Investigating the awareness of social engineering on current and future employees

Abstract

Information security can be divided into two main approaches - technological approach and human based security. In this paper we discuss and experiment the effect of social engineering which targets the human element of security to obtain access into a target company or system. Social engineering is continually on the rise as technical security measures are getting more and more complex and harder to break. Psychological vulnerabilities in human behavior allow a skillful social engineer to achieve his/her goals with great ease. In this paper, we investigate the awareness of current and future employees through two experiments. It has been noted that the majority of respondents are not aware of social engineering and can easily provide sufficient information for an attacker to gain access into a system. Several security measures have been highlighted that prevent or minimize social engineering.