Sociala manipulatörer besitter förmågan att använda social interaktion som medel för att övertyga en individ eller organisation till samtycke för en specifik förfrågan. Syftet är att uppnå ett mål i form av exempelvis ekonomisk vinning, obehörig åtkomst eller serviceavbrott. En social manipuleringsattack föranleds utav bakomliggande processer och innefattar en datorrelaterad enhet för antingen den sociala interaktionen, för övertalningen till samtycke eller för manipulatörens förfrågan. Syftet med arbetet var att kartlägga säkerhetsåtgärder mot sociala manipuleringsattacker och på så vis ge uttryck för en utveckling av området över tid. Resultatet förväntades med andra ord att ge uttryck för en mognad inom området och bidra med ökade insikter i hur attacker på ett tidstroget vis kan tacklas inom administrativ- och teknisk säkerhet. En kartläggande granskning genomfördes utifrån ett urval utifrån de tre databaserna; IEEE Xplore Digital Library, Springer Link och DBLP Computer Science Bibliography. Studier primär- och sekundärkategoriserades utifrån en kodningsprocess i syfte att understödja en narrativ analys. Fyra primärkategorier utav säkerhetsåtgärder uppstod; modellering, sårbarhetsbedömning, datasystem och (in)direkt utbildning. Sökstrategi och bedömningsprocess gav en inkluderad datamängd av totalt 28 studier. Säkerhetsåtgärder mot social manipulering från 2008 representerades av fem studier; en föreslog modellering, tre föreslog datasystem och en föreslog (in)direkt utbildning. Säkerhetsåtgärder från 2018 representerades av 23 studier; fyra föreslog modellering, två föreslog sårbarhetsbedömning; nio föreslog datasystem och åtta föreslog (in)direkt utbildning. Kodningsprocessen gav även upphov till sekundära kategorier – samtliga kategorier återgavs en dynamisk återspegling utav säkerhetsåtgärder mot social manipulering 2008 kontra 2018. Fyra av fem studier från 2008 definierade social manipulering med avsaknad av teoretiska förklaringar till bakomliggande processer för en attack – respektive 13 av 23 studier från 2018. Analysen mynnade ut i insikter om att framtida forskning behöver eftersträva ett holistiskt synsätt för de bakomliggande processer som föranleder en social manipuleringsattack – på så vis kan en ökad säkerhetsmedvetenhet och motståndskraft mot social manipulering uppnås. / Social engineers possess the ability to use social interaction as a means of convincing an individual or organization to consent to a specific request. The purpose is to achieve a goal in the form of, for example, financial gain, unauthorized access or service interruption. A social engineering attack is caused by underlying processes and includes a computer-related device for either the social interaction, for the persuasion to consent or for the social engineer's request. The purpose of the thesis was to map security measures against social engineering attacks and thus express the development of the area over time. In other words, the result was expected to express a maturity in the area and contribute with increased insights into how attacks in a timely manner can be tackled in administrative and technical security. A survey was conducted based on a selection based on the three databases; IEEE Xplore Digital Library, Springer Link and DBLP Computer Science Bibliography. Studies were primary and secondary categorized based on a coding process in order to support a narrative analysis. Four primary categories of security measures occurred; modelling, vulnerability assessment, computer systems and (in)direct education. Search strategy and assessment process provided an included data set of a total of 28 studies. Security measures against social manipulation from 2008 were represented by five studies; one proposed modeling, three suggested computer systems and one suggested (in)direct education. Security measures from 2018 were represented by 23 studies; four proposed modeling, two suggested vulnerability assessment; nine proposed computer systems and eight suggested (in)direct education. The coding process also gave rise to secondary categories - all categories were given a dynamic reflection of security measures against social manipulation 2008 versus 2018. Four out of five studies from 2008 defined social manipulation with the absence of theoretical explanations for underlying processes for an attack - and 13 of 23 studies from 2018. The analysis resulted in insights that future research needs to strive for a holistic approach to the underlying processes that cause a social manipulation attack - in this way increased security awareness and resistance to social engineering can be achieved.

