The persuasion and security awareness experiment: reducing the success of social engineering attacks

Research output: Contribution to journalArticleAcademicpeer-review

31 Citations (Scopus)

Abstract

Objectives: The aim of the current study is to explore to what extent an intervention reduces the effects of social engineering (e.g. the obtaining of access by persuasion) in an office environment. In particular, we study the effect of authority during a `social engineering' attack. Methods: 31 different `offenders' visited the offices of 118 employees and on the basis of a script, asked them to hand over their office keys. Authority, one of the six principles of persuasion, was used by half of the offenders to persuade a target to comply with his/her request. Prior to the visit, an intervention was randomly administered to half of the targets to increase their resilience against attempts by others to obtain their credentials. Results: 37.0% of the employees who were exposed to the intervention surrendered their keys whilst 62.5% of those who were not exposed to it handed it over. The intervention has a significant effect on compliance but the same was not the case for authority. Conclusions: Awareness-raising about the dangers, characteristics and countermeasures associated with social engineering proved to have a significant positive effect on neutralizing the attacker.
Original languageUndefined
Pages (from-to)97-115
Number of pages19
JournalJournal of experimental criminology
Volume11
Issue number1
DOIs
Publication statusPublished - Mar 2015

Keywords

  • EWI-25579
  • SCS-Cybersecurity
  • Persuasion
  • Social Engineering
  • EC Grant Agreement nr.: FP7/2007-2013
  • EC Grant Agreement nr.: FP7/318003
  • Experiment
  • Intervention
  • Credentials
  • METIS-310417
  • IR-94231
  • Awareness
  • Authority

Cite this