Information leakage through online social networking: Opening the doorway for advanced persistence threats

Abdul Molok , Nurul Nuha and Chang, Shanton and Ahmad, Atif (2010) Information leakage through online social networking: Opening the doorway for advanced persistence threats. In: Australian Information Security Management Conference, 30 Nov - 2 Dec 2010, Perth, Western Australia.

PDF (Information leakage through online social networking: Opening the doorway for advanced persistence threats) - Published Version Restricted to Registered users only Download (151kB) | Request a copy

Abstract

The explosion of online social networking (OSN) in recent years has caused damages to organisations due to leakage of information by their employees. Employees’ social networking behaviour, whether accidental or intentional, provides an opportunity for advanced persistent threats (APT) attackers to realise their social engineering techniques and undetectable zero-day exploits. APT attackers use a spear-phishing method that targeted on key employees of victim organisations through social media in order to conduct reconnaissance and theft of confidential proprietary information. This conceptual paper posits OSN as the most challenging channel of information leakage and provides an explanation about the underlying factors of employees leaking information via this channel through a theoretical lens from information systems. It also describes how OSN becomes an attack vector of APT owing to employees’ social networking behaviour, and finally, recommends security education, training and awareness (SETA) for organisations to combat these threats.

Item Type:	Conference or Workshop Item (Full Paper)
Additional Information:	5341/32462
Uncontrolled Keywords:	Information leakage, unauthorised information disclosure, online social networking, social media, advanced persistent threats, cyber espionage
Subjects:	H Social Sciences > H Social Sciences (General) > H61.8 Communication of information T Technology > T Technology (General) > T55.4 Industrial engineering.Management engineering. > T58.6 Management information systems
Kulliyyahs/Centres/Divisions/Institutes (Can select more than one option. Press CONTROL button):	Kulliyyah of Information and Communication Technology > Department of Information System Kulliyyah of Information and Communication Technology > Department of Information System
Depositing User:	Dr. Nurul Nuha Abdul Molok
Date Deposited:	29 Oct 2013 15:13
Last Modified:	29 Oct 2013 15:13
URI:	http://irep.iium.edu.my/id/eprint/32462

Actions (login required)

View Item