This study aimed to examine if there was a difference in how likely a victim is to click on a phishing email’s links based on the content of the email, the tone and language used and the structure of the code. This likelihood also includes the email’s ability to bypass spam filters.  Method: The method used to examine this was a simulated phishing attack. Six different phishing templates were created and sent out via the Gophish framework to target groups of students (from Halmstad University), from a randomized pool of 20.000 users. The phishing emails contained a link to a landing page (hosted via a virtual machine) which tracked user status. The templates were: Covid19 Pre-Attempt, Spotify Friendly CSS, Spotify Friendly Button, Spotify Aggressive CSS, Spotify Aggressive Button, Student Union. Results: Covid19 Pre-Attempt: 72.6% initial spam filter evasion, 45.8% spam filter evasion, 4% emails opened and 100% links clicked. Spotify Friendly CSS: 50% initial spam filter evasion, 38% spam filter evasion, 26.3% emails opened and 0% links clicked. Spotify Friendly Button: 59% initial spam filter evasion, 28.8% spam filter evasion, 5.8% emails opened and 0 %links clicked. Spotify Aggressive CSS: 50% initial spam filter evasion, 38% spam filter evasion, 10.5% emails opened, and 100% links clicked. Spotify Aggressive Button: 16% initial spam filter evasion, 25% spam filter evasion, 0% emails opened and 0% emails clicked. Student Union: 40% initial spam filter evasion, 75% spam filter evasion, 33.3% emails opened and 100% links clicked. Conclusion: Differently structured emails have different capabilities for bypassing spam filters and for deceiving users. Language and tone appears to affect phishing email efficacy; the results suggest that an aggressive and authoritative tone heightens a phishing email’s ability to deceive users, but seems to not affect its ability to bypass spam filters to a similar degree. Authenticity appears to affect email efficacy; the results showed a difference in deception efficacy if an email was structured like that of a genuine sender. Appealing to emotions such as stress and fear appears to increase the phishing email’s efficacy in deceiving a user. / Syftet med denna studie var att undersöka om det fanns en skillnad i hur troligt det är att ett offer klickar på länkarna till ett phishing-e-postmeddelande, baserat på innehållet i e-postmeddelandet, tonen och språket som används och kodens struktur. Denna sannolikhet inkluderar även e-postens förmåga att kringgå skräppostfilter. Metod: Metoden som användes var en simulerad phishing-attack. Sex olika phishing-mallar skapades och skickades ut via Gophish-ramverket till målgruppen bestående av studenter (från Halmstads universitet), från en slumpmässig pool med 20 000 användare. Phishing-e-postmeddelandena innehöll en länk till en målsida (hostad via en virtuell maskin) som spårade användarstatus. Mallarna var: Covid19 Pre-Attempt, Spotify Friendly CSS, Spotify Friendly Button, Spotify Aggressive CSS, Spotify Aggressive Button, Student Union. Resultat: Covid19 förförsök: 72,6% kringgick det primära spamfiltret, 45,8% kringgick det sekundära spamfiltret, 4% e-postmeddelanden öppnade och 100% länkar klickade Spotify Friendly CSS: 50% kringgick det primära spamfiltret, 38% kringgick det sekundära spamfiltret, 26,3% e-postmeddelanden öppnade och 0% länkar klickade. Spotify Friendly Button: 59% kringgick det primära spamfiltret, 28,8% kringgick det sekundära spamfiltret, 5.8% e-postmeddelanden öppnade och 0% länkar klickade. Spotify Aggressive CSS: 50% kringgick det primära spamfiltret, 38% kringgick det sekundära spamfiltret, 10,5% e-post öppnade och 100% länkar klickade. Spotify Aggressive Button: 16% kringgick det primära spamfiltret, 25% kringgick det sekundära spamfiltret, 0% e-postmeddelanden öppnade och 0% e-postmeddelanden klickade. Studentkåren: 40% kringgick det primära spamfiltret, 75% kringgick det sekundära spamfiltret, 33,3% e-postmeddelanden öppnade och 100% länkar klickade. Slutsats: Olika strukturerade e-postmeddelanden har olika funktioner för att kringgå skräppostfilter och för att lura användare. Språk och ton tycks påverka effektiviteten för epost-phishing. Resultaten tyder på att en aggressiv och auktoritär ton ökar phishing-epostmeddelandets förmåga att lura användare, men verkar inte påverka dess förmåga att kringgå skräppostfilter i motsvarande grad. Autenticitet verkar påverka e-postens effektivitet, då resultaten visade en skillnad i effektivitet om ett e-postmeddelande var strukturerat som en äkta avsändare. Att adressera känslor som stress och rädsla verkar öka phishing-e-postens effektivitet när det gäller att lura en användare.

