Reviewing Cyber Security Social Engineering Training and Awareness Programs—Pitfalls and Ongoing Issues

Abstract

The idea and perception of good cyber security protection remains at the forefront of many organizations' information and communication technology strategy and investment. However, delving deeper into the details of its implementation reveals that organizations' human capital cyber security knowledge bases are very low. In particular, the lack of social engineering awareness is a concern in the context of human cyber security risks. This study highlights pitfalls and ongoing issues that organizations encounter in the process of developing the human knowledge to protect from social engineering attacks. A detailed literature review is provided to support these arguments with analysis of contemporary approaches. The findings show that despite state-of-the-art cyber security preparations and trained personnel, hackers are still successful in their malicious acts of stealing sensitive information that is crucial to organizations. The factors influencing users' proficiency in threat detection and mitigation have been identified as business environmental, social, political, constitutional, organizational, economical, and personal. Challenges with respect to both traditional and modern tools have been analyzed to suggest the need for profiling at-risk employees (including new hires) and developing training programs at each level of the hierarchy to ensure that the hackers do not succeed.

Evaluating Contemporary Digital Awareness Programs for Future Application within the Cyber Security Social Engineering Domain

“…Moreover, these traditional programs generally adopted a generalized approach rather than emphasizing different manipulation techniques adopted by attackers. Further, they were conducted in a completely formal setting which had certain limitations such as lack of employee engagement [10]. As mentioned in [11], traditional awareness programs like printing posters and warning messages in the form of screensavers only provided basic awareness regarding such attacks.…”

A Taxonomy for Social Engineering Attacks via Personal Devices

“…Tablets are also equipped with various application software that poses the same limitation as mobile applications. They expose the user to possible malware, worm, and Trojan attack vectors of social engineering [40,[58][59][60][61][62]].…”

Does Awareness of Social Engineering Make Employees More Secure?

“…It has been widely accepted that awareness is one of the most important aspects of information security [5,6]. People using the most secure systems are also often the most vulnerable to social engineering attacks [7]. Employees sometimes ignore time-consuming security procedures in an effort to complete work tasks more quickly.…”

“…Given the fact that social engineering threats are dynamic and constantly evolving, developing a mitigation strategy becomes a top priority for organizations, including training employees to counter such attacks [7,10]. This countermeasure includes testing their level of awareness of social engineering from time to time [11,12].…”

“…Also, it is essential for organizations to have a defined set of security rules for attaining maximum efficacy. In addition to protecting companies from attackers, one of the greatest benefits of enforcing security policies is the protection from potential lawsuits that may arise in case of attacks and crack downs from the local authorities [7].…”