Cyber Security Social Engineers An Extensible Teaching Tool for Social Engineering Education and Awareness

This Work in Progress in the Research to Practice Category paper will discuss the design and implementation of an extensible teaching tool for social engineering education and awareness. With the bulk of recent research within the field of computer and information security being focused squarely on the implementation or theory of security controls and mechanisms at the application, operating system, network, and physical layers, there has been relatively little attention has been paid to the user layer by contrast, especially from a sociotechnical perspective. Thus, while the technical countermeasures for data security grow increasingly sophisticated, user education and awareness has not kept up by comparison. This leaves them a far more attractive avenue of attack, susceptible to social engineering attacks such as phishing, computer virus hoaxes, and so on. Here then, we will endeavor to present a concise overview of the necessary background as well as discuss some of the design decisions that went into our implementation of an extensible teaching tool in the form of a serious game designed to help instill practical and relevant computer security practices to users who might not necessarily have a technical background, in an effort to guard against some of the more common social engineering attacks.