Mängden phishing-mejl har ständigt ökat under de senaste åren, i synnerhet mot företag och organisationer. Syftet med denna studie är att undersöka hur små- och medelstora IT-mogna företag (SMF:er) i Sverige skyddar sig mot phishing-mejl, deras största utmaningar med detta, och hur de upplevt att deras utsatthet förändrats under de senaste åren. Genom denna undersökning har brister i hur SMF:erna skyddar sig identifierats och säkerhetsåtgärder som hanterar SMF:ernas utmaningar tagits fram. Data samlades in genom både litteraturstudie och semistrukturerade-intervjuer med sju respondenter från enskilda företag, där samtliga hade ansvar för någon del i informationssäkerhetsarbetet. Resultatet visar att verksamheterna skyddar sig främst genom att sprida information, medan enbart en minoritet av respondenterna utbildar sina anställda. Ingen av respondenterna hade någon policy som berör hantering av phishing, och användandet av grundläggande tekniska skydd är något som var en gemensam nämnare. Gällande utmaningar visar resultatet främst en svårighet i att upprätthålla medvetenheten bland de anställda, samt att identifiera vilka tekniska skyddslösningar som ska anpassas. Majoriteten av respondenterna upplever även en ökad utsatthet av phishing-mejl, vilket de flesta också tror kommer att öka i framtiden. Med den insamlade data från intervjuerna och befintlig litteratur har sedan en rekommendationslista med säkerhetsåtgärder tagits fram som bemöter de utmaningar som SMF:erna belyser. / The number of phishing emails has been constantly increasing in recent years, especially towards businesses and organizations. The purpose of this study is to investigate how small and medium-sized IT-mature enterprises (SMEs) in Sweden protect themselves against phishing emails, their biggest challenges regarding this, as well as how they perceive that their exposure to phishing emails has changed in recent years. Through this study, gaps in how SMEs protect themselves have been identified and as a result, a list of security measures that address the SMEs' challenges have been produced. Data was gathered by conducting a literature study in conjunction with semistructured interviews with seven respondents, all whom where from individual companies and had some responsibility for the information security work. The results show that all SMEs rely on information sharing as their primary method of protection against phishing emails, while only a small proportion invest in employee education. In addition, the SMEs use only basic technical security solutions and none of them have any dedicated policy for managing phishing. Regarding challenges, the results mainly show difficulties in maintaining awareness among employees and identifying which technical security solutions that should be adapted. Furthermore, most of the respondents perceive that the exposure to phishing emails has increased and believe it will continue doing so in the future. With the collected data from the interviews and the literature study, a list of recommended security measures has compiled which addresses the challenges highlighted by the SMEs.

