Abstract— The goal of our paper is to find out the readiness in Estonia to raise awareness of cyber security related social engineering, especially among common people. We suggest that the awareness and understanding of online social engineering can raise Estonian defence potential to a new level. Future cyber-attacks may complement server attacks with human engineering and spreading misinformation in order to create incentives for treason or mutiny against the decisions of the state. Social engineering of information and people is one way to wage modern information war.
We have conducted a study involving schoolchildren and ICT students as well as members of the Estonian
Defence League Cyber Defence Unit (EDLCDU). The
findings will suggest a way to carry out related training programmes or campaigns. The recommendations are useful for coordinating the efforts of the four Ministries involved, addressing the crossroads of technical cyber
security, social interaction, communication and education.
Our hypothesis
is that in the cyber
war situation
when information is scarce and the circumstances are hard to understand, ordinary citizens
(lay people) can turn against their
government and critical services (e.g. public transport and infrastructure), carrying the conflict over from the cyberspace into actual space – but
this kind of process can be largely prevented by proper policies as well as
education.
There are three ideas that contribute to the possibility of mass
manipulation: we are all connected, tend to overreact and “with the right
weather conditions, all the hell can break loose”. So the following points
apply:
- In the age of social networking, “who knows who”
has gained major importance. The concept of “six degrees of separation”
refers to the idea that everyone is on average approximately six steps
away. Nowadays we see it happening in real social networks [1]. For
example, I know my country’s political leader, who knows the President of
the US, who knows everybody. So the steps can be even less numerous [2];
- Positive feedback loops are well known to
describe the dynamics of change in biological evolution. Today, the same
effects are seen on the net: a small disturbance launches several opinions
from others and the result will be greatly amplified [3, 4]. Sometimes it
will not last long, but in case of larger public interest [5, 6] it can
end up to be gathering to dance like a Michael Jackson [7]. Essentially
the same process worked at the Bronze Soldier riots or more currently the
Arabian Spring, Occupy Wall Street [8] or the on-going protests against
ACTA [9];
- Nowadays the police consider weather conditions
as one of the key elements to influence the risk of massive unrest. The
threat is lower when it’s too cold or too warm [10, 11].
Kalev Leetaru, a computer scientist, has claimed that “pooling together
the global tone of all news mentions of a country over time appears to
accurately forecast its near–term stability, including predicting the
revolutions in Egypt, Tunisia, and Libya, conflict in Serbia, and the stability
of Saudi Arabia [12]”.
Putting these three ideas together, we will get an explosive mix. For
example, Mr Smith hears from a friend’s friend that the Euro is devalued in a
few days. How would he act? When that information is fed to the public, how can
government be quicker and more reliable than the biased (as seen by many
people) mass media or other Web 2.0 tools and social networks? Also (and
perhaps most importantly), who is the enemy to blame?
Doing our research we used triangulation with an interview and a survey
to get better understanding of human behaviour and attitudes towards cyber war
issues in their life: stage I – an interview with three cyber security experts,
where we also got input to the stage II questionnaire from; stage II – the
focus group study. We used the open source web application called Limesurvey.
We collected 98 responses in 2 weeks’ time; stage III – the results were
analysed by five experts (2 representing education, 2 ICT, 1 legislation),
using the group analysis method.
The stage II focused on students (42): 27 from secondary school, others from
university (8 ICT related); ICT experts (25): 6 were EDLCDU-related; and other
adults (31): 14 education and 2 were EDLCDU-related. We used a survey with 37
questions divided on six sub-categories: general, government and cyberspace,
cyber war means, ethics, incident response and background information. The data
was collected using Likert scale [13] and Q Methodology [14] rankings plus open
questions that were mainly used for clarification.
The results were somewhat expected – the ICT people have heard of cyber
war, others see it as related only to 'cyberspace and servers'. At the same
time, the most crucial finding seems to be that both the lack of information
and (even perceived) manipulation attempts from the government will raise
unrest in society.
We also see a problem when the media presents news originating from “an
independent research agency” and it is believed to be reliable a priori – only
a few people will search more information about the topic or think about how
newspapers translate original texts or “lend”
coverage to each other (making it similar to the children's 'telephone
game').
