# An Effective Blockchain-Based Defense Model for Organizations against Vishing Attacks
## 3 Preventing Social Engineering Attacks Using Security Principle  
In this effort, we propose implementing two security principles to deal with human weaknesses: split knowledge and dual control. To the best of our knowledge, no previous model or research has implemented those security principles to deal with SE attacks and the reliance on human decisions. This section categorizes different SE attacks according to the security principles that will stop them. In addition, this is the first categorization that links defense techniques with specific SE attacks, rather than simply categorizing attacks [11]. We aim to implement a solution using security principles that avoid dependence on the psychological status of the individual, even if he or she is well trained. Human decisions and actions are unpredictable during any psychological condition, and employees in certain circumstances will threaten any organization's policy. The idea is to minimize the privileges and need-to-know for employees to a minimum, so that no one could disclose complete knowledge or make a transaction without the endorsement of at least one other person. Thus, even if one person breaches security guidelines, the second will usually discover it and avoid disclosing information or making suspicious transactions. Of course, the use of those security principles is applicable only within organizations where information is classified according to its sensitivity and tasks are distributed over several employees.  
The categorization process of SE attacks is based on the following factors:  
* Split knowledge is a subset of the dual control principle but related only to the information. Dual control is more related to processes and mechanisms. The categorization is based on whether stopping the hacker from knowing the information or completing the hacking operation will avoid the attack or not. In other words, if the SE attack fails when the information is not completelty gathered, then the SE attack is classified within the split knowledge category. Equally, if the SE attack fails when the operation is not completed, then the SE attack is classified within the dual control category. Some of the SE attacks could be stopped by both split knowledge or dual control. In this case, we categorize them as dual control since it represents the big umbrella.
* We show in the Figure 1 only the SE attacks that use different contact/communication techniques with the victim. Therefore, attacks such as piggybacking and whaling are not depicted in Figure 1 but mentioned as similar attack types.  
It should be noted that attacks, such as honeytraps, scareware, pharming, and watering hole assaults, which are categorized as spoofing attacks and employ spoofing techniques to deceive the target, are not taken into account, since those assaults are carried out without the victim having to be involved. For instance, eavesdropping, shoulder surfing, and dumpster diving assaults do not necessitate conversation with the victim. Instead, they include information acquisition by illegal listing, peering over someone's shoulder, or searching for treasure in someone else's garbage, respectively.  
Figure 1 shows the proposed categorization of SE attacks and the security principle to stop them.  
Figure 1: Categorization of SE attacks based on the security principles that prevent it. It describes how the security principle will avoid the associated SE attacks.