Social engineering defence mechanisms and counteracting training strategies. (12th June 2017)

• Record Type: Journal Article
• Authors: Schaab, Peter; Beckers, Kristian; Pape, Sebastian
• Is Part Of: Information and computer security. Volume 25:Number 2(2017)
• Page Start: 206
• Page End: 222
• Publication Date: 2017-06-12
• Subjects: Persuasion -- Social engineering -- Human-centred defence mechanisms -- Security management; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-04-2017-0022
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: This paper aims to outline strategies for defence against social engineering that are missing in the current best practices of information technology (IT) security. Reason for the incomplete training techniques in IT security is the interdisciplinary of the field. Social engineering is focusing on exploiting human behaviour, and this is not sufficiently addressed in IT security. Instead, most defence strategies are devised by IT security experts with a background in information systems rather than human behaviour. The authors aim to outline this gap and point out strategies to fill the gaps. Design/methodology/approach: The authors conducted a literature review from viewpoint IT security and viewpoint of social psychology. In addition, they mapped the results to outline gaps and analysed how these gaps could be filled using established methods from social psychology and discussed the findings. Findings: The authors analysed gaps in social engineering defences and mapped them to underlying psychological principles of social engineering attacks, for example, social proof. Furthermore, the authors discuss which type of countermeasure proposed in social psychology should be applied to counteract which principle. The authors derived two training strategies from these results that go beyond the state-of-the-art trainings in IT security and allow security professionals to raise companies' bars against social engineering attacks. Originality/value: The training strategies outline how interdisciplinary research between computer science and social psychology can lead to a more complete defence against social engineering by providing reference points for researchers and IT security professionals with advice on how to improve training.