Towards Securing Organizational Data against Social Engineering Attacks

The study was carried out mainly to investigate how data of organizations can be secured against Social Engineering (phishing) attack using a model. The phenomenon of social engineering is emerging as a major security threat to organizations’ information systems accounting for about thirty (30) percent of all security breaches globally with its attendant negative impact. It exploits the vulnerabilities inherent in users of information systems using psycho-social skills to influence them to divulge confidential information that is usually used later to gain access to a targeted technology system. Thus to secure data against social engineering attacks, the defense should be modeled around the user who is often considered as the weakest link in the information security chain. The paper used the Design Research method by proposing a model which was translated into web application system that identified vulnerable users to Socially Engineered attack by using their responses to a scam emails administered to them in phases. Purposive sampling was used to select customers of the community Bank where the study exercise (Simulated Phishing Attack) was conducted and evaluation of the efficiency of the model was carried out. Data was collected using log files and was analyzed using simple descriptive statistics and the results presented using frequency tables, bar charts and pie charts. The result showed that, users are highly vulnerable to social engineering attacks, and this vulnerability can be reduced by adopting the CEMASEA training model since it can build the resistance of users or reduces vulnerability by 69.05%. It was recommended that, for organizations to build social engineering resistance or immunity in particular and a sound security culture in general, Ethical Penetration Testing or Red Team Assessment should be adopted by all organizations periodically using a novel CLEMASEA model. GENERAL TERMS Information Systems Security, Social Engineering, Confidentiality, Integrity, Availability