Search

The article presents the discussion on digital environment when immersed users become distracted by an AR interface. Topics include access social media and other websites on their personal smartphones at work or use an office network to visit these platforms; and potential oversight could risk users engaging with notifications designed for social engineering or espionage.

The overall efforts and expenses put across by the organizations and institutions to protect their sensitive information from the larceners has drastically elevated in the recent past with the enhancement and sophistication of advanced persistent threats (APT) attacks, yet obfuscation that these APTs create while in business are proving these organization's and institution's security systems feeble. To prevent the APT's proliferation, the computer security systems shall get out-of-the-box solutions that can challenge the invaders. The proposed comprehensive event-time-action (CETA) threat intelligence has come up with such a model. The basic cons of the existing security systems is to go with the flow which they have found in forensic investigation of the attacks that APTs have made. The CETA model uses the pattern and procedures that the APTs follow, as proposed by Lockheed Martin's intrusion kill chain (IKC), with a new shade every-time. CETA with the consolidation of shuffle-selective-search module, octa-secured entry module, ensnare the invader module and machine learning tools has successfully detected and with better efficiency has prevented the APT's attacks trails. The rigorous experiments with penetration tests and vulnerability exploitations the CETA model has found that sensitive information system could not be breached with success rate of 97.43% of prevention and 98.67% accuracy of detection of the attacks by the APT's spear phishing and social engineering attack vectors. [ABSTRACT FROM AUTHOR]

In today's computerised world, cybersecurity attacks have become a major headache with detrimental effects on cultural institutions including libraries, archives, and museums around the world. The exponential growth in the use of Information and Communication Technology (ICT) and advances in digitalisation have increased the complexity of cybersecurity attacks and threats. Archival repositories face greater exposure to cybersecurity threats and attacks due to increasing digitalisation. In South Africa, a growing number of cultural heritage institutions such as archival repositories and libraries are under constant attack by cybersecurity threats and attacks to disrupt systems, networks, and services offered to the citizens. Cybersecurity could serve as the wall keeping malicious actors from attacking these institutions. This qualitative study sought to explore cybersecurity of information systems at the National Archives and Records Service of South Africa (NARSSA) in Pretoria. Data were collected through semi-structured interviews that were tape-recorded and analysed using a thematic analysis and NVivo 12 software package. The findings of this study revealed that the NARSSA is under severe attack from phishing attacks, computer viruses and worms, Trojan horses, password attacks, and Denial of Service attacks. The results further showed that Microsoft firewall, audit train, strong user password and anti-virus software were put in place to mitigate cybersecurity attacks and threats. The NARSSA should achieve a strong cyber resilience security posture to protect computer systems against cyber-attacks. It is concluded that the NARSSA needs to invest heavily in a security awareness program to continually train staff on how to identify and respond appropriately to the growing range of cyber security threats and defend against attacks such as phishing attacks, social engineering attacks, ransomware attacks, and malware attacks. [ABSTRACT FROM AUTHOR]

The papers in this special section focus on cyberattacks, strategic cyber-foresight, and security applications. Reports of cyber-attacks against individuals, organizations, and businesses are on the rise. Attackers usually have a deliberate and malicious intent and may involve the criminals taking advantage of flaws in software code, using tricks to get around antivirus tools, and or exploiting unsuspecting users into divulging sensitive information. Often launched by isolated amateurs, or criminals that belong to often well-structured organizations, with money, motivation, and an agenda, such attacks are frequently designed to temporarily or indefinitely disrupt services of a host connected to the internet or simply grind institutional systems to a halt. Popular among social engineering, malwares employed in such attacks are what has come to be known as a distributed denial-of-service attack, which affect the infrastructure of websites, computer servers, and other network resources resulting in the compromise of critical personal or institutional data. Across the globe, these attacks are growing in sophistication, and they tend to have serious economic and security consequences for their targets. The chaos they precipitate can be life-threatening, and their cost can be considerable to target organizations or nations. Such features also affect the dynamics of collaboration among firms, thus posing negative effects on innovation dynamics. [ABSTRACT FROM AUTHOR]

