Use Of Social Engineering Research Articles

Social engineering and the use of persuasion to commit cyber fraud

The use of social engineering in cyberattacks has increased in recognition. The gap in understanding is how the various aspects of psychology influence the outcome of social engineering attacks. In this paper Cialdini’s principles of persuasion are discussed in conjunction with neuroscience. Additional insights are introduced, including how biases function within the structure of a business e-mail compromise (BEC) e-mail and what part the persuasion principles play in the structure of the e-mail and the requests. Additional context is provided with examples to clarify the concepts of the various topics discussed. Previous research has focused on isolated disciplines of psychology and its use in phishing attacks. This singular focus has failed to address the various nuances which take place with a social engineering attack. Referencing Cialdini’s extensive work in persuasion as well as social hierarchies and the role of physiology in decision making allows for additional insights to be explored. This unique perspective will offer a more holistic understanding of the aspects that influence decisions a person makes when targeted by a social engineering attack.

A Study on the Psychology of Social Engineering-Based Cyberattacks and Existing Countermeasures

As cybersecurity strategies become more robust and challenging, cybercriminals are mutating cyberattacks to be more evasive. Recent studies have highlighted the use of social engineering by criminals to exploit the human factor in an organization’s security architecture. Social engineering attacks exploit specific human attributes and psychology to bypass technical security measures for malicious acts. Social engineering is becoming a pervasive approach used for compromising individuals and organizations (is relatively more convenient to compromise a human compared to discovering a vulnerability in the security system). Social engineering-based cyberattacks are extremely difficult to counter as they do not follow specific patterns or approaches for conducting an attack, making them highly effective, efficient, easy, and obscure approaches for compromising any organization. To counter such attacks, a better understanding of the attack tactics is highly essential. Hence, this paper provides an in-depth analysis of the approaches used to conduct social engineering-based cyberattacks. This study discusses human vulnerabilities employed by criminals in recent security breaches. Further, the paper highlights the existing approaches, including machine learning-based methods, to counter social engineering-based cyberattacks.

Awareness of the Concept of Social Engineering in Jeddah

Significant advances have been seen in the field of cybersecurity in various institutions globally. However, there are still challenges to setting standards and rules to avoid related problems, due to the use of social engineering. Thus, raising awareness of social engineering methods is considered vital to mitigate the negative impact of social engineering. The aim of this study is to investigate the level of awareness of the concept of social engineering in the city of Jeddah. This study was conducted using an online questionnaire to collect and analyze data. It has been found that there is a lack of awareness, and this issue must be addressed before it escalates.

Social Technologies and Principles of Criminal Justice in the Context of its Digitalization

The paper analyzes the problems that arise in the process of digitalization of criminal proceedings, when its organizers are forced to organize the interaction of social and computer technologies, the joint development and application of which become inevitable in modern conditions. The basic concepts of social technologies theory that were originally developed as a means of organizing human activities, with criminal justice system being only one of them, are interpreted in a new way. The main contexts of application of "social technology" concept, as well as the significance of social technologies in the formulation of principles and achieving the goals of criminal proceedings are studied. The author defines a special type of social technologies, humanitarian technologies in the paper, and analyzes the relevance of this type of technology in the system of principles of criminal procedure. The author substantiates the need to distinguish between the theoretical and technological aspects of compliance with the principles of criminal justice, which allows us to reconstruct the entire system of goal-setting impact on people’s actions and social relations through the development and application of social technologies. The concept of gradual transformation of society through the use of social engineering, put forward by K. Popper, is analyzed in detail. The role of the theoretical distinction between methodological essentialism and methodological nominalism (antirealism) is reconstructed. The ideological and political contextualization of the theory of social technologies, which dominates in modern social science, is subjected to critical analysis. The author examines the ontological assumptions and methodological guidelines proposed by K. Popper for the approval of his socio-technological doctrine. The author identifies and describes the specifics of the use of social technologies in the context of the use of artificial intelligence systems in criminal proceedings. The point about the need to search for the relationship and mutual consistency of the systems of the individual and society in the process of digitalization of criminal proceedings both at the level of principles and at the level of technology is substantiated.

