Social engineering in information assurance curricula

ABSTRACT

With the increasing use of security technology, technical attacks should become more difficult leading attackers to employ social engineering as a means to obtaining unauthorized access to information. Therefore, social engineering is a potentially dangerous threat to information security. Fortunately, a number of countermeasures have been proposed to defend against it. These countermeasures include implementing policy, providing end-user and key personnel education, and performing security audits. However, most current prominent information assurance curricula do not directly address social engineering and only indirectly address the countermeasures. Amending these curricula to include social engineering as a topic may help students be better prepared for encountering social engineering threats.

REFERENCES

• 1: Anti-Phishing Working Group. Phishing attack trends report january, 2004. http://www.antiphishing.org/reports/APWG.Phishing.Attack.Report.Jan2004.pdf, 2004.
• 2: Anti-Phishing Working Group. Phishing attack trends report december, 2005. http://www.antiphishing.org/reports/apwg_report_DEC2005_FINAL.pdf, 2005.
• 3: CERT. The CERT®survivability and information assurance curriculum. http://www.cert.org/sia/, 2005.
• 4: CNSS. Instructions. http://www.cnss.gov/instructions.html, 1994-2006.
• 5: CSSIA. Center for systems security and information awarenes curriculum overview. http://www.cssia.org/CUR_Intro.cfm, 2006.
• 6: L. A. Gordan, M. P. Loeb, W. Lucyshyn, and R. Richardson. 2005 CSI/FBI computer crime and security survey. http://www.gocsi.com/forms/fbi/csi_fbi_survey.jhtml, 2005.
• 7: D. Gragg. A multi-level defense against social engineering. White paper, SANS Institute, 2003.
• 8: A. J. Herbert. Information battleground. Air Force Magazine, 88(12), December 2005 2005.
• 9: (ISC)². Certified information systems security profiessional (cissp) candidate information bulletin. https://www.isc2.org/cgi-bin/request_studyguide. cgi?displaycategory=694, 2006.
• 10: C. E. Lively Jr. Psychological based social engineering. http://www.giac.org/certified_professionals/practicals/gsec/3547.php, 2003.
• 11: Kevin D. Mitnick , William L. Simon, The Art of Intrusion: The Real Stories Behind the Exploits of Hackers, Intruders & Deceivers, John Wiley & Sons, Inc., New York, NY, 2005
• 12: NIATEC. Information assurance teaching materials. http://niatec.info/teachmatl.htm, 2006.
• 13: Bruce Schneier, Beyond Fear: Thinking Sensibly about Security in an Uncertain World, Springer-Verlag New York, Inc., Secaucus, NJ, 2003
• 14: Tim Thornburgh, Social engineering: the "Dark Art", Proceedings of the 1st annual conference on Information security curriculum development, October 08-08, 2004, Kennesaw, Georgia [doi>10.1145/1059524.1059554]
• 15: M. E. Whitman and H. J. Mattord. A model curriculum for programs of study in information security and assurance v. 3.0. http://infosec.kennesaw.edu/presentations/InfoSecCurriculumModel.pdf, 2005.
• 16: I. S. Winkler and B. Dealy. Information security technology? dont rely on it: A case study in social engineering. In Fifth USENIX UNIX Security Symposium, Salt Lake City, UT, 1995.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.3 COMPUTERS AND EDUCATION
      K.3.2 Computer and Information Science Education
          Subjects: Curriculum

Additional Classification:
  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.2 User/Machine Systems
          Subjects: Human factors

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Human Factors

Keywords:
information security curriculum, social engineering