literature review

Biometric Authentication as a Solution to Social Engineering

Technology is vital, and it is evident that it is evolving rapidly in the world today. As the world embraces technological changes through social media networks, online-based transactions, and automated engineered processes, there have been everlasting challenges that have continued to impact and handicap the specialized services due to social engineering Many countries use biometric authentication, which plays a crucial role in their businesses. The technology uses identifications such as fingerprints and palm print, among others. When registering the employees, the company must collect their details such as finger and iris print. These templates get added to the database to provide features that resolve the identity. Aldawood & Skinner (2019) argue that a company's biometric system can verify an individual's identity with pre-stored information in their database.

Therefore, biometric authentication is vital to solving social engineering challenges within the organization. Many countries have continued to develop over the years. These countries include the United States of America, Russia, China, and many more. However, numerous challenges continue to incarcerate most people living in these countries, and the challenges emanate from cybersecurity attacks. The paper's focus is to study the use of biometric authentication as the solution to social engineering. The study is divided into the following topics: the overview of social engineering, social engineering's role in cybersecurity, and its effects on organizational data. Cybersecurity and psychological factors leading to cyber theft, hacking, and lastly, the article discusses the preventive measures to mitigate social engineering, including antiviruses, strong passwords creation of awareness to embrace biometric authentication of protecting organizational data.

Literature Review

Biometric Use as Solution and how it Curbs Social Engineering

Biometric is a technology that can measure and evaluate a human being's behavioral characteristics such as voice and signature; it also analyzes biological features such as iris's pattern, palm, and fingerprint (Fianyi & Zia, 2016). These features are stored in the computer and cannot get forgotten or misplaced. Everyone has unique features, and no one has a similar anatomical characteristic like the fingerprint (Fianyi & Zia, 2016). Therefore, it serves as a solution to social engineering by distinguishing individuals based on these characteristics.

Unlike the passwords that one can easily forget, biometric technology does not fail because it stores a person's biological information. It is the most effective method to curb social engineering because criminals cannot steal a person's physical features (Fianyi & Zia, 2016). An excellent example of biometric technology is the phone's fingerprint, which most smartphone operators use to verify identity. The organizations such as banks use biometric to prevent unauthorized individuals from gaining access to sensitive places such as money safes; to access these locations, people must get verified by fingerprint, usually placed at the door. If a criminal wanted to steal from the bank, their access would get denied by the biometric since it only gives access to legitimate employees who are registered. Research shows that biometric technology has reduced criminal activities in the United States have failed to get access to people's data because of biometric technology (Fianyi & Zia, 2016). Biometric technology is vital to prevent social engineers from accessing critical information.

Various studies have been carried out concerning biometric technology in the recent past. Studies reveal that approximately 90% of organizations and learning institutions have already introduced biometric security to protect their data from social engineers and to ease the burden of monitoring their employees (Aldawood & Skinner, 2019). Supermarkets and malls use biometric security to prevent theft by ensuring every item is registered with a security code that must be scanned before exiting. Biometric technology ensures no one steals anything from these organizations; hence, it is a social engineering solution.

Social Engineering

Social engineering is a technique that cybercriminals used to manipulate people to acquire and access confidential information. They do not use coercion to gain this information; instead, they motivate people to share information such as the identification number, phone number, and year of birth to create fake accounts to withdraw money from the bank and carry out criminal activities. Social engineers manipulate people using a non-technical attack to reveal confidential information (Abass, 2018). Cybercriminals attempt to seek confidential information by tricking people to give bank information or password or access people's personal computers without their knowledge to install soft wares that allow them to steal passwords, control the computer, and access bank information.

· Phishing- in this process, the attackers strategically incorporate misleading emails to the targeted users, use of the website by creating adds which the users can be attempted to use, and instant or sending messages with the aim of getting access to the users' accounts and stealing the data ("9 Examples of Social Engineering Attacks | Terranova Security", 2020).

