August (published: )
Number ()
Home > Issue > Organizational aspects of countering attacks based on social engineering
In this work, the organizational aspects of countering attacks based on social engineering (SE) have been improved to protect the company's personnel from it. It is shown that attacks based on SE are one of the most effective tools for cyber attacks against information systems and digital infrastructure of enterprises, using the psychological characteristics of people. It was emphasized that the human factor has now begun to play a much more significant role in ensuring information security than before. Statistical and literary data demonstrate that attacks based on SE are successful due to their ability to bypass traditional, mostly technical, defense systems. Based on the literature analysis, individual approaches and techniques underlying such attacks have been described. Taking into account the obtained data and literary sources, a simplified algorithm of actions of an attacker during an attack based on SE is proposed. It is emphasized that among the many measures used to ensure the information security of enterprises of any form of ownership, organizational measures occupy a special place, acting as the "core" of the overall information security system, linking legal and technical measures. It is indicated that such measures, first of all, should be aimed at regulating the functioning of security facilities and the activities of officials in order to ensure information security through the development of certain rules and requirements. It is noted that organizational measures should be the first "barrier" against attacks based on SE. Based on an understanding of the basic mechanisms of SE attacks, taking into account the results from individual studies, practical organizational measures are proposed to protect the company's personnel from it. The practical significance of the presented results lies in the fact that they can be useful to managers of enterprises of any form of ownership and information security specialists to counter SE attacks, helping to improve the organizational aspects of countering such attacks to protect enterprise personnel from them.
Keywords: personnel, enterprise, social engineering, information security, organizational measures.
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License
Organizational aspects of countering attacks based on social engineering
In this work, the organizational aspects of countering attacks based on social engineering (SE) have been improved to protect the company's personnel from it. It is shown that attacks based on SE are one of the most effective tools for cyber attacks against information systems and digital infrastructure of enterprises, using the psychological characteristics of people. It was emphasized that the human factor has now begun to play a much more significant role in ensuring information security than before. Statistical and literary data demonstrate that attacks based on SE are successful due to their ability to bypass traditional, mostly technical, defense systems. Based on the literature analysis, individual approaches and techniques underlying such attacks have been described. Taking into account the obtained data and literary sources, a simplified algorithm of actions of an attacker during an attack based on SE is proposed. It is emphasized that among the many measures used to ensure the information security of enterprises of any form of ownership, organizational measures occupy a special place, acting as the "core" of the overall information security system, linking legal and technical measures. It is indicated that such measures, first of all, should be aimed at regulating the functioning of security facilities and the activities of officials in order to ensure information security through the development of certain rules and requirements. It is noted that organizational measures should be the first "barrier" against attacks based on SE. Based on an understanding of the basic mechanisms of SE attacks, taking into account the results from individual studies, practical organizational measures are proposed to protect the company's personnel from it. The practical significance of the presented results lies in the fact that they can be useful to managers of enterprises of any form of ownership and information security specialists to counter SE attacks, helping to improve the organizational aspects of countering such attacks to protect enterprise personnel from them.
Keywords: personnel, enterprise, social engineering, information security, organizational measures.