Suggestions
to counter social engineering attacks focus mainly on
security policies and staff training (Mitnick and Simon, 2002;
Gartner Inc, 2002). Gragg (2003) points out that any education
on social engineering must include psychology and
persuasion in order to understand and counter attacks
security policies and staff training (Mitnick and Simon, 2002;
Gartner Inc, 2002). Gragg (2003) points out that any education
on social engineering must include psychology and
persuasion in order to understand and counter attacks.
Srikwan (2008) recommends cartoons to teach users about
social engineering and phishing. In the light of our discussed
examples, user education might indeed help to counter spearphishing
attacks. Waterholing attacks, however, are hard to
counter even with additional user awareness training and
security policies. One possible approach to counter waterholing
attacks could be to identify the most popular websites
visited by employees to conduct an additional monitoring of
these websites