Social Engineering: The Human Attack Surface

The technical security architecture that the information security programme deploys addresses the adversarial techniques that exploit technology vulnerabilities. Social engineering addresses the adversarial techniques that exploit human vulnerabilities, and the persistence of email as the vector for approximately ninety-one percent of cyber-attacks reflects the adversarial community’s rational conclusion that the human attack surface is more reliably exploitable than the technical one in organisations that have invested substantially in their technical defences. The attacker who cannot penetrate the firewall, bypass the endpoint protection, or exploit the patched vulnerability can often achieve the same access objective by persuading a legitimate user to provide the credentials, authorise the transaction, or execute the payload that technical controls would have prevented.

The ISO must understand social engineering not as the peripheral security concern that technical security orientations have sometimes treated it but as the primary attack vector whose sophistication, prevalence, and success rate makes its governance a central security programme priority. The social engineering threat is not primarily a technology problem requiring a technology solution. It is a human problem requiring the human-centric security response that the preceding sections of this publication have established as the framework for addressing human vulnerability in the security context.

The Social Power Framework #

Social engineering attacks are most accurately understood not as random deceptions but as the systematic exploitation of the social power dynamics that govern human behaviour in organisational settings. Social power refers to the capacity of one individual or entity to influence the behaviour of another, and the principal forms of social power, including authority, expert, reward, coercive, and referent power, each create the specific psychological vulnerability that social engineering techniques are designed to exploit.