Pretexting and the Information Security Culture. Case of a University of the Peruvian Amazon

Marchand-Nino W.-R.; Vargas-Malca Y.-V. · Proceedings - 2023 49th Latin American Computing Conference, CLEI 2023 (2023) · DOI: 10.1109/clei60451.2023.10346160

Resumen

Information security is to protect information from unauthorized access that causes irreparable damage to people and organizations. Security measures must cover both the technical and organizational aspects. It is precisely the organizational aspect related to the security culture that must be strengthened with greater efforts, because social engineering attacks against users continue to be a path of success for cybercriminals. In this investigation, pretexting was carried out, a social engineering technique that was applied to a university of peruvian amazon, whose organizational culture is like others in the interior of the country. The objective was to evaluate the behavior of users in terms of awareness and appropriation against social engineering techniques such as pretexting. The applied methodology included the definition of excuse, preparation of instruments, selection of target persons, chronological programming of execution, application of the exercise, analysis, and data processing. The excuse was related to the collection of data from the computer equipment for a diagnosis of the computer park as part of an investigation to formulate technological optimization solutions. Some results obtained were: 15% of the people reached requested some type of authorization, 70% showed no interest in supervising the data that was collected from the computer, and 40% of users stored passwords in the browser without additional protection. This reflects the low to medium levels of awareness and ownership for the security culture in this case.

Instituciones: Universidad Nacional Agraria de la Selva