Dagens samhälle har blivit alltmer digitaliserat och en följd av detta är att de digitala bedrägerierna har ökat. Digitala bedrägerier kan ta olika former, men i denna studie begränsades de till phishing och dess underkategorier: spear phishing, vishing och smishing. Dessa är varianter på digitala bedrägerier där syftet är att lura användaren att lämna ut känslig information digitalt. Problemet som denna studie behandlade var att det fanns en kunskapsbrist hos människor gällande digitala bedrägerier, eftersom många fortfarande blev lurade. Syftet med studien blev därmed att bidra med ökad kunskap om hur digitala bedrägerier kan upptäckas av de som blivit utsatta och vad man som individ bör vara uppmärksam på. I studien löd därför forskningsfrågan: På vilka sätt försöker individer hantera de digitala hot som finns på internet? Samt med dess följande underfrågor: Vad gör individer för att identifiera digitala bedrägerier? Hur bedömer individer trovärdigheten i digitala interaktioner? För att besvara forskningsfrågan användes forskningsstrategin kartläggning. Kartläggningen genomfördes i form av semistrukturerade intervjuer och data samlades in om hur deltagarna försökte identifiera digitala bedrägerier. Datan analyserades med hjälp av tematisk analys. Studiens resultat visade att trots begränsad formell utbildning inom ämnet, verkade de flesta ha utvecklat liknande strategier för att upptäcka digitala bedrägerier. Många var dock osäkra om vilket skydd de hade mot dessa hot. Resultatet pekade på ett behov av mer information om digitala bedrägerier, särskilt för äldre. Studiens slutsatser framhåller behovet av att åtgärda den identifierade kunskapsluckan och understryker vikten av att individer är vaksamma och kritiska när det kommer till digitala interaktioner. Framtida åtgärder bör inriktas på att höja medvetenheten om digitala bedrägerier, utbilda individer om säkra metoder för digitala interaktioner och särskilt stödja dem som kan vara mer utsatta för dessa hot. Slutligen betonar studien vikten av att företag, myndigheter och organisationer tar ansvar för att hålla sig uppdaterade och ge information om potentiella digitala bedrägerier. Studien tillhör området informationssäkerhet inom data- och systemvetenskap. / Today's society has become increasingly digitized, and as a result, digital fraud has increased. Digital fraud can take various forms, but in this study, it was limited to phishing and its subcategories: spear phishing, vishing, and smishing. These are variations of digital fraud where the purpose is to deceive users into disclosing sensitive information digitally. The problem addressed in this study was the lack of knowledge among people regarding digital fraud, as many were still being deceived. The purpose of the study was therefore to contribute to increased awareness of how digital fraud can be detected by those who have been targeted and what individuals should be mindful of. Thus, the research question of the study was: In what ways do individuals attempt to manage the digital threats present on the internet? With the following sub-questions: What do individuals do to identify digital scams? How do individuals assess the credibility of digital interactions? To answer the research question, we used the research strategy survey. The survey was conducted in the form of semi-structured interviews, and data was collected on how the selected participants try to identify digital fraud and the collected material was analyzed using thematic analysis. The data was analyzed using thematic analysis. The study's findings indicated that despite limited formal education on the subject, most participants seemed to have developed similar strategies to detect digital fraud. However, many were unsure about the level of protection they had against these threats. The results highlighted the need for more information about digital fraud, especially for older individuals. The study's conclusions emphasize the necessity of addressing the identified knowledge gap and underscore the importance of individuals being vigilant and critical in their digital interactions. Future actions should focus on raising awareness about digital fraud, educating individuals on secure methods of digital interactions, and providing support to those who may be more vulnerable to these threats. Lastly, the study emphasizes the significance of companies, authorities, and organizations taking responsibility for staying updated and providing information about potential digital fraud. The study falls within the field of information security in data and systems science.

In recent years, cyber crime has focused intensely on people to bypass existing sophisticated security controls; phishing is one of the most common forms of such attack. This research highlights the problem of e-mail phishing. A lot of previous research demonstrated the danger of phishing and its considerable consequences. Since users behaviour is unpredictable, there is no reliable technological protective solution (e.g. spam filters, anti-viruses) to diminish the risk arising from inappropriate user decisions. Therefore, this research attempts to reduce the risk of e-mail phishing through awareness and education. It underlines the problem of e-mail phishing in the State of Qatar, one of world s fastest developing countries and seeks to provide a solution to enhance people s awareness of e-mail phishing by developing an effective awareness and educational framework. The framework consists of valuable recommendations for the Qatar government, citizens and organisations responsible for ensuring information security along with an educational agenda to train them how to identify and avoid phishing attempts. The educational agenda supports users in making better trust decisions to avoid phishing that could complement any technical solutions. It comprises a collection of training methods: conceptual, embedded, e-learning and learning programmes which include a television show and a learning session with a variety of teaching components such as a game, quizzes, posters, cartoons and a presentation. The components were tested by trial in two Qatari schools and evaluated by experts and a representative sample of Qatari citizens. Furthermore, the research proves the existence and extent of the e-mail phishing problem in Qatar in comparison with the UK where people were found to be less vulnerable and more aware. It was discovered that Qatar is an attractive place for phishers and that a lack of awareness and e-law made Qatar more vulnerable to the phishing. The research identifies the factors which make Qatari citizens susceptible to e-mail phishing attacks such as cultural, country-specific factors, interests and beliefs, religion effect and personal characteristics and this identified the need for enhancing Qatari s level of awareness on phishing threat. Since literature on phishing in Qatar is sparse, empirical and non-empirical studies involved a variety of surveys, interviews and experiments. The research successfully achieved its aim and objectives and is now being considered by the Qatari Government.

