Loading...
Publication
Avaliação de segurança informática numa instituição pública
| Name: | Description: | Size: | Format: | |
|---|---|---|---|---|
| 9.14 MB | Adobe PDF |
Authors
Advisor(s)
Abstract(s)
A Cibersegurança vem a ser cada vez mais utilizada com o desenvolver e a integração da tecnologia
no dia a dia das pessoas, seja para trabalho como vida pessoal. No contexto de Cibersegurança a
Engenharia Social é um dos tipos de ataque mais utilizados, sendo que os atacantes aproveitam-se
das vulnerabilidades dos utilizadores para ter sucesso. O phishing é o método de engenharia social
mais comum, este visa a recolha de informações das vítimas. Outro método de ataque utilizado são
os dispositivos USB maliciosos, que contêm malware com o objetivo de difundi-lo e/ou de danificar
os dispositivos.
Considerando o uso destes ataques é relevante saber o quão vulneráveis as pessoas realmente
estão, se existem fatores que afetam a perceção sobre os ataques, e se fornecer recursos para educar
as pessoas é significativo para o aumento dos conhecimentos. É importante os utilizadores apren derem a reconhecer e qual o procedimento a ter em situações de phishing e de dispositivos USB de
fontes desconhecidas. Este conhecimento é transmitido através de campanhas de consciencialização
e permite a proteção de dados no trabalho e na vida pessoal.
O projeto, aqui apresentado, tem como objetivo a educação dos membros de uma comunidade
académica sobre engenharia social (focando no phishing e em pens maliciosas), através de uma
campanha de consciencialização. Para verificar a eficácia da campanha, foram feitos ataques simu lados antes e depois da desta, e através dos resultados de ambos os ataques e da sua comparação,
procurar identificar o grau de melhoria (ou não) da consciência das pessoas para a cibersegurança.
A pouca quantidade de resultados no caso de estudo com as pens USB não permitiu fazer uma
análise que pudesse avaliar o impacto na comunidade académica. Já a análise e comparação dos
resultados do caso de estudo do phishing possibilitou identificar alguns dos comportamentos de risco
por parte de diferentes membros da universidade e permitiu uma melhor adequação da formação
em cibersegurança. A análise aos dados de ambas as campanhas mostrou uma vulnerabilidade
relevante em todos os grupos, tendo em ambos os ataques, e.g., mais de 50% de ligações maliciosas
selecionadas. Outro fator relevante identificado, foi o fator idade nos alunos, sendo os alunos de
menor idade mais vulneráveis e este ataque, identificados como os alunos dos cursos técnicos e 1º
ciclo (geralmente, idades entre 18 e 21 anos). No geral, concluiu-se que a formação necessita ser
melhorada de forma a reduzir estas vulnerabilidades.
Cybersecurity is being used more and more with the development and integration of technology in people’s daily lives, whether for work or personal life. In the context of Cybersecurity, Social Engineering is one of the most used types of attack, with attackers taking advantage of user vulnerabilities to succeed. Phishing is the most common method of social engineering, it aims to collect information from victims. Another attack method used is malicious USB devices, which contain malware with the aim of spreading it and/or damaging the devices. Considering the use of these attacks, it is relevant to know how vulnerable people really are, if there are factors that affect the perception of attacks, and if providing resources to educate people is significant for increasing knowledge. It is important for users to learn how to recognize and what to do in situations of phishing and USB devices from unknown sources. This knowledge is transmitted through awareness campaigns and enables data protection at work and in personal life. The project, presented here, aims to educate members a academic community about social engineering (focusing on phishing and malicious pens), through an awareness campaign. To verify the effectiveness of the campaign, simulated attacks were made before and after the campaign, and through the results of both atacks and their comparision, seek to identify the degree of improvement (or not) in people’s awareness of cybersecurity. The small amount of results from the attack with pens did not allow for an analysis that could evaluate the academic community. The analysis and comparison of the phishing results made it possible to assess some of the risky behaviours by different members of the university and allowed a better adequacy of training in cybersecurity. The comparison between both campaigns showed a relevant vulnerability in all groups, in both attacks, e.g., more than 50% of malicious links clicked. Another relevant factor identified was the age factor in the students, with younger students being more vulnerable to this attack, identified as students of technical courses and 1st cycle (generally, ages between 18 and 21 years old). Overall, it was concluded that training needs to be improved in order to reduce these vulnerabilities.
Cybersecurity is being used more and more with the development and integration of technology in people’s daily lives, whether for work or personal life. In the context of Cybersecurity, Social Engineering is one of the most used types of attack, with attackers taking advantage of user vulnerabilities to succeed. Phishing is the most common method of social engineering, it aims to collect information from victims. Another attack method used is malicious USB devices, which contain malware with the aim of spreading it and/or damaging the devices. Considering the use of these attacks, it is relevant to know how vulnerable people really are, if there are factors that affect the perception of attacks, and if providing resources to educate people is significant for increasing knowledge. It is important for users to learn how to recognize and what to do in situations of phishing and USB devices from unknown sources. This knowledge is transmitted through awareness campaigns and enables data protection at work and in personal life. The project, presented here, aims to educate members a academic community about social engineering (focusing on phishing and malicious pens), through an awareness campaign. To verify the effectiveness of the campaign, simulated attacks were made before and after the campaign, and through the results of both atacks and their comparision, seek to identify the degree of improvement (or not) in people’s awareness of cybersecurity. The small amount of results from the attack with pens did not allow for an analysis that could evaluate the academic community. The analysis and comparison of the phishing results made it possible to assess some of the risky behaviours by different members of the university and allowed a better adequacy of training in cybersecurity. The comparison between both campaigns showed a relevant vulnerability in all groups, in both attacks, e.g., more than 50% of malicious links clicked. Another relevant factor identified was the age factor in the students, with younger students being more vulnerable to this attack, identified as students of technical courses and 1st cycle (generally, ages between 18 and 21 years old). Overall, it was concluded that training needs to be improved in order to reduce these vulnerabilities.
Description
Keywords
Engenharia social Consciencialização Social engineering Awareness Phishing USB Engenharia Informática . Faculdade de Ciências Exatas e da Engenharia