13th ICCRTS “C2 for Complex Endeavors” Operationalizing Social Engineering for Offensive Cyber Operations Topic(s): Cognitive and Social Issues, Organizational Issues Authors:

Social Engineering describes a class of computer hacking that targets the user of the system rather than the hardware or software. It is a proven and viable vector that includes techniques like phishing, pharming, and persuasion. The Air Force uses social engineering to a limited extent as a validation tool when assessing the security stance of a unit or installation. Units like the 57th Information Aggressor Squadron based at Nellis Air Force Base routinely employ social engineering techniques as they perform their mission. However, this is the only employment of social engineering currently evidenced in the Air Force inventory. Based on the widespread success of these techniques in the civilian world, anecdotal evidence gleaned from both interviews and literature reviews places their effectiveness at or near 100 percent [14], social engineering seems a logical fit for an organization looking for the next best weapon. Additionally, social engineering has the rare and enviable trait of being extremely low cost, both in terms of training and execution. These factors inspired this research along with the perceived lack of interest given the topic inside the Air Force. Further investigation into social engineering evidenced little academic attention devoted to the topic which seemed disproportionate to the technique’s reported level of effectiveness. With the material presented here, we aim to demonstrate that social engineering as a concept already exists in current doctrine and that, with a little adaptation, a widely practiced methodology exists that can be used to structure social engineering attacks and evaluation. Social engineering directly impacts both friendly and adversary decision cycles, making it a direct player in any discussion about command and control. It can provide information or misinformation depending on the application. Even a failed social engineering attempt, if recognized by an adversary, can undermine trust and confidence in the validity of uncompromised data. However, its blend of technical with the psychological makes it difficult to categorize. Perhaps the best fit would be in the realm of decision support systems where the traditional concept of a data warehouse with appropriate filtering technology is expanded to include the human element. This paper takes the stance that social engineering is an under appreciated tool that is available for use. As the Air Force steps into the cyber arena with the creation of a new Cyber Command [8], the cultivation and employment of all possible methods to achieve supremacy in that domain must necessarily achieve primary concern. Answering the implicit challenge in this statement, we explore social engineering. We start with a discussion on the background of social engineering, reviewing the exploits of Kevin Mitnick who is perhaps the most famous hacker in the United States and who made many of his biggest breakthroughs using social engineering techniques. We will also discuss the essence of social engineering, persuasion, and review some research being done at Stanford University by Dr. Fogg on a new area of study called Captology. We will explore Influence Operations, a term we believe implicity points to social engineering. Chapter Three goes further into the realm of Influence Operations, drawing explicit parallels between concepts widely accepted in the Air Force and concepts familiar to the social engineer. Finally, Chapter Four takes social engineering and introduces a conceptual framework to apply it to the real world, a practical method for planning operations and performing Battle Damage Assessments (BDA) afterwards. This application and evaluation model is the real contribution of the research effort as it provides a starting point for the Air Force