Managing Social Engineering Attacks- Considering Human Factors and Security Investment

Soliciting and managing the protection of information assets has become a objective of
paramount importance in an organizational context. Information Security Management System
(ISMS) has the unique role of ensuring that adequate and appropriate security tools are in
place in order to protect information assets. Security is always seen in three dimensions of
technology, organization, and people. Undoubtedly, the socio-technical challenges have
proven to be the most difficult ones to tackle. Social Engineering Attacks (SEAs) are a sociotechnical
challenge and considerably increase security risks by seeking access to information
assets by exploiting the vulnerabilities in organizations as they target human frailties. Dealing
effectively and adequately with SEAs requires practical security benchmarking together with
control mechanism tools, which in turn requires investment to support security and ultimately
organizational goals. This paper contributes in this area. In particular, the paper proposes a
language for managing SEAs using several concepts such as actor, risks, goals, security
investment and vulnerabilities. The language supports in-depth investigation of human factors
as one of the main causes of SEAs. It also assists in the selection of appropriate mechanisms
considering security investment to mitigate risks. Finally, the paper uses a real incident in a
financial institution to demonstrate the applicability of the approach.