Psychological Aspects of the Organization’s Information Security in the Context of Socio-engineering Attacks

Abstract

The purpose of this review article is to determine approaches to solving existing problems in taking into account the psychological aspects of an organization’s information security in the context of socio-engineering attacks based on the analysis and systematization of sources on this topic.Methods. To achieve this goal, two complementary directions were chosen. The first direction included the investigation of selected specialized journals. The second direction involved the analysis of the representation of this problem in the Scopus database over the past 20 years.Results. The analysis of the psychological aspects of the key elements of a socio-engineering attack is carried out: the knowledge and skills of the attacker, organizational conditions, the characteristics of an employee who is part of information systems and the direction of training and prevention. A model of socio-engineering attack considering psychological aspects is proposed.Conclusions. The study showed that the approaches developed now are sufficient to form the basis for the revision of personnel processes in the organization. The problem of social engineering attacks cannot be solved without the involvement of HR services in terms of changing HR processes, taking into account information security policies. The results of this study will be of interest to specialists in the field of personnel management, personnel training, information security, information technology, artificial intelligence, executives, business owners, heads of state and municipal bodies.