risc of social engineering survey
TRANSCRIPT
7/26/2019 Risc of Social Engineering Survey
http://slidepdf.com/reader/full/risc-of-social-engineering-survey 1/7
© 2011 Dimensional ResearchAll Rights Reserved
www.dimensionalresearch.com
IntroductionThe threat of technology-based security attacks is well understood, and IT organizations have tools and processes
in place to manage this risk to sensitive corporate data. However, social engineering attacks are more challenging to
manage since they depend on human behavior and involve taking advantage of vulnerable employees. Businesses
today must utilize a combination of technology solutions and user awareness to help protect corporate information.
The following report, sponsored by Check Point, is based on a global survey of 853 IT professionals conducted in
the United States, United Kingdom, Canada, Australia, New Zealand, and Germany during July and August 2011.
The goal of the survey was to gather data about the perceptions of social engineering attacks and their impact on
businesses.
Key Findings• The threat of social engineering is real
- 97% of security professionals and 86% of all IT professionals are aware or highly aware of this potential
security threat
- 43% know they have been targeted by social engineering schemes
- Only 16% were condent they had not been targeted by social engineering, while 41% were not aware if they
had been attacked or not
• Financial gains are the primary motivation of social engineering
- 51% of social engineering attacks are motivated by nancial gain
- 14% of social engineering attacks are motivated by revenge
• Social engineering attacks are costly especially in large organizations
- 48% of large companies and 32% of companies of all sizes have experienced 25 or more social engineering
attacks in the past two years
- 48% of all participants cite an average per incident cost of over $25,000
- 30% of large companies cite a per incident cost of over $100,000
• New employees are most susceptible to social engineering techniques
- New employees (60%), contractors (44%), and executive assistants (38%) are cited to be at high risk for
social engineering techniques.
• Lack of proactive training to prevent social engineering attacks
- Only 26% of respondents do ongoing training
- 34% do not currently make any attempt to educate employees, although 19% have plans to
THE RISK OF SOCIAL ENGINEERING ONINFORMATION SECURITY:A SURVEY OF IT PROFESSIONALS
Dimensional Research | September 2011
Sponsored by
7/26/2019 Risc of Social Engineering Survey
http://slidepdf.com/reader/full/risc-of-social-engineering-survey 2/7
THE RISK OF SOCIAL ENGINEERING ONINFORMATION SECURITY:A SURVEY OF IT PROFESSIONALS
Dimensional Research | September 2011
www.dimensionalresearch.com © 2011 Dimensional ResearchAll Rights Reserved
Page 2
Detailed Findings Awareness of social engineering high among IT professionals
Participants were asked to rate their level of awareness of the potential security threat of social engineering attacks.
In general, IT professionals reported a high degree of awareness (86%) — 39% described themselves as aware and
47% highly aware. And among security professionals whose entire job was to secure their organizations systems,
awareness was even higher (97%) — 35% were aware and 62% highly aware. See Figure A.
Many businesses have already faced social engineering attacks
Participants were asked if their organizations have been targeted by social engineering attacks. While 43% of
participants indicated that they had, only 16% had condence that they had not been targeted. A large number of
participants (41%) were not aware of any attacks, but could not say denitively that there had not been an attempt.
This response implies a potential risk that businesses and IT teams are not dealing with. See Figure B.
What is Social Engineering?
Participants were given this denition of social
engineering before answering the survey question
Social Engineering is the act of breaking corpora
security by manipulating employees into divulgingcondential information. It uses psychological
tricks to gain trust, rather than technical cracking
techniques. Social Engineering includes scams
such as obtaining a password by pretending to be
an employee, leveraging social media to identify
new employees more easily tricked into providing
customer information, and any other attempt to
breach security by gaining trust.
0%
3%
35%
62%
2%
12%
39%
47%
0% 10% 20% 30% 40% 50% 60% 70%
Never heard of it
Somewhat aware
Aware
Highly aware
Figure A: Awareness of social engineering threats
All IT Professionals
Security Professionals
Yes
43%
Never
16%
Not that I am
aware of
41%
Figure B: Social engineering a0ack experiences
7/26/2019 Risc of Social Engineering Survey
http://slidepdf.com/reader/full/risc-of-social-engineering-survey 3/7
THE RISK OF SOCIAL ENGINEERING ONINFORMATION SECURITY:A SURVEY OF IT PROFESSIONALS
Dimensional Research | September 2011
www.dimensionalresearch.com © 2011 Dimensional ResearchAll Rights Reserved
Page 3
The highest rate of social engineering attacks (61%) was reported by participants who work in energy and utilities. Nonprots experienced the lowest level of social engineering attacks (24%).
