A Survey about the integration of social engineering attacks with cyber security exploiting Turkish vulnerabilities in Turkey

Tosun, Adem
Many organizations have been seeking for comprehensive and applicable security policies to regulate their security aspects. As it is a well-known issue, the weakest link of chain in Cyber security is human being and it cannot be measured easily as its being intangible. Organizations may invest millions of dollars to build technically secure systems by installing high level trusted software programs or devices. History has shown that these kind of measures neither has been that much successful or effective in protecting the systems nor prevented social engineering kinds of attacks which may lead to a compromised system without any need to lose much time and risk for a hacker. The purpose of this thesis is to investigate which successful tactic and techniques are successfully being used to compromise systems by manipulating or hacking human software rather than software systems and find out results of these attacks. In addition, the weakness of human software will be analyzed and dominant factors will be figured out. At the end of this thesis, how security policies should be made, which issues better be considered in addition to technical solutions and what the most weaknesses of participants will be revealed to provide a higher level secure systems for organizations. The effects and popularity of social engineering attacks will also be discussed at the end of the study and some countermeasures will be given to managers to prevent such social engineering attacks towards their workers.


Virtual penetration testing with phase based vulnerability analysis
Çalışkan, Emre; Baykal, Nazife; Department of Information Systems (2015)
Vulnerability scanning, penetration testing, and manual auditing are ways of finding vulnerabilities in organizations. However, they have some limitations like time, accuracy, testers’ ability, etc. Virtual penetration testing aims to alleviate these limitations. By virtual penetration testing, it is intended to assess security controls corresponding to the vulnerabilities found by vulnerability scanning, and correlating assessment result with vulnerabilities. Consequently, correlation will enable to find e...
On provable security of some public key encryption schemes
Hanoymak, Turgut; Akyıldız, Ersan; Selçuk, Ali Aydın; Department of Cryptography (2012)
In this thesis, we analyse the security criteria of some public key encryption schemes. In this respect, we present the notion of adversarial goals and adversarial capabilities. We give the definition of provably security by means of several games between the challenger and the adversary in some security models, namely the standard model and the random oracle model. We state the main differences between these two models and observe the advantage of the success probability of the adversary in breaking the cr...
A faster intrusion detection method for high-speed computer networks
Tarım, Mehmet Cem; Schmidt, Şenan Ece; Department of Electrical and Electronics Engineering (2011)
The malicious intrusions to computer systems result in the loss of money, time and hidden information which require deployment of intrusion detection systems. Existing intrusion detection methods analyze packet payload to search for certain strings and to match them with a rule database which takes a long time in large size packets. Because of buffer limits, packets may be dropped or the system may stop working due to high CPU load. In this thesis, we investigate signature based intrusion detection with sig...
A Conceptual Model for a Metric Based Framework for the Monitoring of Information Security Tasks’ Efficiency
Sönmez, Ferda Özdemir (Elsevier BV; 2019)
Information Security Governance Systems are not adequate to measure the effectiveness and efficiency of security tasks for the enterprises. Although some of the systems offer ways for measurement, they still need the definition of measurement objectives and metrics. This study proposes a conceptual framework mode which has human and tool/process related metrics. This system also allows the collection of evidence data for security-related tasks and ways to motivate the security staff to provide a more produc...
Security of certificate-based protocols: focus on server authentication
Baran, Selim; Özbudak, Ferruh; Selçuk, Ali Aydın; Department of Cryptography (2015)
Today, secure communication channels are mostly set up via certificate-based protocols, such as Secure Sockets Layer (SSL) and Transport Layer Security (TLS). Although they have been used for years and in so many areas, from e-commerce and internet banking to secure channel needs in military, there have been several attacks on their security model, which forced researchers to make studies on them. In this thesis, we will explain their security model, the vulnerabilities discovered so far, the precautions fo...
Citation Formats
A. Tosun, “A Survey about the integration of social engineering attacks with cyber security exploiting Turkish vulnerabilities in Turkey,” M.S. - Master of Science, Middle East Technical University, 2015.