Cyber war is in some ways alike to cyber bullying – it happens on the
Net and is often believed to be separate from real life. But as there are links
between real-life bullying and cyber bullying, there are links between cyber
war and real life conflicts. When we see massive unrest in several countries,
it has often started from the discussions on the Net where everybody can join –
the positive feedback takes place. It is easy to think that cyber incidents are
related only to servers and systems, but it is important to see that these
attacks are more and more related to information manipulation, lack of
information and affecting people.
We also see children's dependence on the online needs and quick reaction
to problems. When adults tend to wait before acting and are more patient then
youngsters usually want quick and simple results and are not patient. It can be
illustrated with two events in Estonian history spanning over more than a dozen
of years - defending the TV Tower 1991 [15] and the Bronze soldier removal
affair in 2007 - when schoolchildren and young adults were manifest in the
streets. Young adults and students also formed the core of anti-ACTA protesters
in February 11, 2012 [16].
By raising awareness in e-safety and cyber war issues as well social
engineering, less people will be affected by misleading information from any
channels. Trusted and open government is also of vital importance. Awareness
training should be carried out by specialists in that very area, not volunteers
or different generic programs. When people are treated respectfully by the
government sharing valid information, there will be no or less rallying in the
streets during the next crisis.
Education in cyber defence should be a part of national curricula in
elementary, secondary and university level. An interesting finding was that
while people would like to have more practical skills to defend themselves and
it is also seen as an opportunity to include NGO or ISP to the training
process, government institutions were given preference over private
enterprises.
Keywords- cyber security; social engineering; education policy
[1]
J. Ugander, et al “The Anatomy
of the Facebook Social
Graph,” Cornell University Library, NY, US. 2011
[2]
L. Backstrom, et
al, “Four Degrees of
Separation,” Cornell University Library, NY, US. 2011
[3]
T. Goetz, “Harnessing the Power of
Feedback Loops,” Wired Magazine, Jun. 2011
[4]
P. McRae, “Argumentum ad infinitum: The
complex nature of echoing
voices on the Internet,” Complexity Science and Educational Research (CSER), Vancouver, BC: University of British Columbia. 2007
[5]
K. Lewis, (2010,
Feb 11) The Network Effect [online] Available: http://www.kieranlevis.com/the-network-effect/
[6]
L. Rosales, (2011,
Oct 18) Anatomy of a social media chain reaction – case study [online] Available: http://agbeat.com/real-estate-technology-new-media/anatomy-of-a-social-media-chain-reaction-case-study/
[7]
D. Paap, (2009,
Aug. 3) Dance Tributes Around the World for the Dance Legend, Michael Jackson [online] Available: http://movetheframe.wordpress.com/2009/08/03/dance-tributes-around-the-world-for-the-dance-legend-michael-jackson/
[8]
Hundreds of Occupy Wall Street protesters arrested (2011, Oct. 2)
BBC News US&Canada [online]
Available: http://www.bbc.co.uk/news/world-us-canada-15140671
[9]
Acta: Europe braced for protests over anti-piracy treaty (2012 Feb. 6)
BBC News Technology [online]
Available: http://www.bbc.co.uk/news/technology-16906086
[10] E.
G. Cohn, “Weather ans
Crime,” Brit. J. Criminol vol
30 no. 1. 1990
[11] P.
Butke and S. Sheridan, “An Analysis of
Relationships between Weather ans
Aggressive Crime in Cleavland, Ohio,” Dep. Geography, Ken State Univerity, 2010
[12] K.
Leetaru, “Cultoromics 2.0:
Forecasting large-scale human behaviour using news media
tone in time and
space,” FM
Vol 16 no 9
2011
[13] R.
Kumar, Research Methodology, APH Publishing, 2005
[14] Z.
Todd, Mixing methods in psychology: the integration of qualitative and practice, Psychology Press
Taylor ans Francis Group,
2004
[15] Saatuslikud tunnid teletornis? (2006
Aug. 17) Maaleht [online]
Available: http://www.levira.ee/dyna/site/696est.html
[16] Tartu ACTA vastaste
protesti lõpukõne: Siim Tuisk (2012, Feb. 11)
Youtube [onlne] Available: http://www.youtube.com/watch?v=gDz8MAG4jj4
No comments:
Post a Comment