detecting and responding to social engineering attacks, placing limits on the access each member has in the system, always require a username and password to be configured. On the strategies used to prevent social engineering, the finding of this study showed that telecommunication companies should ensure encrypting data, proper verification of emails or instructions sent to customers, ensure that even if hackers intercept communication they can’t access information contained within, use of SSL certificates from trusted authorities, incorporating phishing and malicious detection solutions into security stack. This study concludes that telecommunications ensure routine reviews of security standards, daily notifications for customers and other system users, and the availability of a well-known customer care services number. Due to the difficulties that information system users face, businesses have been using a variety of protection techniques to avoid social engineering, from putting up multifactor authentication for users' accounts to teaching employees how to spot suspect activity. Hence it is recommended that it is necessary to deploy mechanisms like machine learning-based ways to defend against social engineering-based assaults since cybercriminals exploit human activities to breach security as well as using the security features on messages (filter unknown senders) and calls (silence unknown callers).

show abstract

Impact of Social Engineering Attacks: A Literature Review

Cited by 11 publications

References 37 publications

A Study of Different Awareness Campaigns in a Company

A Study of Different Awareness Campaigns in a Company

A comprehensive survey on social engineering-based attacks on social networks

Evaluation of Measures Taken by Telecommunication Companies in Preventing Social Engineering Attacks in Tanzania

Contact Info

Product

Resources

About