# An Effective Blockchain-Based Defense Model for Organizations against Vishing Attacks
## 3 Preventing Social Engineering Attacks Using Security Principle
### How Security Principles prevents Social Engineering Attacks
#### 3.3.2 Dual Control Effectiveness Analysis  
Dual control is an implementation of a defense-in-depth strategy. It involves more protection mechanisms to complete any transaction. Dual control requires at least two persons to handle any transaction so that if one person is tricked, the second will discover it. For instance, quid pro quo, tailgating, baiting, and phishing attack success depends on bypassing one direct person. It does not require information disclosure but mostly incites the victim to do something. Dual control will stop those attacks since every transaction will be verified twice.  
Similarly, dual control will protect corporations against all SE attacks classified in its category.  
A Social Engineering Attack Defense Model for Organizations Performed via Merging Security Principles and Blockchain  
Figure 2 represents the proposed new SE defense model that implements dual control and split knowledge security principles using private blockchain technology. Figure 2 shows the different ingredients and connections between the different entities of the proposed SE attack defense model. It consists of separating the control between involved parties and documenting agreed processes in a decentralized way to improve accountability and transparency. Thus, any potential request for non-public information or unusual transactions by phone call will be dual controlled and collectively processed. The issues of the psychological status of the phone recipient will be avoided, and the attacker will find it harder to collect information about each background verifier of the transaction.  
The proposed model uses blockchain technology to implement and manage dual control requirements. Blocks are created only when all participating parties positively endorse the transaction. In that event, a new block is issued containing the different transaction details. The blockchain will also enable the recording of all transactions in  
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**SE Attacks** & **Security Principles** & **How to** **Data Level** & **Management Level** \\ \hline Smishing & & & Information classification will be governed by organizational policies. Each person will only be allowed to know the information necessary to perform his or her job, and those who have direct contact with the outside world will only be allowed to know information that the company deems apparently known. \\ Quid Pro Quo & & & The information required to complete a task is divided between at least two persons. So, if the attackers deceive one victim it will be harder to trick the second also. \\ \hline \hline \end{tabular}
\end{table}
Table 1: Security principles ability to stop SE attacks.  
a non-repudiation manner, which is very important for accountability requirements. We use private blockchain since all parties are within the same organization. Private blockchain does not face scalability and time-relentless issues since it does not require proof of work as in a public blockchain.