МОДЕЛЬ АНАЛІЗУВАННЯ УРАЗЛИВОСТЕЙ СОЦІОТЕХНІЧНИХ СИСТЕМ ДО ВПЛИВІВ СОЦІАЛЬНОЇ ІНЖЕНЕРІЇ

Socio-technical systems as education with technical and social subsystems are considered. The directions for ensuring their safety have been established and among them the use of technical capabilities has been singled out, taking into account user behavior. Attention is paid to their vulnerabilities to the realisability of sociotechnical threats, in particular, the influence of social engineering. The orientation of such an influence on the manipulation of weaknesses, needs, mania (passions), user hobbies is shown. This leads to the insolvency of socio-technical systems to counteract the influence of social engineering. This can be prevented by analyzing the user's vulnerabilities regarding the forms of manipulation of their consciousness. The approaches to counteracting the use of social engineering are compared. For each of them, the application features, advantages, and disadvantages are analyzed. Given this, it is proposed to use fuzzy directed social graphs to set a model for analyzing the vulnerabilities of socio-technical systems. This was preceded by the definition of the concepts of the social network, actor, relationships. This view allows us to take into account the characteristics of the social engineering influence. In particular, the numbers of input and output arcs distinguish varieties of actors from the social engineer, user, manipulative form, vulnerability. While the importance of each of them is determined using the characteristics of centrality and prestige. At the same time, the levels of the actor, dyad, and the triad of vulnerabilities analysis of socio-technical systems to the effects of social engineering are highlighted. This will make it possible to determine the ways of such impacts taking into account the peculiarities of their realizability through user vulnerabilities and, as a result, to counteract them. In further research, it is planned to develop a method for analyzing the vulnerability of socio-technical systems to the impacts of social engineering based on the proposed model.

Methods of counteracting social engineering

Methods of counteracting the use of social engineering are analyzed. Relevant tools, for example, Social-Engineer Toolkit, Social Engineering Defensive Framework, Social Engineering Optimizer, Kali Linux, have been considered as examples of their practical implementation. Among the methods analyzed, penetration testing is highlighted. This method of counteraction is focused on identifying and preventing the exploitation of human (employee, client) vulnerabilities. Human vulnerability testing for penetration testing is done using the Social-Engineer Toolkit and Kali Linux, Cogni-Sense. Each of these tools is focused on the implementation of threats to social engineering. In this case, the Social-Engineer Toolkit can be used individually or as part of Kali Linux. At the same time the method of raising awareness of employees and customers is considered. To do this, he is trained on the likely scenarios of social engineering attacks. As a result of such training, technologies and policies for counteracting socio-engineering influence are being improved. In practice, the method is implemented as the Social Engineering Defensive Framework. At the same time, there are two aspects of counteracting the use of social engineering: the subject (the attacker), the object (the protector) of socio-engineering influence. This method can counteract the use of social engineering by considering likely actions by the attacker. It is considered that the sequence of its actions is determined solely in view of the attack scenarios of social engineering. This method allows each action to counteract and, consequently, prevent the realization of threats to the use of social engineering. This method is practically implemented by the tool Social Engineering Optimizer. In addition, the method of identifying and reporting to employees (clients) about the use of social engineering is considered. Its practical application of Cogni-Sense is focused on the interpretation of humans as a sensor that responds to socio-engineering impact. Thus, the analysis of counteracting methods for the use of social engineering will allow, first, to consider their advantages and disadvantages to prevent the realization of threats of socio-engineering influence; second, to develop appropriate models, methods and tools to overcome the shortcomings of known solutions.

Virtuous human hacking: The ethics of social engineering in penetration-testing

This paper offers a virtue ethics analysis of social engineering in penetration-testing. It begins by considering previous research on this topic and argues that such attempts misconstrue or more often overlook this Aristotelian tradition. It articulates the core tenets of virtue ethics and applies them to an analysis of white hat social engineering. A virtue ethics analysis requires that individuals and the firms that initiate the penetration-test be placed within a larger communal context which obligates individuals who are potential human hacking victims to participate in the constitution and flourishing of larger communities. As such, for virtue ethics consent is not a necessary condition for the positive ethical status of white hat social engineering. If methods are consistent with moderation (i.e. the golden mean) manipulation at lower orders within the hierarchy of communities can be justified if it can reasonably be understood as part of an individual's participatory obligation and the results of this participation is essential to ensure the eudaimonia of the larger community. Nevertheless, the golden mean requires that robust mitigation strategies lessen the degree of harm inflicted on social engineering victims. Where possible, a degree of consent should be attained as part of this mitigation. Finally, penetration-testing firms must be able to demonstrate that a robust ethical training program governs its use of social engineering.

