Information security technology?...don't rely on it: a case study in social engineering

Authors:
Ira S. Winkler;Brian Dealy
Affiliations:
Science Applications International Corporation, Annapolis, Maryland;Science Applications International Corporation, Annapolis, Maryland
Venue:
SSYM'95 Proceedings of the 5th conference on USENIX UNIX Security Symposium - Volume 5
Year:
1995

Citing 1
Cited 7

Masters of Deception

Masters of Deception

A Quantitative Model of the Security Intrusion Process Based on Attacker Behavior

IEEE Transactions on Software Engineering
Computer Immunology

LISA '98 Proceedings of the 12th USENIX conference on System administration
Theoretical System Administration

LISA '00 Proceedings of the 14th USENIX conference on System administration
Social engineering in information assurance curricula

InfoSecCD '06 Proceedings of the 3rd annual conference on Information security curriculum development
Heat-ray: combating identity snowball attacks using machinelearning, combinatorial optimization and attack graphs

Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles
The use of formal social engineering techniques to identify weaknesses during a computer vulnerability competition

Journal of Computing Sciences in Colleges
Whispers in the hyper-space: high-speed covert channel attacks in the cloud

Security'12 Proceedings of the 21st USENIX conference on Security symposium

Quantified Score

Hi-index	0.00

Visualization

Abstract

Many companies spend hundreds of thousands of dollars to ensure corporate computer security. The security protects company secrets, assists in compliance with federal laws, and enforces privacy of company clients. Unfortunately, even the best security mechanisms can be bypassed through Social Engineering. Social Engineering uses very low cost and low technology means to overcome impediments posed by information security measures. This paper details a Social Engineering attack performed against a company with their permission. The attack yielded sensitive company information and numerous user passwords, from many areas within the company, giving the attackers the ability to cripple the company despite extremely good technical information security measures. The results would have been similar with almost any other company. The paper concludes with recommendations for minimizing the Social Engineering threat.