A Framework for Evaluating and Patching the Human Factor in Cybersecurity

No ratings

Presented at BlackHat USA 2020 by

Ron Bitton

Social engineering (SE) attacks have dramatically changed in recent years: They are no longer limited to PCs and they goes way beyond phishing. Despite those changes, current methods for evaluating the resilience of users to SE attacks are still mainly focus on phishing attacks and do not distinguish between different platforms.Furthermore, current methods depend, to a large extent, on the subjects’ response to surveys, which tend to be subjective, biased and require the subjects’ active involvement and collaboration; thereby are less accurate and consuming significant human resources. Other solutions are based on measuring the momentary behaviour of subjects while facing a simulated phishing attack. These methods however, tend to be sensitive to environmental factors and cannot be used for evaluating users’ behaviour continuously.We present a methodology and an automated, scalable and objective framework for continuously evaluating the resilience of users to specific types of social engineering attacks. The methodology includes a set of measurable criteria for a security aware user; and an expert-based procedure for deriving security awareness models for different attacks classes (each class is an aggregation of SE attacks that exploit a similar set of human vulnerabilities). The framework utilizes data collected and analyzed from different data sources to measure the set of criteria:Android agent, which measures the users' actual behaviourwhile operating with their smartphones.Chrome extension, which measures the users' actual behaviourwhile operating with their PCsNetwork traffic monitor, which analyzes the network traffic transmitted-to/received-from the devices.Attack simulator, which implement multiple type of SE attacks on the users.In order to evaluate the proposed framework, we conducted an empirical experiment involving 162 users for a duration of seven to eight weeks. The results show that (1) the skills required from a user to mitigate an attack are different for different attack classes; (2) the self-reported behaviour of users differs significantly from their actual behaviour and (3) the security awareness level derived from the actual behaviour of users is highly correlated with their ability to mitigate SE attacks.