Mouton, FrancoisLeenen, LouiseVenter, HS2017-06-072017-06-072016-06Mouton, F., Leenen, L. and Venter, H.S. 2016. Social engineering attack examples, templates and scenarios. Computers & Security, vol. 59: 186-209. https://doi.org/10.1016/j.cose.2016.03.0040167-4048http://www.sciencedirect.com/science/article/pii/S0167404816300268https://doi.org/10.1016/j.cose.2016.03.004http://hdl.handle.net/10204/9185Copyright: 2016 Elsevier. Due to copyright restrictions, the attached PDF file contains the pre-print version of the article. For access to the published version, please consult the publisher's website.The field of information security is a fast-growing discipline. Even though the effectiveness of security measures to protect sensitive information is increasing, people remain susceptible to manipulation and thus the human element remains a weak link. A social engineering attack targets this weakness by using various manipulation techniques to elicit sensitive information. The field of social engineering is still in its early stages with regard to formal definitions, attack frameworks and templates of attacks. This paper proposes detailed social engineering attack templates that are derived from real-world social engineering examples. Current documented examples of social engineering attacks do not include all the attack steps and phases. The proposed social engineering attack templates attempt to alleviate the problem of limited documented literature on social engineering attacks by mapping the real-world examples to the social engineering attack framework. Mapping several similar real-world examples to the social engineering attack framework allows one to establish a detailed flow of the attack whilst abstracting subjects and objects. This mapping is then utilised to propose the generalised social engineering attack templates that are representative of real-world examples, whilst still being general enough to encompass several different real-world examples. The proposed social engineering attack templates cover all three types of communication, namely bidirectional communication, unidirectional communication and indirect communication. In order to perform comparative studies of different social engineering models, processes and frameworks, it is necessary to have a formalised set of social engineering attack scenarios that are fully detailed in every phase and step of the process. The social engineering attack templates are converted to social engineering attack scenarios by populating the template with both subjects and objects from real-world examples whilst still maintaining the detailed flow of the attack as provided in the template. Furthermore, this paper illustrates how the social engineering attack scenarios are applied to verify a social engineering attack detection model. These templates and scenarios can be used by other researchers to either expand on, use for comparative measures, create additional examples or evaluate models for completeness. Additionally, the proposed social engineering attack templates can also be used to develop social engineering awareness material.enBidirectional communicationIndirect communicationMitnick's attack cycleSocial engineeringSocial engineering attack detection modelSocial engineering attack examplesSocial engineering attack frameworkSocial engineering attack scenarioSocial engineering attack templatesUnidirectional communicationArticleMouton, F., Leenen, L., & Venter, H. (2016). Social engineering attack examples, templates and scenarios. http://hdl.handle.net/10204/9185Mouton, Francois, Louise Leenen, and HS Venter "Social engineering attack examples, templates and scenarios." (2016) http://hdl.handle.net/10204/9185Mouton F, Leenen L, Venter H. Social engineering attack examples, templates and scenarios. 2016; http://hdl.handle.net/10204/9185.TY - Article AU - Mouton, Francois AU - Leenen, Louise AU - Venter, HS AB - The field of information security is a fast-growing discipline. Even though the effectiveness of security measures to protect sensitive information is increasing, people remain susceptible to manipulation and thus the human element remains a weak link. A social engineering attack targets this weakness by using various manipulation techniques to elicit sensitive information. The field of social engineering is still in its early stages with regard to formal definitions, attack frameworks and templates of attacks. This paper proposes detailed social engineering attack templates that are derived from real-world social engineering examples. Current documented examples of social engineering attacks do not include all the attack steps and phases. The proposed social engineering attack templates attempt to alleviate the problem of limited documented literature on social engineering attacks by mapping the real-world examples to the social engineering attack framework. Mapping several similar real-world examples to the social engineering attack framework allows one to establish a detailed flow of the attack whilst abstracting subjects and objects. This mapping is then utilised to propose the generalised social engineering attack templates that are representative of real-world examples, whilst still being general enough to encompass several different real-world examples. The proposed social engineering attack templates cover all three types of communication, namely bidirectional communication, unidirectional communication and indirect communication. In order to perform comparative studies of different social engineering models, processes and frameworks, it is necessary to have a formalised set of social engineering attack scenarios that are fully detailed in every phase and step of the process. The social engineering attack templates are converted to social engineering attack scenarios by populating the template with both subjects and objects from real-world examples whilst still maintaining the detailed flow of the attack as provided in the template. Furthermore, this paper illustrates how the social engineering attack scenarios are applied to verify a social engineering attack detection model. These templates and scenarios can be used by other researchers to either expand on, use for comparative measures, create additional examples or evaluate models for completeness. Additionally, the proposed social engineering attack templates can also be used to develop social engineering awareness material. DA - 2016-06 DB - ResearchSpace DP - CSIR KW - Bidirectional communication KW - Indirect communication KW - Mitnick's attack cycle KW - Social engineering KW - Social engineering attack detection model KW - Social engineering attack examples KW - Social engineering attack framework KW - Social engineering attack scenario KW - Social engineering attack templates KW - Unidirectional communication LK - https://researchspace.csir.co.za PY - 2016 SM - 0167-4048 T1 - Social engineering attack examples, templates and scenarios TI - Social engineering attack examples, templates and scenarios UR - http://hdl.handle.net/10204/9185 ER -