|
Title:
|
SOCIAL ENGINEERING AS AN APPROACH
FOR PROBING ORGANIZATIONS TO IMPROVE
IT SECURITY: A CASE STUDY AT A LARGE
INTERNATIONAL FIRM IN THE TRANSPORT INDUSTRY |
|
Author(s):
|
Daniël van Liempd, Arthur Sjouw,Matthijs Smakman andKoen Smit |
|
ISBN:
|
978-989-8533-85-2 |
|
Editors:
|
Piet Kommers, Pascal Ravesteijn, Guido Ongena and Pedro Isaías |
|
Year:
|
2019 |
|
Edition:
|
Single |
|
Keywords:
|
Social Engineering, Security awareness, Security analysis, Phishing |
|
Type:
|
Full Paper |
|
First Page:
|
119 |
|
Last Page:
|
126 |
|
Language:
|
English |
|
Cover:
|
|
|
Full Contents:
|
click to dowload 
|
|
Paper Abstract:
|
This paper describes the external IT security analysis of an international corporate organization, containing a technical and
a social perspective, resulting in a proposed repeatable approach and lessons learned for applying this approach. Part of the
security analysis was the utilization of a social engineering experiment, as this could be used to discover employee related
risks. This approach was based on multiple signals that indicated a low IT security awareness level among employees as
well as the results of a preliminary technical analysis. To carry out the social engineering experiment, two techniques were
used. The first technique was to send phishing emails to both the system administrators and other employees of the
company. The second technique comprised the infiltration of the office itself to test the physical security, after which two
probes were left behind. The social engineering experiment proved that general IT security awareness among employees
was very low. The results allowed the research team to infiltrate the network and have the possibility to disable or hamper
crucial processes. Social engineering experiments can play an important role in conducting security analyses, by showing
security vulnerabilities and raising awareness within a company. Therefore, further research should focus on the
standardization of social engineering experiments to be used in security analyses and further development of the approach
itself. This paper provides a detailed description of the used methods and the reasoning behind them as a stepping stone for
future research on this subject. |
|
|
|
|
|
|
