USER PROFILING TO INCREASE RESILIENCE OF CRITICAL INFRASTRUCTURE PERSONNEL TO CYBER ATTACKS USING THE HUMAN FACTOR

Abstract

The work is devoted to issues of increasing the resistance of employees of critical infrastructure objects to cybernetic attacks, the success of which is determined by the use of human factor weaknesses. Each social engineering attack, which is usually the key to the success of a subsequent cyber attack, exploits certain traits inherent in the individual. It also exploits flaws in enterprise-specific security policies that make users more vulnerable. The purpose of this work is to enrich the means of increasing the resistance of personnel of critical infrastructure objects to social engineering attacks, in terms of diagnostic profiling tools combined with training functions based on user surveys. The novelty of the work. An approach to the prevention of social engineering attacks is proposed, based on the identification of features that make the user vulnerable to such attacks. A set of factors, the presence of which can be diagnosed on the basis of a survey, is identified, a methodology and a corresponding software tool are proposed. Based on the factors, Boolean functions have been built that can be used to determine whether the user belongs to the appropriate profile. Methodology. An expert method was used to form the questionnaire. Vulnerabilities (factors) that are exploited by cyberattacks on critical infrastructure are determined as a result of the generalization of existing developments in the field of research. The developed software uses the questionnaire in a flexible format, based on it creating a communication interface with the user, and based on the user’s answers, forming the result of his profiling and analyzing the cases present in the survey. Main results. The proposed software and the corresponding methodology support preventive measures and security measures of the enterprise, can be used both as a tool for diagnosing vulnerabilities and as a training tool. Boolean functions that determine belonging to a certain profile can be used when building a formalized model of an internal violator. Conclusions. Testing of employees of critical infrastructure facilities according to the developed methodology made it possible to identify among the interviewed groups of users who are vulnerable to social engineering attacks of certain types, despite a high level of knowledge in information technologies. The tools proposed in the work are helpful in the tasks of increasing the resistance of personnel of critical infrastructure objects to cyber attacks using the human factor.