Comparing Misuse Case and Mal-Activity Diagrams for Modelling Social Engineering Attacks

Comparing Misuse Case and Mal-Activity Diagrams for Modelling Social Engineering Attacks

Peter Karpati (Norwegian University of Science and Technology, Norway), Guttorm Sindre (Norwegian University of Science and Technology, Norway) and Raimundas Matulevicius (Institute of Computer Science, University of Tartu, Estonia)
Copyright: © 2012 |Pages: 20
DOI: 10.4018/jsse.2012040103
OnDemand PDF Download:


Understanding the social engineering threat is important in requirements engineering for security-critical information systems. Mal-activity diagrams have been proposed as being better than misuse cases for this purpose, but without any empirical testing. The research question in this study is whether mal-activity diagrams would be more efficient than misuse cases for understanding social engineering attacks and finding prevention measures. After a conceptual comparison of the modelling techniques, a controlled experiment is presented, comparing the efficiency of using the two techniques together with textual descriptions of social engineering attacks. The results were fairly equal, the only significant difference being a slight advantage for mal-activity diagrams concerning perceived ease of use. The study gives new insights into the relative merits of the two techniques, and suggests that the advantage of mal-activity diagrams is smaller than previously assumed. However, more empirical investigations are needed to make detailed conclusions.
Article Preview

1. Introduction

The term ‘social engineering’ (Townsend, 2010) comes from the hacker community and is a widely accepted jargon for conning people into helping an attacker to compromise a target system. Social engineering is often considered the easiest way to get illegitimate access to confidential information or perform other security-related attacks on information systems (Mitnick & Simon, 2002). Yet the information security efforts of many organizations tend to be focused on technical solutions. In a survey (Gallagher & Gallagher, 2010) where organizations were asked about their effectiveness in mitigating ten different security issues, social engineering came tenth, so organizations considered that they were least effective in dealing with this. Yet there is comparatively little research related to social engineering, meaning that it remains one of the most under-researched topics in information security (Taylor & Garrett, 2007). Security professionals predict that it will continue being a dominant threat (Northcutt, 2011).

One important step in addressing social engineering is to understand the threats (Power & Forte, 2006). Techniques for this must be easy to understand and not presuppose advanced technical knowledge, since victims of social engineering are not only computer workers but also front desk clerks, personnel officers, janitors or anyone in an organization who might have access to offices, infrastructure, people or sensitive information. Misuse cases (Sindre & Opdahl, 2005), henceforth abbreviated MUC, is one technique for threat modelling, often argued to be simple to understand even for people without technical expertise. However, in Sindre (2007) it was argued that misuse cases might not give a good representation of social engineering, since such attacks are often comprised of many different episodes, e.g., the attacker first talks to person A, posing as X, achieving some partial result. Then he talks to person B, posing as Y (e.g., Y = A, using insights from the former conversation), etc., until the confidential information is finally obtained. Motivated by this, Sindre (2007) proposed another notation, mal-activity diagrams, henceforth abbreviated MAD, which was assumed to be better than misuse case diagrams for depicting social engineering attacks.

Complete Article List

Search this Journal:
Open Access Articles: Forthcoming
Volume 8: 4 Issues (2017): 1 Released, 3 Forthcoming
Volume 7: 4 Issues (2016)
Volume 6: 4 Issues (2015)
Volume 5: 4 Issues (2014)
Volume 4: 4 Issues (2013)
Volume 3: 4 Issues (2012)
Volume 2: 4 Issues (2011)
Volume 1: 4 Issues (2010)
View Complete Journal Contents Listing