Vulnerability of Social Networking Media and the Insider Threat: New Eyes for Bad Guys

摘要

Social networking media introduces a new set of vulnerabilities to protecting an organization's sensitive information. Competitors and foreign adversaries are actively targeting U.S. industry to acquire trade secrets to undercut U.S. business in the marketplace. Of primary concern in this endeavor is an insider's betrayal of an organization, witting or unwitting, by providing sensitive information to a hostile outsider that negatively impacts an organization. A common existing technique to enable this breach of sensitive information is social engineering -- the attempt to elicit sensitive information by obscuring the true motivation and/or identity behind the request. Social engineering, when coupled with the new and widespread use of social networking media, becomes more effective by exploiting the wealth of information found on the social networking sites. This information allows for more selective targeting of individuals with access to critical information. This thesis identifies the vulnerabilities created by social networking media and proposes a mitigation and prevention strategy that couples training and awareness with active surveys and monitoring of critical persons within an organization.