Social engineering attacks motivated primarily by nancial gain
The participants who indicated that they had been victims of social engineering attacks were asked what they
believed the motivations were behind those attacks. Financial gain was cited as the most frequent reason (51%),
followed by access to proprietary information (46%), and competitive advantage (40%). Fortunately, revenge was
the least likely reason for a social engineering attack with only 14% reporting this as a motivator. See Figure C.
Motivations for social engineering attacks varied slightly in different countries. Australians (61%) and Americans
(52%) were the most likely to cite nancial gain as a motivation. Germans reported more revenge-motivated attacks(18%), while Canadians were more likely to experience attacks motivated by competitive advantage (54%).
Social engineering attacks happen frequently
Participants who had been targeted by social engineering attacks and also tracked these incidences were asked
about their frequency (N=322). Social engineering attacks were a frequent occurrence with 32% of all participants
reporting 25 or more attacks during the past two years. Unsurprisingly, larger organizations were attacked even more
frequently with 48% of participants reporting 25 or more attacks in the past two years. See Figure D.
4%
14%
40%
46%
51%
0% 10% 20% 30% 40% 50% 60%
Other
Revenge or personal vende9a
Compe<<ve advantage
Access to proprietary informa<on
Financial gain
Figure C: Mo,va,ons for social engineering a4acks
20%
32%
5%
33%
32%
36%
20%
2%
0% 5% 0% 5% 20% 25% 30% 35% 40%
Less than 5 1mes
5-24
25-50
More than 50 1mes
Figure D: Frequency of social engineering a3acks
All companies
More than 5,000 employees
7/26/2019 Risc of Social Engineering Survey
http://slidepdf.com/reader/full/risc-of-social-engineering-survey 4/7
THE RISK OF SOCIAL ENGINEERING ONINFORMATION SECURITY:A SURVEY OF IT PROFESSIONALS
Dimensional Research | September 2011
www.dimensionalresearch.com © 2011 Dimensional ResearchAll Rights Reserved
Page 4
Social engineering attacks are costly
Participants who had been targeted by social engineering attacks and tracked these incidences were also asked about
the typical cost of each incident (N=322). Costs included business disruptions, customer outlays, revenue loss,
labor, and other overhead. These attacks were frequently costly with almost half of participants (48%) reporting a
per-incident cost of more than $25,000. Again, larger organizations reported even higher costs with 30% reporting a
per-incident cost of more than $100,000. See Figure E.
Across industries, nancial services and manufacturing reported the highest average per-incident cost, and
educational institutions and non-prots reported the lowest costs.
New employees present greatest risk for social engineering attacks
All participants were asked what type of personnel was the most likely to be susceptible to social engineering
techniques. New employees were considered the highest risk (60%), followed by contractors (44%) who may be less
familiar with corporate security policies, and executive assistants (38%) who have access to executive calendars and
condential information. See Figure F.
32%
12%
13%
13%
30%
38%
14%
16%
13%
19%
0% 5% 10% 15% 20% 25% 30% 35% 40%
Less than $10,000
$10,000 - $25,000
$25,000 - $50,000
$50,000 - $100,000
More than $100,000
Figure E: Typical cost per social engineering incident
All companies
More than 5,000 employees
60%
44% 38%33% 32%
23%
34%
46%53%
56% 56% 55%
6%11% 9% 11% 12%
22%
0%
10%
20%
30%
40%50%
60%
70%
New employees Contractors Execu?ve
assistants
Human resources Business leaders IT personnel
Figure F: Risk of falling for social engineering techniques
High risk
Low risk
No risk
7/26/2019 Risc of Social Engineering Survey
http://slidepdf.com/reader/full/risc-of-social-engineering-survey 5/7
THE RISK OF SOCIAL ENGINEERING ONINFORMATION SECURITY:A SURVEY OF IT PROFESSIONALS
Dimensional Research | September 2011
www.dimensionalresearch.com © 2011 Dimensional ResearchAll Rights Reserved
Page 5
Few companies proactively train on risk of social engineeringAll participants were asked what their organization was doing to prevent social engineering attacks. Only 26% of
participants actively train employees on the threat. An additional 34% do not have any initiatives in place now,
although some of those (19%) do have plans to start a program to educate employees. The largest segment of
participants, 40%, put the responsibility on the employee to read and understand their organization’s overall security
policy documents to prevent data loss, security attacks, and social engineering-based threats. See Figure G.
