Social Engineering and Cyber Security

Breda, Filipe; Barbosa, Hugo; Morais, Telmo

doi:10.21125/inted.2017.1008

Cited by 38 publications

(41 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Currently, social engineering attacks are the biggest threats facing cybersecurity [4][5][6][7][8][9]. According to the authors of [6], they can be detected but not stopped.…”

Section: Social Engineering Attacksmentioning

confidence: 99%

“…Social engineering attacks may combine the different aspects previously discussed, namely: human, computer, technical, social, and physical-based. Examples of social engineering attacks include phishing, impersonation on help desk calls, shoulder surfing, dumpster diving, stealing important documents, diversion theft, fake software, baiting, quid pro quo, pretexting, tailgating, Pop-Up windows, Robocalls, ransomware, online social engineering, reverse social engineering, and phone social engineering [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18]. Figure 4 illustrates the classification of these attacks.…”

Section: Attacks Classificationmentioning

confidence: 99%

See 1 more Smart Citation

Social Engineering Attacks: A Survey

2019

View full text Add to dashboard Cite

The advancements in digital communication technology have made communication between humans more accessible and instant. However, personal and sensitive information may be available online through social networks and online services that lack the security measures to protect this information. Communication systems are vulnerable and can easily be penetrated by malicious users through social engineering attacks. These attacks aim at tricking individuals or enterprises into accomplishing actions that benefit attackers or providing them with sensitive data such as social security number, health records, and passwords. Social engineering is one of the biggest challenges facing network security because it exploits the natural human tendency to trust. This paper provides an in-depth survey about the social engineering attacks, their classifications, detection strategies, and prevention procedures.

show abstract

“…Currently, social engineering attacks are the biggest threats facing cybersecurity [4][5][6][7][8][9]. According to the authors of [6], they can be detected but not stopped.…”

Section: Social Engineering Attacksmentioning

confidence: 99%

Section: Attacks Classificationmentioning

confidence: 99%

Social Engineering Attacks: A Survey

2019

View full text Add to dashboard Cite

show abstract

“…Thapar [21] considered social engineering is ''a collection of techniques used to manipulate people into performing actions or divulging confidential information.'' Later works such as [63], [64], [70], [71] also holds the same type of idea.…”

Section: ) Social Engineering Concepts That Emphasize Deception and mentioning

confidence: 99%

“…Hasan et al [62] argued that social engineering is a process of deceiving people into giving away access or confidential information as a formidable threat to most secured networks. Literature [63], [64] considered that ''in essence, social engineering refers to the design and application of deceitful techniques.'' Some studies emphasize the manipulation of social engineering.…”

Section: ) Social Engineering Concepts That Emphasize Deception and mentioning

confidence: 99%

Defining Social Engineering in Cybersecurity

2020

View full text Add to dashboard Cite

Social engineering has posed a serious security threat to infrastructure, user, data and operations of cyberspace. Nevertheless, there are many conceptual deficiencies (such as inconsistent conceptual intensions, a vague conceptual boundary, confusing instances, overgeneralization and abuse) of the term making serious negative impacts on the understanding, analysis and defense of social engineering attacks. In this paper, an in-depth literature survey is conducted, the original meaning of social engineering in cybersecurity is traced, the conceptual evolution and technical development are analysed systematically, and the conceptual problems are discussed. Based on above work, this paper attempts to address these conceptual deficiencies by proposing a more compatible and precise definition of social engineering in cybersecurity (SEiCS). This definition eliminates the conceptual inconsistencies, covers the mainstream conceptual connotations, clarifies the conceptual boundary, mitigates the overgeneralization and abuse, etc. Five analysis tables (i.e., the comparative analysis of the SEiCS definition vs. mainstream conceptual intensions in the conceptual evolution, the comparative analysis of the SEiCS definition vs. typical definitions in the literature, the analysis of confusing ''social engineering cases'', the analysis of popular social engineering attack scenarios, and the analysis of social-engineering-based attacks) are provided to illustrate the performance of the proposed definition.

show abstract

“…Attacks against businesses have become so resolute that the modern society is incapable of responding to the sheer volume of attacks. In fact, in the year 2016 in an Internet-organized crime threat assessment, it was found that for some European countries, cybercrimes surpassed traditional crimes [1].…”

Section: Introductionmentioning

confidence: 99%

Does Awareness of Social Engineering Make Employees More Secure?

Aldawood¹,

Alashoor²,

Skinner³

2020

IJCA

View full text Add to dashboard Cite

Social engineering has become one of the biggest security threats facing organizations. Rather than relying upon information security technical-related shortcomings to break into computer networks, social engineers make use of employees' individual and organizational traits to deceive them. In such a scenario, it is crucial for organizations to ensure that their employees not only possess sound knowledge about information security but also about the concept of social engineering and threats emerging from social engineering attacks. This study aims to test whether awareness of social engineering can predict and explain individuals' securityprotective practices. We conducted a survey of 265 employees working in different organizations in Saudi Arabia. The results suggest that awareness of social engineering is a positive predictor of security-protective practices above and beyond the predictability power of possessing information security knowledge. Thus, to reduce the probability of potential consequences of social engineering attacks, our study suggests that organizations should not only strive to enhance employees' security knowledge but should also invest in increasing employees' awareness of social engineering.

show abstract

Social Engineering and Cyber Security

Cited by 38 publications

References 4 publications

Social Engineering Attacks: A Survey

Social Engineering Attacks: A Survey

Defining Social Engineering in Cybersecurity

Does Awareness of Social Engineering Make Employees More Secure?

Contact Info

Product

Resources

About