Comparing Security Risk-oriented Modelling Languages to Manage Social Engineering Risks
Name
Sarbar Tursunova
Abstract
Social engineering security risk management is emerging as a central technique for dealing with identification of occurring risks on the daily basis. Unfortunately, its standards might have limitations in support with security modelling languages and comprehension of users. This is a problem because lack of understanding can cause misinterpretation of analysis. Nowadays, same security events occur periodically, but they are not treated properly. It might be because ordinary users do not see vulnerabilities or their misunderstanding of ongoing process of risk treatment. Without knowing what is clear to ordinary users and what should be improved any social engineering analysis is irrelevant.
The paper applies structured approach in identification of one security risk management standard that can be applied with different modelling languages. For a more in-depth analysis in this paper considered several modelling languages as BPMN, Secure Tropos and Misuse case. Taking into account the main aspect of the study in social engineering is psychological manipulation of people, author considered as a good foundation of the illustration a book of Kevin Mitnick “The art of deception”. One case has been chosen for a further study and analysed using ISSRM domain model with application of aforementioned three security modelling languages.
To identify certain concepts or logic of ordinary users and taking into account their lack of knowledge in information technology this paper has been concentrated on weaknesses of modelling approaches for social engineering analysis. This led to the result that overall BPMN constructs and Secure Tropos concepts are preferred by users. Also based on collected results, we tried to make a parallel between understanding of concepts and constructs for participants. Percentage wise understanding of constructs showed higher results than concepts. Business asset, IS asset, threat, attack method, risk treatment, security requirement and control are easily identified in the form of constructs. Concepts are have received higher score in following aspects: Business Asset, Security criterion, Impact, Event, Vulnerability, Threat, Threat agent, Security requirement.
Graduation Thesis language
English
Graduation Thesis type
Master - Cyber Security
Supervisor(s)
Raimundas Matulevičius
Defence year
2015