· Lance Phishing- this is a phishing type, but in this process, the attackers use email to complete the attacks against the targeted group of people or the entire organization.

· Tailgating- As the name subject works by befriending an employee or making favors to the targeted employees to pay later. The best type of payment is getting the desired information due to the high level of trust.

· Baiting- In this process, attackers promise the users a reward or prize for giving a certain type of information. This type of social attack is very tempting because people are greedy, desperate for things like money.

· Malware- Casualties are fooled into accepting that malware is introduced on their PC and that they will be taken out if they pay.

· Pretexting- It utilizes bogus character to fool casualties into surrendering data, for example, pretending to be one of the family members who need some information, but in the real sense, they are not.

· Close following- This depends on the trade of data or administration to persuade the casualty to act. For instance, a message can keep on appearing on your site a thousand times, and then the user is feed-up, and in return, he or she accepts the message with a view that it will not create any disturbance anymore.

· Vishing- This refers to pressing phone messages to persuade casualties to act rapidly to shield themselves from capture or other danger. For example, some attackers pretend to be customer providers who need to get some information quickly, and if they do not give the information, they threaten to close their lines or sites.

· Water Holing- this is one of the most serious social assault which contaminates the site and the entire system with malware at a go.

The one consistent idea connecting these social designing methods is the human component. Cybercriminals realize that exploiting human feelings is the ideal approach to take. Generally, organizations have zeroed in on the specialized parts of online protection – however, it's an ideal opportunity to adopt a people-driven strategy to network safety mindfulness. Studies suggest that cyber insecurity will continue to rise if strength measures fail to get implemented. The following human emotions make humans venerable and encourage the success of attacks.

Fear

In most situations, attackers use our common situation to install fear in humans; for instance, you get a voice message that says you're under scrutiny for charge tax fraud and that you should call quickly to forestall capture and criminal examination. This social designing assault occurs mostly during the tax pay season when individuals are worried over their duties. Cybercriminals go after the pressure and nervousness that accompanies documenting charges and utilize these dread feelings to fool individuals into agreeing to their conning voice message. This is one of the most efficient ways of conning people which the cyber attackers use.

Covetousness or greed

Suppose you could basically move $10 to a speculator and see it change or grow to $10,000 with no exertion for your benefit? Cybercriminals utilize the real human feelings of trust and avarice to persuade casualties that they truly can get something in vain. A deliberately phrased bedeviling email advises casualties to give their financial data, and the assets will be moved immediately.

Interest and curiosity

As the saying says, curiosity kills the cat the Cybercriminals focus on functions catching a ton of information, including curious people, and afterward exploit human interest to fool social designing casualties into acting. For instance, after the second Boeing plane crash accident, cybercriminals sent messages which connections that professed to incorporate spilled information about the accident. Actually, their main target was to introduce a rendition of the worms on users' PC. This worked perfectly well because people are curious.

Supportiveness and helpfulness

Naturally, People need to trust and help each other on different occasions because they think their time will come when they need to be helped. In the wake of examining an organization, cybercriminals target a few workers in the organization with an email that seems as though it originates from the administrator. The email requests that they send the supervisor the secret key for the bookkeeping information base – focusing on that the chief requirements for the information are to ensure everybody gets paid on schedule. The email tone is dire, fooling the casualties into accepting that they are assisting their chief by acting quickly. Such messing is very convincing, and many people can be encountered such a dilemma in their workplace.

Urgency

Most of the attackers use an urgent tune to convince users. For instance, in this case, you get an email from client service that you entrust and often purchase and informs you that they need master card conformation in order to record the purchase. The language used in such email requires you to react faster to ensure that hoodlums don't take your Visa data. Without reconsidering because you mostly use the online store, you will defiantly send all card information required also you may find yourself disclosing other personal information like email and phone numbers which they can easily use to get the passwords. A couple of weeks after the encounter you may get a call from the bank department informing you that a lot of dollars have been withdrawn from your account to purchase deceitful goods. This kind of awareness, when created people they can have some guide on how attackers use emotional venerability to ground people.

