Abstract

Social engineering attacks are a major threat to organizations and individuals as digitization and connectivity through the internet increase. This study aims to review scholarly research analyzing the topic of social engineering and further chart the evolution of the threat. The review identifies methods of such attacks on various platforms and devices and discusses motivations behind social engineering attacks. Finally, the paper analyzes the nature and impact of social engineering attacks and presents a taxonomy on socially engineered attacks by analyzing their anatomy.

References

• Orgill, G. L., Romney, G. W., Bailey, M. G. and Orgill, P. M. The urgency for effective user privacy-education to counter social engineering attacks on secure computer systems. ACM, 2004.
• Kumar, A., Chaudhary, M. and Kumar, N. Social engineering threats and awareness: a survey. European Journal of Advances in Engineering and Technology, 2, 11 (2015), 15-19.
• Albert, R., Jimenez, A., Keane, S., Mancini, S., Orr, M., Pantazopoulos, R., Reichert, A. and Wentzel, K. The Future of Ransomware and Social Engineering. U.S. Department of Homeland Security (2017).
• Ivaturi, K. and Janczewski, L. A taxonomy for social engineering attacks. Centre for Information Technology, Organizations, and People, 2011.
• Patel, K. K. and Reichardt, S. The Dark Side of Transnationalism Social Engineering and Nazism, 1930s–40s. Journal of Contemporary History, 51, 1 (2016), 3-21.
• Butavicius, M., Parsons, K., Pattinson, M. and McCormac, A. Breaching the human firewall: Social engineering in phishing and spear-phishing emails. arXiv preprint arXiv:1606.00887 (2016).
• Ablon, L. Data Thieves: The Motivations of Cyber Threat Actors and Their Use and Monetization of Stolen Data. RAND, 2018.
• Algarni, A., Xu, Y., Chan, T. and Tian, Y.-C. Social engineering in social networking sites: Affect-based model. IEEE, 2013.
• Kjaerland, M. A taxonomy and comparison of computer security incidents from the commercial and government sectors. Computers & Security, 25, 7 (2006), 522-538.
• Krombholz, K., Hobel, H., Huber, M. and Weippl, E. Advanced social engineering attacks. Journal of Information Security and Applications, 22 (2015), 113-122.
• Schoeman, A. and Irwin, B. Social recruiting: a next generation social engineering attack. Journal of Information Warfare, 11, 3 (2012), 17-24.
• Greitzer, F. L., Strozer, J. R., Cohen, S., Moore, A. P., Mundie, D. and Cowley, J. Analysis of unintentional insider threats deriving from social engineering exploits. IEEE, 2014.
• Conteh, N. Y. and Schmick, P. J. Cybersecurity: risks, vulnerabilities and countermeasures to prevent social engineering attacks. International Journal of Advanced Computer Research, 6, 23 (2016), 31.
• LeBlanc, J. and Messerschmidt, T. Identity and Data Security for Web Development: Best Practices. " O'Reilly Media, Inc.", 2016.
• Harry, C. and Gallagher, N. Classifying Cyber Events: A Proposed Taxonomy. Journal of Information Warfare, 17, 3 (2018), 17.
• Salahdine, F. and Kaabouch, N. Social Engineering Attacks: A Survey. Future Internet, 11, 4 (2019), 89.
• Koyun, A. and Al Janabi, E. Social engineering attacks. Journal of Multidisciplinary Engineering Science and Technology (JMEST) (2017).
• Gupta, S., Singhal, A. and Kapoor, A. A literature survey on social engineering attacks: Phishing attack. IEEE, 2016.
• Patil, P. and Devale, P. A literature survey of phishing attack technique. Int. J. Adv. Res. Comput. Commun. Eng, 5 (2016), 198-200.
• Ikhalia, E. J. A new social media security model (SMSM). International Journal of Emerging Technology and Advanced Engineering Website: www. ijetae. com (ISSN 2250-2459, ISO 9001: 2008 Certified Journal, Volume 3, Issue 7 (2013).
• Arachchilage, N. A. G. and Love, S. Security awareness of computer users: A phishing threat avoidance perspective. Computers in Human Behavior, 38 (2014).
• Wilcox, H., Bhattacharya, M. and Islam, R. Social engineering through social media: an investigation on enterprise security. Springer, 2014.
• Narendra, K. and Sreedevi, E. Social Engineering and Defense against Social Engineering (2018).
• Krombholz, K., Hobel, H., Huber, M. and Weippl, E. Social engineering attacks on the knowledge worker. ACM, 2013.
• Chitrey, A., Singh, D. and Singh, V. A comprehensive study of social engineering based attacks in india to develop a conceptual model. International Journal of Information and Network Security, 1, 2 (2012), 45.
• Wilcox, H. and Bhattacharya, M. A framework to mitigate social engineering through social media within the enterprise. IEEE, 2016.
• Mohebzada, J. G., El Zarka, A., BHojani, A. H. and Darwish, A. Phishing in a university community: Two large scale phishing experiments. IEEE, 2012.
• Hadnagy, C. Unmasking the social engineer: The human element of security. John Wiley & Sons, 2014.
• Airehrour, D., Vasudevan Nair, N. and Madanian, S. Social Engineering Attacks and Countermeasures in the New Zealand Banking System: Advancing a User-Reflective Mitigation Model. Information, 9, 5 (2018).
