Social engineering-based attacks: Model and new zealand perspective

The field of information security is a fast-growing discipline. Even though the effectiveness of security measures to protect sensitive information is increasing, people remain susceptible to manipulation and thus the human element remains a weak link. A social engineering attack targets this weakness by using various manipulation techniques to elicit sensitive information. The field of social engineering is still in its early stages with regard to formal definitions, attack frameworks and templates of attacks. This paper proposes detailed social engineering attack templates that are derived from real-world social engineering examples. Current documented examples of social engineering attacks do not include all the attack steps and phases. The proposed social engineering attack templates attempt to alleviate the problem of limited documented literature on social engineering attacks by mapping the real-world examples to the social engineering attack framework. Mapping several similar real-world examples to the social engineering attack framework allows one to establish a detailed flow of the attack whilst abstracting subjects and objects. This mapping is then utilised to propose the generalised social engineering attack templates that are representative of real-world examples, whilst still being general enough to encompass several different real-world examples. The proposed social engineering attack templates cover all three types of communication, namely bidirectional communication, unidirectional communication and indirect communication. In order to perform comparative studies of different social engineering models, processes and frameworks, it is necessary to have a formalised set of social engineering attack scenarios that are fully detailed in every phase and step of the process. The social engineering attack templates are converted to social engineering attack scenarios by populating the template with both subjects and objects from real-world examples whilst still maintaining the detailed flow of the attack as provided in the template. Furthermore, this paper illustrates how the social engineering attack scenarios are applied to verify a social engineering attack detection model. These templates and scenarios can be used by other researchers to either expand on, use for comparative measures, create additional examples or evaluate models for completeness. Additionally, the proposed social engineering attack templates can also be used to develop social engineering awareness material.

show abstract

“…The SE is able to obtain sensitive information from the help-desk staff by bypassing any checks that require authorisation to be granted [23].…”

Section: Bidirectional Communication -Templatementioning

confidence: 99%

“…The cleaner grants the social engineer access to the building. This allows the social engineer to gain physical access to the computerised terminals on the management floor [23,24].…”

Section: Bidirectional Communication Scenariomentioning

confidence: 99%

Social engineering attack examples, templates and scenarios

Mouton

Leenen

Venter

2016

Computers & Security

134

View full text Add to dashboard Cite

show abstract

“…There have been a number of works that focus on analysing SEA attacks. Janczewski & Fu (2010) provided a conceptual model in order to understand SEAs impacts on individuals and businesses and present a defensive approach to mitigate these risks [17]. The study focused on IT departments and a more abstract view of SEAs without considering SEAs concepts related to critical human factors and their relationships to the concept of SI.…”

Section: Social Engineering Attacks Taxonomymentioning

confidence: 99%

“…It is clear that lack of security awareness contributed to a successful F o r P e e r R e v i e w 17 planned SEA. The absent of adequate authentication process in regards to communication has also assisted the attacker to establish a false communication channel.…”

Section: Activity 1: Organisational Analysismentioning

confidence: 99%

“…The study developed a risk-driven security model for understanding of the role of human factors in security incidents, concerning risk, security and return of an investment on security. Social Engineering Attacks (SEA) use as F o r P e e r R e v i e w 2 security incidents example because SEAs are greatly influenced by human factors [17]. The proposed model assists the mitigation process from an organisational perspective.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation