The Defense and Popularity of Social Engineering in Norway

ENGLISH: Social Engineers attack the weakest link in an organization’s barrier - it’s human users. They do this by manipulating the users into performing actions they wouldn’t normally perform. This can have devastating consequences for an organization. The goal may be to get unauthorized access to sensitive information, or gain access to restricted areas, like server rooms. While crackers use their technical skills to break into a computer system and retrieve a password, the Social Engineer use his social skills to make an individual reveal the password themselves. While there has been written books and papers on different attack vectors, and even some methods for defending against this threat, they are not considered scientific - they are in many cases the experience and views of one particular individual. The amount of scientific work on Social Engineering do not appear to be comprehensive. This Thesis has gathered the essence of what different authors has conveyed about Social Engineering attacks and defenses, as well as why it actually works. Further it has investigated how popular Social Engineering is in Norway, what vector of attacks are most common and effective, as well as what defense mechanisms one should implement to stand strong against these threats. This has primarily been done by the development of a Questionnaire targeting Norwegian Organizations, a review of existing literature and research, as well as some preliminary interviews with Information Security Professionals. The results suggest that: (i) Social Engineering by E-Mail is by far the most heavily used vector of attack, followed by attacks originating from websites (ii) most Organizations have mechanisms to defend against Social Engineering, (iii) Organizations conceived Security Risk of Social Engineering is leaning towards medium-high and (iv) the ultimate economic consequences due to Social Engineering attacks are loss of millions of NOK. Further, not surprising, the review of earlier literature and research, as well as data gathered from our Questionnaire, suggest that Security Awareness is a very important factor for defending against Social Engineering. We end the Thesis by discussing important steps when developing Security Awareness programs