• Gupta, B. B., Arachchilage, N. A. and Psannis, K. E. Defending against phishing attacks: taxonomy of methods, current issues and future directions. Telecommunication Systems, 67, 2 (2018), 247-267.
• Chen, S. Trust Management for a Smart Card Based Private eID Manager. NTNU, 2016.
• Van Heerden, R., Irwin, B., Burke, I. D. and Leenen, L. A computer network attack taxonomy and ontology. International Journal of Cyber Warfare and Terrorism (IJCWT), 2, 3 (2012), 12-25.
• Nath, H. V. and Mehtre, B. M. Static malware analysis using machine learning methods. Springer, 2014.
• Stringhini, G., Kruegel, C. and Vigna, G. Shady paths: Leveraging surfing crowds to detect malicious web pages. ACM, 2013.
• Grégio, A. R. A., Afonso, V. M., Filho, D. S. F., Geus, P. L. d. and Jino, M. Toward a taxonomy of malware behaviors. The Computer Journal, 58, 10 (2015).
• Laribee, L. Development of methodical social engineering taxonomy project. Naval Postgraduate School Monterey CA, 2006.
• Heartfield, R. and Loukas, G. A taxonomy of attacks and a survey of defence mechanisms for semantic social engineering attacks. ACM Computing Surveys (CSUR), 48, 3 (2016), 37.
• Jang-Jaccard, J. and Nepal, S. A survey of emerging threats in cybersecurity. Journal of Computer and System Sciences, 80, 5 (2014), 973-993.
• Mancuso, V. F., Strang, A. J., Funke, G. J. and Finomore, V. S. Human factors of cyber attacks: a framework for human-centered research. SAGE Publications Sage CA: Los Angeles, CA, 2014.
• Foozy, C. F. M., Ahmad, R., Abdollah, M. F., Yusof, R. and Mas’ud, M. Z. Generic taxonomy of social engineering attack and defence mechanism for handheld computer study, 2011.
• Caviglione, L., Coccoli, M. and Merlo, A. A taxonomy-based model of security and privacy in online social networks. IJCSE, 9, 4 (2014), 325-338.
• Klaper, D. and Hovy, E. A taxonomy and a knowledge portal for cybersecurity. ACM, 2014.
• He, D., Chan, S. and Guizani, M. Mobile application security: malware threats and defenses. IEEE Wireless Communications, 22, 1 (2015), 138-144.
• Pienta, D., Thatcher, J. B. and Johnston, A. C. A Taxonomy of Phishing: Attack Types Spanning Economic, Temporal, Breadth, and Target Boundaries, 2018.
• Rowe, N. A taxonomy of deception in cyberspace, 2006.
• Pawlick, J. A Systems Science Perspective on Deception for Cybersecurity in the Internet of Things. New York University Tandon School of Engineering, 2018.
• Patel, R. S. Kali Linux social engineering. Packt Publishing Ltd, 2013.
• Rjaibi, N. and Rabai, L. B. A. Developing a novel holistic taxonomy of security requirements. Procedia Computer Science, 62 (2015), 213-220.
• Hindy, H., Brosset, D., Bayne, E., Seeam, A., Tachtatzis, C., Atkinson, R. and Bellekens, X. A taxonomy and survey of intrusion detection system design techniques, network threats and datasets. (2018).
• Brar, H. S. and Kumar, G. Cybercrimes: A proposed taxonomy and challenges. Journal of Computer Networks and Communications, 2018 (2018).
• Cebula, J. J., Popeck, M. E. and Young, L. R. A taxonomy of operational cyber security risks version 2. Carnegie-Mellon Univ Pittsburgh Pa Software Engineering Inst, 2014.
• Chen, K., Zhang, S., Li, Z., Zhang, Y., Deng, Q., Ray, S. and Jin, Y. Internet-of-things security and vulnerabilities: taxonomy, challenges, and practice. Journal of Hardware and Systems Security, 2, 2 (2018), 97-110.
• Simmons, C., Ellis, C., Shiva, S., Dasgupta, D. and Wu, Q. AVOIDIT: A cyber attack taxonomy, 2014.
• Yeboah-Boateng, E. O. and Amanor, P. M. Phishing, SMiShing & Vishing: an assessment of threats against mobile devices. Journal of Emerging Trends in Computing and Information Sciences, 5, 4 (2014), 297-307.
• Dunham, K. Mobile malware attacks and defense. Syngress, 2008.
• Bitton, R., Finkelshtein, A., Sidi, L., Puzis, R., Rokach, L. and Shabtai, A. Taxonomy of mobile users' security awareness. Computers & Security, 73 (2018), 266-293.
• Yoshizawa, H., Ishida, M. and Yoshitsuru, T. Development of and Future Prospects for Tablet Devices. Fujitsu Sci. Tech. J, 49, 2 (2013), 208-212.
• Aldawood, H. and Skinner, G. An academic review of current industrial and commercial cyber security social engineering solutions. In Proceedings of the Proceedings of the 3rd International Conference on Cryptography, Security and Privacy (Kuala Lumpur, Malaysia, 2019). ACM, 2019.
• Aldawood, H. and Skinner, G. Reviewing Cyber Security Social Engineering Training and Awareness Programs—Pitfalls and Ongoing Issues. Future Internet, 11, 3 (2019), 73.
• Aldawood, H. and Skinner, G. Contemporary Cyber Security Social Engineering Solutions, Measures, Policies, Tools and Applications: A Critical Appraisal. International Journal of Security (IJS), 10, 1 (2019), 1.
• Aldawood, H. and Skinner, G. Educating and Raising Awareness on Cyber Security Social Engineering: A Literature Review. Sydney, Australia, 2018.
• Aldawood, H. A. and Skinner, G. A Critical Appraisal of Contemporary Cyber Security Social Engineering Solutions: Measures, Policies, Tools and Applications. Sydney, Australia, 2018.