Social Engineering: The Human Factor in Information Assurance
Harold F. Tipton, Micki Krause · 2007
In the world of information technology (IT), four years is akin to an eternity. To say that there have been changes in the last four years would be an understatement. Looking back at the previous chapter a colleague and I wrote on the topic of social engineering (SE) back in 2002, there have been few changes in some regards and many changes in others, not all for the good. In 2006, SE is still a topic for discussion and efforts continue to come to terms with the risks that it poses. There has been no satisfying answer reached on how to mitigate the risk, no meaningful or valid statistics related specifically to SE exist, and most organizations have opted for the ostrich approach-burying their heads in the sand and hoping it will all go away. Sadly, this is the same landscape that existed in 2002 and prompted the original chapter on this topic. One thing that has changed, however, is the fact that attacks using SE have skyrocketed (e.g., identity theft, phishing). This chapter is a call to arms, of sorts. If proactive steps in dealing with SE are not taken (and not just throwing more technology at the problem), its impact will become even greater than it is today.