Phishing emails most common source of social engineering
Participants were asked their opinion on the most common source of social engineering threats. Phishing —
pretending to be a trustworthy entity in an electronic communication — was identied as the most typical source
(47%), followed by social networking sites such as LinkedIn that allow new employees to be targeted (39%). See
Figure H.
15%
19%
40%
26%
0% 5% 10% 15% 20% 25% 30% 35% 40% 45%
No, not at the moment
Not currently, but we have plans to
Our security policy includes direcAons on prevenAng
social engineering
We acAvely do ongoing training with employees
Figure G: Approach to employee awarenss of social engineering
Phishing emails
47%
Social networkingsites
39%
Insecure mobile
devices
12%
Other
2%
Figure H: Most common source of social engineering threats
7/26/2019 Risc of Social Engineering Survey
http://slidepdf.com/reader/full/risc-of-social-engineering-survey 6/7
THE RISK OF SOCIAL ENGINEERING ONINFORMATION SECURITY:A SURVEY OF IT PROFESSIONALS
Dimensional Research | September 2011
www.dimensionalresearch.com © 2011 Dimensional ResearchAll Rights Reserved
Page 6
Sophisticated technology-based security threats continueOrganizations across all sizes and industries have experienced a variety of both technologically sophisticated and
social engineering attacks, indicating a clear need to manage both technological and social engineering attacks.
Participants reported that they were most likely to experience trojans (56%), followed by phishing techniques,
botnets, and drive-by downloads. See Figure J.
Survey MethodologyIn July 2011, an independent database of IT professionals was invited to participate in a Web survey on the topic
of social engineering and information security sponsored by Check Point. A total of 853 respondents across the
U.S., UK, Canada, Australia, New Zealand, and Germany completed the survey, all of whom had responsibility forsecuring company systems. Participants included IT executives, IT managers, and hands-on IT professionals and
represented a wide range of company size and industry verticals.
IT security is my
en.re job
31%
IT security is a part
of my job
69%
Responsibility for IT Security
IT execu(ve
30%
IT manager
41%
Front-line IT
professional
29%
Par$cipant Job Func$on
1%
16%
22%
26%
48%
56%
0% 10% 20% 30% 40% 50% 60%
Other
Drive-by downloads
Botnets
Targeted threats
Phishing
Trojans
Figure J: Occurrence of technologically sophis6cated
and social engineering security threats
Less than 100
7%
100-1,000
35%
1,000 – 5,000
29%
5,000 – 15,000
15%
More than 15,000
14%
Company Size
7/26/2019 Risc of Social Engineering Survey
http://slidepdf.com/reader/full/risc-of-social-engineering-survey 7/7
THE RISK OF SOCIAL ENGINEERING ONINFORMATION SECURITY:A SURVEY OF IT PROFESSIONALS
Dimensional Research | September 2011
www.dimensionalresearch.com © 2011 Dimensional ResearchAll Rights Reserved
Page 7
About Dimensional ResearchDimensional Research® provides practical marketing research to help technology companies make their customers
more successful. Our researchers are experts in the people, processes, and technology of corporate IT and understand
how IT organizations operate. We partner with our clients to deliver actionable information that reduces risks,
increases customer satisfaction, and grows the business. For more information visit www.dimensionalresearch.com.
About Check Point Software Technologies Ltd.Check Point Software Technologies Ltd. (www.checkpoint.com), the worldwide leader in securing the Internet,
provides customers with uncompromised protection against all types of threats, reduces security complexity and
lowers total cost of ownership. Check Point rst pioneered the industry with FireWall-1 and its patented stateful
inspection technology. Today, Check Point continues to develop new innovations based on the Software Blade
Architecture, providing customers with exible and simple solutions that can be fully customized to meet the exact
security needs of any organization. Check Point is the only vendor to go beyond technology and dene security as a
business process. Check Point 3D Security uniquely combines policy, people and enforcement for greater protection
of information assets and helps organizations implement a blueprint for security that aligns with business needs.
Customers include tens of thousands of organizations of all sizes, including all Fortune and Global 100 companies.
Check Point’s award-winning ZoneAlarm solutions protect millions of consumers from hackers, spyware and
identity theft.