Social engineering attack examples, templates and scenarios

dc.contributor.authorMouton, Francois
dc.contributor.authorLeenen, Louise
dc.contributor.authorVenter, H.S. (Hein)
dc.date.accessioned2016-04-25T11:01:13Z
dc.date.issued2016-06
dc.description.abstractThe field of information security is a fast-growing discipline. Even though the effectiveness of security measures to protect sensitive information is increasing, people remain susceptible to manipulation and thus the human element remains a weak link. A social engineering attack targets this weakness by using various manipulation techniques to elicit sensitive information. The field of social engineering is still in its early stages with regard to formal definitions, attack frameworks and templates of attacks. This paper proposes detailed social engineering attack templates that are derived from real-world social engineering examples. Current documented examples of social engineering attacks do not include all the attack steps and phases. The proposed social engineering attack templates attempt to alleviate the problem of limited documented literature on social engineering attacks by mapping the real-world examples to the social engineering attack framework. Mapping several similar real-world examples to the social engineering attack framework allows one to establish a detailed flow of the attack whilst abstracting subjects and objects. This mapping is then utilised to propose the generalised social engineering attack templates that are representative of real-world examples, whilst still being general enough to encompass several different real-world examples. The proposed social engineering attack templates cover all three types of communication, namely bidirectional communication, unidirectional communication and indirect communication. In order to perform comparative studies of different social engineering models, processes and frameworks, it is necessary to have a formalised set of social engineering attack scenarios that are fully detailed in every phase and step of the process.The social engineering attack templates are converted to social engineering attack scenarios by populating the template with both subjects and objects from real-world examples whilst still maintaining the detailed flow of the attack as provided in the template. Furthermore, this paper illustrates how the social engineering attack scenarios are applied to verify a social engineering attack detection model. These templates and scenarios can be used by other researchers to either expand on, use for comparative measures, create additional examples or evaluate models for completeness. Additionally, the proposed social engineering attack templates can also be used to develop social engineering awareness material.en_ZA
dc.description.departmentComputer Scienceen_ZA
dc.description.embargo2017-06-30
dc.description.librarianhb2016en_ZA
dc.description.urihttp://www.elsevier.com/locate/coseen_ZA
dc.identifier.citationMouton, F, Leenen, L & Venter, HS 2016, 'Social engineering attack examples, templates and scenarios', Computers and Security, vol. 59, pp. 186-209.en_ZA
dc.identifier.issn0167-4048 (print)
dc.identifier.issn1872-6208 (online)
dc.identifier.other10.1016/j.cose.2016.03.004
dc.identifier.urihttp://hdl.handle.net/2263/52151
dc.language.isoenen_ZA
dc.publisherElsevieren_ZA
dc.rights© 2016 Elsevier Ltd. All rights reserved. Notice : this is the author’s version of a work that was accepted for publication in Computers and Security. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Computers and Security, vol. 59, pp. 186-209, 2016. doi : 10.1016/j.cose.2016.03.004.en_ZA
dc.subjectBidirectional communicationen_ZA
dc.subjectIndirect communicationen_ZA
dc.subjectMitnick’s attack cycleen_ZA
dc.subjectSocial engineeringen_ZA
dc.subjectSocial engineering attack detection modelen_ZA
dc.subjectSocial engineering attack examplesen_ZA
dc.subjectSocial engineering attack frameworken_ZA
dc.subjectSocial engineering attack scenarioen_ZA
dc.subjectSocial engineering attack templatesen_ZA
dc.subjectUnidirectional communicationen_ZA
dc.titleSocial engineering attack examples, templates and scenariosen_ZA
dc.typePostprint Articleen_ZA

Files

Original bundle

Now showing 1 - 1 of 1
Loading...
Thumbnail Image
Name:
Mouton_Social_2016.pdf
Size:
1.09 MB
Format:
Adobe Portable Document Format
Description:
Postprint article

License bundle

Now showing 1 - 1 of 1
Loading...
Thumbnail Image
Name:
license.txt
Size:
1.75 KB
Format:
Item-specific license agreed upon to submission
Description: