Decrypting Social Engineering: An Analysis of Conceptual Ambiguity

Abstract

Social engineering is widely considered to be one of the most significant contemporary threats to information security. Despite its ubiquitous use among online criminal subcultures and security practitioners, there exists no single agreed upon conceptualization of “social engineering.” Responses from 37 qualitative semi-structured interviews with “social engineers” are analyzed using grounded theory methods to generate a subculturally grounded understanding of the term. The results of this analysis indicate that “social engineering” is nearly indistinguishable from other forms of fraud or influence except in the manner in which participants frame the concept. Drawing from the work of Mikhail Bakhtin (1981), we argue that the concept of “social engineering” is part of a linguistic heteroglossia that reveals the subcultural values and ideologies of its practitioners which are underpinned by a computational or mechanistic worldview.