The aim of this study was to explore the extent to which persuasion principles are used in successful social engineering attacks. Seventy-four scenarios were extracted from 4 books on social engineering (written by social engineers) and analysed. Continue reading →
Telephone-based social engineering attacks
The objective of this study is to evaluate the effectiveness of an information campaign to counter a social engineering attack via the telephone. Four different offenders phoned 48 employees and made them believe that their PC was distributing spam emails. Continue reading →
Presenting at SUTD
On the 14th of January, I presented the paper Telephone-Based social engineering attacks during the First Singapore-Cybersecurity R&D Conference (SG-CRC 2016), hosted at the Singapore University of Technology and Design (SUTD).
Regression nodes
In the field of security, attack trees are often used to assess security vulnerabilities probabilistically in relation to multi-step attacks. The nodes are usually connected via AND-gates, where all children must be executed, or via OR-gates, where only one action is necessary for the attack step to succeed. Continue reading →
The persuasion and awareness experiment
The aim of the current study is to explore to what extent an intervention reduces the effects of social engineering (e.g., the obtaining of access via persuasion) in an office environment. In particular, we study the effect of authority during a ‘social engineering’ attack. Continue reading →