Where Good Ideas Come From: The Natural History of Innovation

The idea and perception of good cyber security protection remains at the forefront of many organizations’ information and communication technology strategy and investment. However, delving deeper into the details of its implementation reveals that organizations’ human capital cyber security knowledge bases are very low. In particular, the lack of social engineering awareness is a concern in the context of human cyber security risks. This study highlights pitfalls and ongoing issues that organizations encounter in the process of developing the human knowledge to protect from social engineering attacks. A detailed literature review is provided to support these arguments with analysis of contemporary approaches. The findings show that despite state-of-the-art cyber security preparations and trained personnel, hackers are still successful in their malicious acts of stealing sensitive information that is crucial to organizations. The factors influencing users’ proficiency in threat detection and mitigation have been identified as business environmental, social, political, constitutional, organizational, economical, and personal. Challenges with respect to both traditional and modern tools have been analyzed to suggest the need for profiling at-risk employees (including new hires) and developing training programs at each level of the hierarchy to ensure that the hackers do not succeed.

https://www.mdpi.com/1999-5903/11/3/73/pdf

Reviewing Cyber Security Social Engineering Training and Awareness Programs—Pitfalls and Ongoing Issues

Social engineering is the acquisition of informationabout computer systems by methods that deeply include non-technical means. While technical security of most critical systemsis high, the systems remain vulnerable to attacks from socialengineers. Social engineering is a technique that: (i) does notrequire any (advanced) technical tools, (ii) can be used by anyone,(iii) is cheap. Traditional security requirements elicitation approaches oftenfocus on vulnerabilities in network or software systems. Fewapproaches even consider the exploitation of humans via socialengineering and none of them elicits personal behaviours of indi-vidual employees. While the amount of social engineering attacksand the damage they cause rise every year, the security awarenessof these attacks and their consideration during requirementselicitation remains negligible. We propose to use a card game to elicit these requirements, which all employees of a company can play to understand thethreat and document security requirements. The game considersthe individual context of a company and presents underlyingprinciples of human behaviour that social engineers exploit, aswell as concrete attack patterns. We evaluated our approachwith several groups of researchers, IT administrators, andprofessionals from industry.

https://mediatum.ub.tum.de/doc/1328974/file.pdf

A Serious Game for Eliciting Social Engineering Security Requirements

Cybersecurity awareness in the context of the Industrial Internet of Things: A systematic literature review

Cyber Security Training for Critical Infrastructure Protection: a Literature Review

Social engineering is one of the biggest threats organizations face today, as more and more organizations are adopting digitalization. In the context of cyber security, social engineering is the practice of taking advantage of human weaknesses through manipulation to accomplish a malicious goal. For better implementation methods against social engineering, this qualitative study will attempt to provide measures against information security challenges faced by organizations. The analysis is then provided by the answers of interviewed experts in the field of cyber security and social engineering. The research herein focuses on the human element of cyber security threats, recognizing that hackers exploit the vulnerabilities and lack of awareness of staff. Then using these issues to create security loopholes and engineer cyber-attacks that include the interruption or infection of information systems, transfer of unauthorized funds, and stealing of credentials. The results of this qualitative study highlight that there is a positive relationship between social engineering and user awareness. The findings build upon the researchers' ongoing work, which postulates that as an increase in contextual social engineering knowledge leads to a decrease in being victims of social engineering and is, therefore, one of the most effective mechanisms for managing social engineering.

/pdf/analysis-and-findings-of-social-engineering-industry-experts-44zixzcfvu.pdf

Analysis and Findings of Social Engineering Industry Experts Explorative Interviews: Perspectives on Measures, Tools, and Solutions

Information security is one of the growing sources of concern that organizations are dealing with today. With increased levels of sophistication of social engineering threats, the exploits from such attacks are evolving. This study highlights some of the challenges that organizations encounter in the process of developing the human knowledge to fight against social engineering attacks. Despite state-of-the-art cyber security preparations and trained personnel, hackers are still successful in their malicious acts of stealing sensitive information that is crucial to organizations. This study further discusses the need for human resource departments to impose training requirements for new hires as part of onboarding processes. The factors influencing users' proficiency in the process of threat detection and mitigation have been identified as business environmental, social, political, constitutional, organizational, economical, and personal. Challenges with respect to both traditional and modern tools have been analyzed to suggest the need for profiling at-risk employees and developing training programs at each level of the hierarchy to ensure that the hackers do not succeed.

Challenges of Implementing Training and Awareness Programs Targeting Cyber Security Social Engineering

Social engineering has become one of the biggest security threats facing organizations. Rather than relying upon information security technical-related shortcomings to break into computer networks, social engineers make use of employees’ individual and organizational traits to deceive them. In such a scenario, it is crucial for organizations to ensure that their employees not only possess sound knowledge about information security but also about the concept of social engineering and threats emerging from social engineering attacks. This study aims to test whether awareness of social engineering can predict and explain individuals’ securityprotective practices. We conducted a survey of 265 employees working in different organizations in Saudi Arabia. The results suggest that awareness of social engineering is a positive predictor of security-protective practices above and beyond the predictability power of possessing information security knowledge. Thus, to reduce the probability of potential consequences of social engineering attacks, our study suggests that organizations should not only strive to enhance employees’ security knowledge but should also invest in increasing employees’ awareness of social engineering.

/pdf/does-awareness-of-social-engineering-make-employees-more-3b2y768q41.pdf

Does Awareness of Social Engineering Make Employees More Secure

Rapid technological advancement has not only resulted in a change in the pace of economic development, but also led to increase in cyber-threats. A social engineering attack is one such threat where an attacker not only accesses critical information about a user through technology, but also through manipulation. Although the types of attacks are different i.e. social, physical, technical or socio-technical, the process is the same. This study creates an advanced taxonomy of social engineering attacks with the aim of facilitating the development and implementation of better prevention measures, stressing the importance of organizational awareness.

/pdf/an-advanced-taxonomy-for-social-engineering-attacks-xxuja8sgq8.pdf

An Advanced Taxonomy for Social Engineering Attacks

Educational supervision is closely related to establishing instructional efficiency, and supervision is a multidimensional concept that varies from one setting to another. Application of contemporary tools, however, facilitates mediation of this complex and dynamic process. At the same time, it intends to help schools to establish digital education leadership. The paper herein, presents different methods through which digital leadership can be carried out. This study includes scientific supervision, transactional efforts, and transformational approach. The study suggests that digital and transformational leadership approaches can be blended to inspire leadership teams and leaders in educational supervision to innovate and come up with ideas, objectives and goals that lead change by using an all-around technological approach. The study further presents the benefits for schools to have an integrated leadership approach within educational supervision.

Hussain Aldawood

Papers

Analysis and Findings of Social Engineering Industry Experts Explorative Interviews: Perspectives on Measures, Tools, and Solutions

Challenges of Implementing Training and Awareness Programs Targeting Cyber Security Social Engineering

Does Awareness of Social Engineering Make Employees More Secure

An Advanced Taxonomy for Social Engineering Attacks

Integrating Digital Leadership in an Educational Supervision Context: a Critical Appraisal