Article Preview
Top1. Introduction
The term ‘social engineering’ (Townsend, 2010) comes from the hacker community and is a widely accepted jargon for conning people into helping an attacker to compromise a target system. Social engineering is often considered the easiest way to get illegitimate access to confidential information or perform other security-related attacks on information systems (Mitnick & Simon, 2002). Yet the information security efforts of many organizations tend to be focused on technical solutions. In a survey (Gallagher & Gallagher, 2010) where organizations were asked about their effectiveness in mitigating ten different security issues, social engineering came tenth, so organizations considered that they were least effective in dealing with this. Yet there is comparatively little research related to social engineering, meaning that it remains one of the most under-researched topics in information security (Taylor & Garrett, 2007). Security professionals predict that it will continue being a dominant threat (Northcutt, 2011).
One important step in addressing social engineering is to understand the threats (Power & Forte, 2006). Techniques for this must be easy to understand and not presuppose advanced technical knowledge, since victims of social engineering are not only computer workers but also front desk clerks, personnel officers, janitors or anyone in an organization who might have access to offices, infrastructure, people or sensitive information. Misuse cases (Sindre & Opdahl, 2005), henceforth abbreviated MUC, is one technique for threat modelling, often argued to be simple to understand even for people without technical expertise. However, in Sindre (2007) it was argued that misuse cases might not give a good representation of social engineering, since such attacks are often comprised of many different episodes, e.g., the attacker first talks to person A, posing as X, achieving some partial result. Then he talks to person B, posing as Y (e.g., Y = A, using insights from the former conversation), etc., until the confidential information is finally obtained. Motivated by this, Sindre (2007) proposed another notation, mal-activity diagrams, henceforth abbreviated MAD, which was assumed to be better than misuse case diagrams for depicting social engineering attacks.