Today's threats use multiple means of propagation, such as social engineering, email, and application vulnerabilities, and often operate in different phases, such as single device compromise, lateral network movement, and data exfiltration. These complex threats rely on advanced persistent threats supported by well-advanced tactics for appearing unknown to traditional security defenses. As organizations realize that attacks are increasing in size and complexity, cyber threat intelligence (TI) is growing in popularity and use. This trend followed the evolution of advanced persistent threats, as they require a different level of response that is more specific to the organization. TI can be obtained via many formats, with open-source intelligence one of the most common, and using threat intelligence platforms (TIPs) that aid organizations to consume, produce, and share TI. TIPs have multiple advantages that enable organizations to quickly bootstrap the core processes of collecting, analyzing, and sharing threat-related information. However, current TIPs have some limitations that prevent their mass adoption. This article proposes AECCP, a platform that addresses some of the TIPs limitations. AECCP improves quality TI by classifying it accordingly a single unified taxonomy, removing the information with low value, enriching it with valuable information from open-source intelligence sources, and aggregating it for complementing information associated with the same threat. AECCP was validated and evaluated with three datasets of events and compared with two other platforms, showing that it can generate quality TI automatically and help security analysts analyze security incidents in less time. [ABSTRACT FROM AUTHOR]

Highlights • Phishing email subject lines contain high and diverse persuasive power in just a few words. • The paper builds on the well-known and foundational work of Cialdini's (2007), Gragg's (2003) and Stajano and Wilson (2011) to derive a unique list of Principles of Persuasion in social engineering, resulting from the application of the relational method by two independent researchers. • The study of the relations between existing persuasion principles was applied to the content analysis, by two independent researchers, of a random sample of phishing emails subject lines (N = 194), dated from 2008 to 2017. A thematic content analysis and a sample characterization in terms of visual elements and targeted content, revealed that the most prominent persuasion principles were 'Authority', 'Strong Affect', 'Integrity' and 'Reciprocation'. The persuasion principle 'Strong Affect' was the one containing the larger percentage of references with the presence of visual elements. The use of the pronoun 'you' and 'your' was more evident for the categories 'Strong Affect' and 'Authority', while the employment of the pronouns 'we, us, our' was more expressive in the 'Reciprocation' principle. • This paper presents a method on the way to define a tool for automated identification of principles of human persuasion in social engineering, within phishing emails. Future solutions should focus on the use of socio-technical aspects related mainly to a small number of persuasion principles ('Authority' and 'Distraction – Strong Affect'), which seem to be the most commonly used in phishing emails. Abstract Phishing is a very dangerous form of social engineering with the aim to deceive people into disclosing private/confidential information. Despite widespread warnings and means to educate users to identify phishing messages, these are still a prevalent practice and a lucrative business. The authors believe that persuasion, as a style of human communication designed to influence others, has a central role in successful digital scams. Research on persuasion applied to phishing emails is scarce and tends to build on Cialdini's work alone. Only a single study has proposed a list of merged principles from three different perspectives but it has methodological limitations regarding the analysis' performance by a single researcher and the testing of principles in a small, not validated sample of phishing emails. This paper aims to fill those gaps by building on Cialdini's, Gragg's and Stajano & Wilson's works to derive a unique list of Principles of Persuasion in Social Engineering (PPSE), resulting from the application of the relational method by two independent researchers. The PPSE are identified, by two independent researchers (Kappa > 0.789) on a sample of phishing email subject lines (N = 194), dated from 2008 to 2017 and randomly selected from a reliable phishing archive (millersmiles.co.uk). A thematic content analysis, together with the sample characterization in terms of visual elements and targeted content, revealed that the most prominent principles of persuasion in phishing emails were 'Authority', 'Strong Affect', 'Integrity' and 'Reciprocation'. The larger percentage of references with the presence of visual elements was found for the 'Strong Affect' principle. The use of the pronouns 'you' and 'your' was more evident for the categories 'Strong Affect' and 'Authority', while the employment of the pronouns 'we, us, our' was more frequent in the 'Reciprocation' principle. This paper constitutes a step further in understanding the use of principles of persuasion in phishing emails with future applications on how their recognition can be automated. [ABSTRACT FROM AUTHOR]

The aim of this study was to explore the extent to which persuasion principles are used in successful social engineering attacks. Seventy-four scenarios were extracted from 4 books on social engineering (written by social engineers) and analysed. Each scenario was split into attack steps, containing single interactions between offender and target. For each attack step, persuasion principles were identified. The main findings are that (a) persuasion principles are often used in social engineering attacks, (b) authority (1 of the 6 persuasion principles) is used considerably more often than others, and (c) single-principle attack steps occur more often than multiple-principle ones. The social engineers identified in the scenarios more often used persuasion principles compared to other social influences. The scenario analysis illustrates how to exploit the human element in security. The findings support the view that security mechanisms should include not only technical but also social countermeasures. [ABSTRACT FROM AUTHOR]

