Jan-Willem Bullee

Argumentation-based security requirements elicitation: the next round

Information Security Risk Assessment can be viewed as part of requirements engineering because it is used to translate security goals into security requirements, where security requirements are the desired system properties that mitigate threats to security goals. To improve the defensibility of these mitigations, several researchers have attempted to base risk assessment on argumentation structures. However, none of these approaches have so far been scalable or usable in real-world risk assessments. In this paper, we present the results from our search for a scalable argumentation-based information security RA method. We start from previous work on both formal argumentation frameworks and informal argument structuring and try to find a promising middle ground. An initial prototype using spreadsheets is validated and iteratively improved via several Case Studies. Challenges such as scalability, quantify-ability, ease of use, and relation to existing work in parallel fields are discussed. Finally, we explore the scope and applicability of our approach with regard to various classes of Information Systems while also drawing more general conclusions on the role of argumentation in security.

Telephone-based social engineering attacks: An experiment testing the success and time decay of an intervention

The objective of this study is to get insight into the effectiveness of an information campaign to counter a social engineering attack via the telephone. Four different offenders phoned 48 employees and made them believe that their PC was distributing spam emails. Targets were told that this unfortunate situation could be solved by downloading and executing software from a website (i.e. an untrusted one). A total of 46.15 % of the employees not exposed to the intervention followed the instructions of the offender. This was significantly different to those exposed to an intervention 1 week prior to the attack (9.1%); however there was no effect for those exposed to an intervention 2 weeks prior to the attack (54.6%). This research suggests that scam awareness-raising campaigns reduce vulnerability only in the short term.

Tangible modelling to elicit domain knowledge: an experiment and focus group

Conceptual models represent social and technical aspects of the world relevant to a variety of technical and non-technical stakehold- ers. To build these models, knowledge might have to be collected from domain experts who are rarely modelling experts and don’t usually have the time or desire to learn a modelling language. We investigate an app- roach to overcome this challenge by using physical tokens to represent the conceptual model. We call the resulting models tangible models. We illustrate this idea by creating a tangible representation of a socio- technical modelling language and provide initial evidence of the relative usability and utility of tangible versus abstract modelling. We discuss psychological and social theories that could explain these observations and discuss generalizability and scalability of the approach.

Spear phishing in organisations explained

Purpose The purpose of this study is to explore how the opening phrase of a phishing email influences the action taken by the recipient. Design/methodology/approach Two types of phishing emails were sent to 593 employees, who were asked to provide personally identifiable information (PII). A personalised spear phishing email opening was randomly used in half of the emails. Findings Nineteen per cent of the employees provided their PII in a general phishing email, compared to 29 per cent in the spear phishing condition. Employees having a high power distance cultural background were more likely to provide their PII, compared to those with a low one. There was no effect of age on providing the PII requested when the recipient’s years of service within the organisation is taken into account. Practical implications This research shows that success is higher when the opening sentence of a phishing email is personalised. The resulting model explains victimisation by phishing emails well, and it would allow practitioners to focus awareness campaigns to maximise their effect. Originality/value The innovative aspect relates to explaining spear phishing using four socio-demographic variables.

Experimental social engineering : investigation and prevention

Social engineering is the usage of social manipulation and psychological tricks to make the targets assist offenders in their attack. This practice manifests itself in e.g. phishing emails or cold call telephone scams. The aim of the thesis was to investigate the understanding of social engineering attacks in an organisational setting. In particular, the effectiveness both of the threat and the countermeasures was investigated. Tree kinds of social engineering experiments were performed, each using a different modality (i.e. Face-to-Face (F2F), email and telephone). In each experiment, the targets (i.e. participants) were persuaded to perform actions that contribute to their victimisation. The subjects (N = 162) in the F2F experiment were visited by an offender in their offices and asked them to hand over their office keys. The subjects (N = 593) in the email experiment received a phishing email with the request to provide Personally Identifiable Information (PII). The subjects (N = 92) in the telephone experiment were persuaded to download and execute software from an untrustworthy website. A portion of the participants in both the F2F and telephone experiment received an intervention to reduce victimisation. The result was that 58.62% of those in the F2F experiment complied with the offender, compared to 36.96% who were priorly informed on how to detect and react to social engineering. In the telephone experiment, 40% complied with the offender, compared to 17.2% who received an intervention. Furthermore, 19.3% of those who received a generic phishing email complied, compared to 28.9% that received a spear phishing email. There was no effect of age, sex and using authority on victimisation found, whereas having had an intervention, receiving a spear phishing email and cultural background did have an effect. It is concluded that awareness raising about dangers, characteristics and countermeasures related to social engineering proved to have a significant positive effect on protecting the target. The research also shows that awareness-raising campaigns reduce the vulnerability only in the short term. In phishing emails, the use of a personalised opening sentence increases its success. The results of these experiments allow practitioners to focus awareness campaigns to maximise their effectiveness.

Regression Nodes: Extending Attack Trees with Data from Social Sciences

In the field of security, attack trees are often used to assess security vulnerabilities probabilistically in relation to multi-step attacks. The nodes are usually connected via AND-gates, where all children must be executed, or via OR-gates, where only one action is necessary for the attack step to succeed. This logic, however, is not suitable for including human interaction such as that of social engineering, because the attacker may combine different persuasion principles to different degrees, with different associated success probabilities. Experimental results in this domain are typically represented by regression equations rather than logical gates. This paper therefore proposes an extension to attack trees involving a regression-node, illustrated by data obtained from a social engineering experiment. By allowing the annotation of leaf nodes with experimental data from social science, the regression-node enables the development of integrated socio-technical security models.