The Impact of Social Engineering Attacks on Competent Students in Information Management

[[abstract]]目前處於資訊爆炸的時代，許多資訊安全議題廣泛的為人們所討論、研究。今日，不管是企業、政府或是個人與組織都盡可能引進許多軟硬體來使得內外部資訊流通、交換更為安全。在今日，稍微有程度的駭客具有強大的軟體技巧與硬體設施，另外也更具備了社交工程攻擊方面的手段如心理戰術、言語誘惑、偽造身分與種種人性弱點來向使用者發動社交工程攻擊並取得所需的資料與資訊(Abraham & Chengalur-Smith 2010)，造成不管是個人、企業組織與政府部門等等損失慘重。 本研究主要探討社交工程攻擊中的一項手段，此類型攻擊是利用電子郵件或偽造假網站詐騙機密資訊與個人資料，本研究探討對象是具有資訊背景與資訊素養的網路使用者，因此，本研究將以高雄第一科技大學資訊管理系大學部二、三、四年級為實驗對象。本研究實驗方式是利用偽造他人的電子郵件寄信給有資訊背景與素養的學生，請學生們在填寫完研究問卷後附上自己的基本資料以便抽獎活動進行，並在電子郵件中加入社交工程的警語觀察這些學生是否會被騙取個人資料，茲發現以下結論： 一、 在電子郵件內加入對社交工程的警告標語對社交工程的攻擊行為無顯著性 的抵禦效果。 二、 一般來說資訊素養會隨著在學年級增加而遞增，因此年級越高之學生更 能夠有效辨別社交工程的攻擊而不向攻擊者提供個人資料、資訊。 三、 若已經有被社交工程所詐騙的經驗，則會更注意電子郵件內的警告內容， 且再次受騙的機率將低於一半以上。 最後本文加以探討、分析如何能夠避免社交工程在電子郵件中的攻擊行為。[[abstract]]In the age of information explosion information security has been an issue to every information systems’ users Generally organizations would employ anti-attack software in defending hostile attacks by unknown hackers However hackers are not only capable of in coding techniques for hostile software but have social skills such as oral communication lure counterfeit identity greed and punishment avoidance to defraud or to phish users' personal and confidential information This study focus on one of social engineering techniques termed phishing in which well-developed email-based or Web-based scenarios are used to defraud users of confidential information In this study an e-mail with social engineering warning signs attached is distributed unexpectedly to students with information majors who are supposed to be capable of dealing with the issue of information security to see whether they would be defrauded Thus the experiment units are students rolled in the department of information management in a university In this study the experimental students were asked to fill out the personal information in the questionnaires attached with the cautions headline in the email After the collection of replying emails we have found the followings: 1 Initially emails with warning signs do not significantly prevent social engineering attack to target students who are information majors 2 It is assumed that senior student (junior and senior students) should have more information literacy than junior experimenters (freshmen and sophomore) do In this experiment the assumption is confirmed Senior students could effectively identify social engineering attacks and provide no personal information 3 The students who have been defrauded by social engineering before would have fewer chance (less than 50%)to be defrauded again by similar social engineering attacks Finally how to avoid and prevent social engineering attacks in emails has been explored and analyzed Alternatives of avoiding being attacks by social engineering are also suggeste