Cyber threats have been growing with social engineering and business e-mail compromise reported as the two most rising penetration vectors. Advanced Persistent Threats (APTs) are penetration techniques that combine several approaches to gain access to organizational networks. Organizations need a team of skilled individuals to mitigate or prevent the complexity and seriousness of cyber threats such as APTs. A skill is defined as the combination of ability, knowledge and experience to do something well. Therefore, cybersecurity skills correspond to individual's ability, knowledge and experience surrounding the hardware and software required to identify, protect, detect, respond and recover against damage, unauthorized use, modification, and/or exploitation of cyber infrastructure. Moreover, a strong security posture cannot exist without individuals that possess high level of cybersecurity skills as cyber-attackers prejudice against all nationalities. Therefore, the importance to find individuals that use their cybersecurity skills for good is paramount. This paper presents an-in-depth discussion on the theoretical rationale for cybersecurity skills as the cornerstone of APTs and other cyber threat mitigation. [ABSTRACT FROM AUTHOR]

This article discusses why cybersecurity organizations need to rethink how they protect against the next wave of malware attacks and information-borne threats. The author analyzes monetization strategies driving malware development, the latest social engineering and payload delivery techniques, and a layer of sanitization to detect and prevent an attack before it starts. [ABSTRACT FROM AUTHOR]

The article is devoted to the audit of the bank's information security when working with electronic money. The author considers main requirements and principles of conducting audit, identifies main directions of the audit, in particular, organisational-technical and legal provision of banks for prevention of violation of integrity, accessibility, confidentiality and observance of information systems, which ensure functioning of the electronic money systems. Moreover, the article pays attention to social engineering and focuses on the necessity to conduct audit of training of bank specialists that deal with electronic money operations and users (owners) of electronic money. [ABSTRACT FROM AUTHOR]

The essential need for security is apparent to organizations, government and individuals. Whether it is to secure a company's assets, abide by a law, or guard an individual's privacy, it has become evident that all are vulnerable to one form of electronic attack or another and that in order to protect sensitive information, all possible security precautions must be taken to limit any form of authorized access to electronic records or computer-related equipment. In this security-conscious era, we spend huge sums on technology to protect our computer networks and data. As IT security spending has increased so also has the number of successful attacks. This paper has been developed to highlight the fact that we all have an 'electronic life' which is been hunted by social engineers, and provides a solution on how this life can be protected. The purpose is to provide organizations and individual a simple solution for increasing security awareness against social engineering attacks towards their critical information. [ABSTRACT FROM AUTHOR]

Purpose – The purpose of this paper is to investigate the behaviour response of computer users when either phishing e-mails or genuine e-mails arrive in their inbox. The paper describes how this research was conducted and presents and discusses the findings. Design/methodology/approach – This study was a scenario-based role-play experiment that involved the development of a web-based questionnaire that was only accessible by invited participants when they attended a one-hour, facilitated session in a computer laboratory. Findings – The findings indicate that overall, genuine e-mails were managed better than phishing e-mails. However, informed participants managed phishing e-mails better than not-informed participants. Other findings show how familiarity with computers, cognitive impulsivity and personality traits affect behavioural responses to both types of e-mail. Research limitations/implications – This study does not claim to evaluate actual susceptibility to phishing emails. The subjects were University students and therefore the conclusions are not necessarily representative of the general population of e-mail users. Practical implications – The outcomes of this research would assist management in their endeavours to improve computer user behaviour and, as a result, help to mitigate risks to their organisational information systems. Originality/value – The literature review indicates that this paper addresses a genuine gap in the research. [ABSTRACT FROM AUTHOR]

The purpose of this paper is to present some directions to perform the risk management for information security. The article follows to practical methods through questionnaire that asses the internal control, and through evaluation based on existing controls as part of vulnerability assessment. The methods presented contains all the key elements that concurs in risk management, through the elements proposed for evaluation questionnaire, list of threats, resource classification and evaluation, correlation between risks and controls and residual risk computation. [ABSTRACT FROM AUTHOR]

This study demonstrates that consumers, healthcare workers and corporate America are still very much vulnerable to simple social engineering attacks, even with current levels of security training. Through a simulation of what a real social engineer might try to do (with a few safeguards to protect participants) security levels were tested in the business district of a large downtown financial center, a hospital, and a university campus. Through the simulation attack, researchers were able to get useful demographic and tactical information from the majority of the victims. In addition, 73% of respondents shared a password with the researchers. Those with recent security awareness training were just as likely as those without to share their passwords with strangers. Results, implications and future directions are discussed [ABSTRACT FROM AUTHOR]

