Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    9 Citations (Scopus)
    273 Downloads (Pure)

    Abstract

    The objective of this study is to get insight into the effectiveness of an information campaign to counter a social engineering attack via the telephone. Four different offenders phoned 48 employees and made them believe that their PC was distributing spam emails. Targets were told that this unfortunate situation could be solved by downloading and executing software from a website (i.e. an untrusted one). A total of 46.15 % of the employees not exposed to the intervention followed the instructions of the offender. This was significantly different to those exposed to an intervention 1 week prior to the attack (9.1%); however there was no effect for those exposed to an intervention 2 weeks prior to the attack (54.6%). This research suggests that scam awareness-raising campaigns reduce vulnerability only in the short term.
    Original languageUndefined
    Title of host publicationProceedings of the inaugural Singapore Cyber Security R&D Conference (SG-CRC 2016)
    EditorsA. Mathur, A. Roychoudhury
    Place of PublicationAmsterdam
    PublisherIOS Press
    Pages107-114
    Number of pages6
    ISBN (Print)978-1-61499-616-3
    DOIs
    Publication statusPublished - Jan 2016

    Publication series

    NameCryptology and Information Security Series
    PublisherIOS Press
    Volume14
    ISSN (Print)1871-6431

    Keywords

    • SCS-Cybersecurity
    • EC Grant Agreement nr.: FP7/2007-2013
    • EC Grant Agreement nr.: FP7/318003
    • Retention
    • Scam
    • Training
    • IR-98314
    • Social Engineering
    • Time
    • EWI-26500
    • Awareness
    • Decay
    • METIS-315056
    • Telephone

    Cite this