Information Leakage through Online Social Networking: Opening the Doorway for Advanced Persistence Threats

Authors

Nurul Nuha Abdul Molok, University of Melbourne
Shanton Chang, University of Melbourne
Atif Ahmad, University of Melbourne

Document Type

Conference Proceeding

Publisher

School of Computer and Information Science, Edith Cowan University, Perth, Western Australia

Comments

8th Australian Information Security Mangement Conference, Edith Cowan University, Perth Western Australia, 30th November 2010

Abstract

The explosion of online social networking (OSN) in recent years has caused damages to organisations due to leakage of information by their employees. Employees’ social networking behaviour, whether accidental or intentional, provides an opportunity for advanced persistent threats (APT) attackers to realise their social engineering techniques and undetectable zero-day exploits. APT attackers use a spear-phishing method that targeted on key employees of victim organisations through social media in order to conduct reconnaissance and theft of confidential proprietary information. This conceptual paper posits OSN as the most challenging channel of information leakage and provides an explanation about the underlying factors of employees leaking information via this channel through a theoretical lens from information systems. It also describes how OSN becomes an attack vector of APT owing to employees’ social networking behaviour, and finally, recommends security education, training and awareness (SETA) for organisations to combat these threats.

DOI

10.4225/75/57b673cf34781