The concept of ‘empowerment’ has been widely used among development practitioners since the early 1990s. This thesis aims to contribute to the literature on empowerment by developing an analytical framework that incorporates: (a) the dialectical nature of power, (b) multiple levels of analysis, and (c) the subjectivities of power that different actors have and that affect the way they respond to policies. The model is applied to the analysis of Mozambique’s transition to peace and the study of a national initiative called District Development Fund, known as the ‘7 Million’, which aims to promote empowerment by reducing poverty and promoting local participation in the rural districts. The analysis focuses, on the one hand, on the ‘7 million’ policy formulation, stressing the power struggles that shaped its final outcome and, on the other hand, the policy implementation in the district of Angoche, where I conducted extensive fieldwork. I argue that, even though the ‘7 million’ had some positive aspects – including providing a discourse that underlines the relevance of the districts and the local community in matters of governance – its effects in promoting local empowerment have been far below its potential. One of the reasons for this is to be found in the dynamics of power-to and power-over that take place at the local level and that partly reflect structural aspects linked to the Mozambique state formation and peacebuilding process. More generally, the case illustrates the limitations and contradictions of policies that aim promoting ‘bottom-up’ empowerment from the ‘top-down’.

A primeira metade do século XX foi marcada por uma profunda alteração no tratamento dado à Questão Social. O Estado assumiu a gestão do problema alterando a maneira de lidar com o segmento pobre da sociedade. A gradual transição de um Estado Liberal para um Estado Corporativo, iniciada na década de 20, foi um marco na intervenção na área social. Forte engenharia social teve início no Brasil nessa época. À direita ou à esquerda do espectro político, grupos plenamente constituídos buscaram na juventude a força social renovadora. Esta tese analisa as disputas pelo controle do poder no Brasil, especificamente a disputa pela juventude, grupo social tido como essencial para reprodução dos projetos políticos em confronto. / The first half of the twentieth century was marked by a profound change in the treatment given to the Social Question. The state took over management of the problem by changing the way of dealing with the poor segment of society. The gradual transition from a Liberal State to a Corporate State, started in the decade of 20, was a mark in the intervention in social problems. Strong social engineering began in Brazil at that time. To the right or left of the political spectrum, fully formed groups sought to force the youth social novel. This thesis analyzes the dispute for control of power in Brazil, specifically the dispute for youth, social group considered essential for replication of the projects in political confrontation. Keywords: Youth Social Matter.

Thesis (Ph. D.)--University of Chicago, Faculty of the School of Social Service Administration, August 2001. / Includes bibliographical references. Also available on the Internet.

<p>Inom hälso- och sjukvården hanteras känslig patientinformation. I framtiden kommer alltmer information att lagras elektroniskt och därmed bli mer lättillgänglig. Användarna av informationssystemen kan vara en säkerhetsrisk. Metoderna som används vid intrångsförsök inriktas alltmer på att involvera människor istället för att enbart använda sig av teknik.</p><p>Syftet med detta arbete är att undersöka användarnas upplevelse och medvetenhet om icke tekniska hot mot informationssäkerheten för digitalt lagrad patientinformation.</p><p>Datainsamlingen genomfördes i form av kvalitativa intervjuer med sjuksköterskor anställda på ett sjukhus i västra Sverige. Resultatet visar att det allt överskuggande upplevda hotet var intrång och förlust av sekretess i den elektroniska patientjournalen. Hoten uppfattades som interna främst från personal och till viss del från patienter. Intrång av externa aktörer ansågs osannolikt och av mer teknisk natur. En social engineering attack skulle kunna vara lyckosam, skadan som skulle kunna åstadkommas förstärks av icke fungerande utloggningsrutiner, kombinerat med vissa brister i lösenordshanteringen och användarnas omedvetenhet om hoten.</p>

Hacking information systems is continuously on the increase. Social engineering attacks is performed by manipulating the weakest link in the security chain; people. Consequently, this type of attack has gained a higher rate of success than a technical attack. Based in Expert Systems, this study proposes a proactive and integrated Intelligent Social Engineering Security Model to mitigate the human risk and reduce the impact of social engineering attacks. Many computer users do not have enough security knowledge to be able to select a strong password for their authentication. The author has attempted to implement a novel quantitative approach to achieve strong passwords. A new fuzzy logic tool is being developed to evaluate password strength and measures the password strength based on dictionary attack, time crack and shoulder surfing attack (social engineering). A comparative study of existing tools used by major companies such as Microsoft, Google, CertainKey, Yahoo and Facebook are used to validate the proposed model and tool. A comprehensive literature survey and analytical study performed on phishing emails representing social engineering attacks that are directly related to financial fraud are presented and compared with other security threats. This research proposes a novel approach that successfully addresses social engineering attacks. Another intelligent tool is developed to discover phishing messages and provide educational feedback to the user focusing on the visible part of the incoming emails, considering the email’s source code and providing an in-line awareness security feedback.