Global ETD Search

11	Social engineering and the ISO/IEC 17799:2005 security standard: a study on effectiveness Frangopoulos, Evangelos D. 31 March 2007 (has links) As Information Security (IS) standards do not always effectively cater for Social Engineering (SE) attacks, the expected results of an Information Security Management System (ISMS), based on such standards, can be seriously undermined by uncontrolled SE vulnerabilities. ISO/IEC 17799:2005 is the subject of the current analysis as it is the type of standard not restricted to technical controls, while encompassing proposals from other standards and generally-accepted sets of recommendations in the field. Following an analysis of key characteristics of SE and based on the study of Psychological and Social aspects of SE and IS, a detailed examination of ISO/IEC 17799:2005 is presented and an assessment of the efficiency of its controls with respect to SE is provided. Furthermore, enhancements to existing controls and inclusion of new controls aimed at strengthening the defense against Social Engineering are suggested. Measurement and quantification issues of IS with respect to SE are also dealt with. A novel way of assessing the level of Information Assurance in a system is proposed and sets the basis for future work on this subject. / Information Systems / M. Sc. (Information Systems) Information assurance Influence Persuasion Actor-network theory Objective reality Subjective reality ISO 27002 ISO 27001 ISO 17799 Security policy Information security Social engineering 005.8 Social engineering Data protection Computer security

Search results

Social engineering and the ISO/IEC 17799:2005 security standard: a study on effectiveness