Zmiany w środowisku bezpieczeństwa regionu Morza Bałtyckiego kreowane przez działania informacyjne Federacji Rosyjskiej. Ryga, Tallin i Wilno wobec presji informacyjnej Moskwy

Along with the intensive dissemination of information and communication technologies, there has been a rapid increase in the availability of information, and even its excess. The specific way of informing on the Internet and social media has started to influence the behavior of its users and on the community and society as the number of Internet users is rapidly growing. With the help of ICT tools, one can create patterns of interpersonal contacts and civic awareness, which can potentially lead to mass surveillance, the use of social engineering for purposes contrary to the objectives of a given society or creating needs and lifestyles. Examples of such activities of the Russian Federation against Lithuania, Latvia and Estonia, although necessarily limited, indicate that the Kremlin's activity is intensifying, well-organized, with the use of both people and automatic communication. Moscow uses traditional and social media directly and indirectly, carefully choosing means of information war - propaganda, disinformation, falsification of reality and discrediting opponents. The message generated by the Kremlin-friendly media creates a new security environment characterized by information chaos, causing the inability to distinguish the truth from falsehood, uncertainty about the intentions of the authorities of their own countries and neighbors, uncertainty about the actual state of affairs. The long-term goal for the Baltic states is to create organizational and administrative chaos in societies and authorities at all levels who, by making decisions on false premises, will destabilize these countries in every aspect.

The impact of security Awareness on information technology professionals’ behavior

Protecting digital assets is a growing concern for corporations, as cyberattacks affect business performance, reputation, and compromise intellectual property. Information technology (IT) security in general and cyber security, in particular, is a fast-evolving area that requires continuous evaluation and innovation. The objective of cyber-attacks has not changed over time however there is a shift in the attack methods through the increased use of social engineering, concentrating on the human elements as the weakest link in the security posture of any system network. This research looks at the relationship between threat awareness and countermeasure awareness on IT professionals’ compliance with desktop security behaviors. The model originally put forward by Hanus and Wu (2016), was tested on a population of 400 IT professionals across a broad range of IT roles and company sizes in the United States. The overall findings show that 61.2% of the variability in desktop security behavior can be explained by threat awareness and countermeasure awareness. In addition, the research found a determinant relationship between threat awareness and countermeasure awareness with the five elements of protective motivation theory (PMT), which include perceived severity, perceived vulnerability, self-efficacy, response efficacy, and response cost. Finally, the research shows that all elements of PMT, with the exception of perceived vulnerability, significantly determine desktop security behavior.

Are you being manipulated?

Purpose – To explore the distinctions between social marketing and social engineering. Design/methodology/approach – Evaluates alternative definitions proposed in the theoretical literature. Gives examples of the use of social engineering by democratic governments, contrasting this with the use by totalitarian regimes of a process of social fabrication, social engineering and social marketing in the form of propaganda. Findings – The consequences of some individual behaviors don’t just affect that one person. When a widespread individual behavior has a social impact then society – typically the government – has to decide if the impact is bad enough to justify doing something about it. That can mean legislation, but is also likely to use marketing methods such as publicity campaigns to influence behavior. This kind of social marketing is generally seen as a “good thing”. Strange, perhaps, when people usually describe social engineering as a “bad thing”. Practical implications – Concludes that when the public is fully aware of the links between social marketing and social engineering, people will be better able to appreciate the extent to which their behavior is being influenced. Social implications – Argues that marketers have an obligation to assess whether social marketing campaigns in which they participate are consistent with the norms and values of their society. Originality/value – Describes social engineering as a normal part of the business of government – whether totalitarian or democratically elected.

Rwandan developmental ‘social engineering’: What does it imply and how is it displayed?

Rwandan development policy is frequently referred to as ‘social engineering’. As this concept is not analytically clear and carries negative connotations, this article elaborates on its meaning. An analytical framework is developed and applied to selected Rwandan policies and programmes, as depicted in government documents, academic writing and field work. The analysis points to far-reaching social engineering in terms of visionary design, depoliticized managerialism, firm and partly coercive implementation, state–population separation and paternalism. In the conclusion, impressive results as well as problematic aspects are discussed, as are the negative connotations and the legitimate use of social engineering.