Abstract: Social engineering continues to be an increasing attack vector for the propagation of malicious programs. For this article, we collected data on malware incidents and highlighted the prevalence and longevity of social engineering malware. We developed a framework that shows the steps social engineering malware executes to be successful. To explain its pervasiveness and persistence, we discuss some common avenues through which such attacks occur. The attack vector is a combination of psychological and technical ploys, which includes luring a computer user to execute the malware, and combating any existing technical countermeasures. We describe some of the prevalent psychological ploys and technical countermeasures used by social engineering malware. We show how the techniques used by purveyors of such malware have evolved to circumvent existing countermeasures. The implications of our analyses lead us to emphasize (1) the importance for organizations to plan a comprehensive information security program, and (2) the shared social responsibility required to combat social engineering malware. [ABSTRACT FROM AUTHOR]

Social engineering is not new and it''s here to stay. Kevin Townsend looks at how social networking is a social engineer''s best friend and asks what we can do to protect ourselves from this very real — and very personal — threat [Copyright &y& Elsevier]

The article focuses on security risks related to social networking websites in the context of social engineering, defined as manipulating people into performing actions or divulging confidential information. According to the article, social engineers will exploit trust in human beings and use seemingly harmless information to launch cyber attacks. The article discusses how social engineers online "friends" with people or pretending to be people they trust. The article notes that users should have as little information online as possible and should make sure they treat strangers online as they would treat strangers in everyday life.

Few would argue that enterprises have increasingly become dependent on IT to facilitate business operations. In today's knowledge-driven economy, information is critical to an enterprise's ability not only to survive but also to thrive. Experienced business leaders know that information deserves at least the same level of protection as any other asset, and have made information security managers a common addition to the organization chart. Organizations lose proprietary information daily due to hackers, insiders, or business partners. Most organizations think that this issue isbeing addressed with technology alone, but that is not realistic. This article will try to demonstrate that focusing holistically on people, processes, andtechnology can reduce the impact of data loss. People can be trained to recognize threats such asphishing and social engineering. Processes can address the issue through policies and procedures. Technology can be implemented to monitor and prevent attacks against the environment. [ABSTRACT FROM AUTHOR]

The article presents a study which explores the level of susceptibility to social engineering among employees within a cooperating organisation. Social engineering remains a popular method of compromising the security of computing systems. An e-mail-based experiment was done where staff were sent a message asking them to follow a link and install a claimed software update. The results showed that 23% of recipients were fooled by the attack. It suggests that many users lack security awareness needed to protect them online.

Social engineering is a methodology that allows an attacker to bypass technical controls by attacking the human element in an organization. There are many techniques commonly used in social engineering including but not limited to Trojan and phishing email messages, impersonation, persuasion, bribery, shoulder surfing, and dumpster diving. Hackers rely on social engineering attacks to bypass technical controls by focusing on the human factors. Social engineers often exploit the natural tendency people have toward trusting others who seem likeable or credible, deferring to authority or need to acquiesce to social conformity. Mitigation of social engineering begins with good policy and awareness training, but there are a number of other approaches an organization can take to defend against this type of an attack. Social engineering attacks are likely to increase, and it is becoming increasingly important for organizations to address this issue. [ABSTRACT FROM AUTHOR]

The article discusses a forum discussion to protect organization from cyberattacks. Topics discussed include cyber attacker uses social engineering as a primary tool to bypass the traditional network layers of defense; attacker can determine an individual's password through various means, including collecting stolen passwords available for sale on the dark web, exploiting the tendency to use predictable passwords and two-factor authentication is the next logical step for securing.

The article discusses the relationship between cybercrime and social engineering, and it mentions scams targeting lawyers and law firms, as well as information about attorney-client privilege and phishing attacks. Computer security measures for attorneys and law firms are addressed, along with employee training and online tools for preventing cybercrime and fraudulent email attacks.

When people hear cyber security they automatically think of IT. So when organisations hear the words cyber security breach there is often a tendency to leave it with the IT department, not only to deal with the breach but to ensure the breach doesn't happen again says Andrew Fitzmaurice, Chief Executive, Templar Executives. [ABSTRACT FROM AUTHOR]

The article profiles Kevin Mitnick, the most notorious computer hackers in the U.S. It mentions that Mitnick uses what is known as "social engineering" to accomplish his crimes. He serves four and a half year in prison pre-trial before he agreed to plead guilty to wire and computer fraud. He owns Mitnick Security Consulting LLC, an information security consulting firm based in Henderson, Nevada. He suggests not following his footsteps, noting that there are definitely other roads or other opportunities that people can learn and educate themselves about hacking, security, and pen testing.