Role of social engineering on cyber insecurity

Social engineering has numerous impacts on people's daily lives, also leads to cyber insecurity. Therefore, social engineers can access information by manipulating people to provide confidential information. According to Abass (2018), research reveals that in 2015, cyber insecurity cases had risen by 95% due to inadequate security systems in most organizations in the United States of America. Organizations should encrypt their network with a virtual private network (VPN). A VPN is a software to ensure the data is not intercepted by cybercriminals while sending it to another destination; thus, it ensures it is safe (Kyeremeh et al., 2019). Comparing the two studies, it is worth noting that cyber insecurity will continue to rise if strength measures fail to get implemented.

Social engineering posits adverse effects such as theft on organizational data. One of the challenges is identity theft. Abass (2019) argues that approximately 90% of internet users daily receive phishing messages and emails from hackers. Identity theft involves information regarding the credit card, unauthorized document access, which can put the organization at risk of theft. Cybercriminals carry out shoulder surfing, which refers to watching over someone's shoulder while operating an electronic device to steal confidential information such as passwords, enabling them to access bank accounts. According to a survey, 95% of the United States attacks in most business organizations are due to social engineering (Abass, 2018). Social engineers' most common stealing methods from organizations are phishing emails and online advertisements on social media. Phishing refers to a criminal's act of pretending to be recruiting employees and asks for confidential details from people to help them conduct cyber-attacks (Williams & Joinson, 2020).

They also persuade computer users to click specific links and provide sensitive information, enabling them to hijack the system. In most situations, attackers use our typical conditions to instill fear in humans; for instance, you get a voice message that says you're under scrutiny for charge tax fraud and that you should call quickly to forestall capture and criminal examination. This social designing assault occurs mostly during the tax pay season when individuals are worried over their duties. Cybercriminals go after the pressure and nervousness that accompanies documenting charges and utilize these dread feelings to fool individuals into agreeing to their conning voice message. This is the efficient ways of conning people which the cyber attackers use

Research shows that social engineers attacked 60% of Information and Technology companies (IT) in the United States in the year 2016; these attacks continued to increase by 2017, and by 2020 cases of cybersecurity have risen exponentially due to flawed security system in organizations (Kyeremeh et al. 2019), (Williams & Joinson, 2020). Therefore, organizational data is at risk due to the tricks used by social engineers to acquire secretive information.

The lack of knowledge and awareness is why social engineering is growing day by day. There are protection measures that people and organizations need to embrace to improve their data security system's quality. The use of strong passwords will enable organizations to avoid social engineering attacks. People must use two-factor authentication, which is vital to protect the organization from malicious hacks. Social engineers used many media sites such as Facebook, WhatsApp, Instagram, Twitter, emails, and many more. Lastly, it is vital to log out of the accounts when done. Cybercriminals take advantage of cookies. This information's that the website stores from the user's computer to access social media accounts whenever they leave them logged in; these cookies get stored in the browser. (Aldawood & Skinner, 2019). Therefore, it is essential to clear the browser history after using the computer to avoid unnecessary hacks.

Psychological factors as contributors to cyber theft

Psychological factors such as an individual's personality, mostly if they work in a low environment, may compel them to turn into cyber thieves. For instance, if someone is working in a bank and the atmosphere is not conducive, their pay does not equal the work, this may prompt them to hack the systems to steal money. Motivation is crucial in ensuring that people do not turn into hackers, especially those who work in such environments (Bossler & Belenblum, 2019). Therefore, cyber theft emanates from psychological factors such as personality and lack of proper motivation, so it is essential to ensure employees get treated relatively; otherwise, they may turn into thieves.

The research to determine how psychological factors may compel people to embrace cyber theft is growing. Bossler & Belenblum (2019) note that psychological factors, such as stress and burnout, can also lead to cyber theft. Research carried out by cyber theft scholars is considered a vital source of information for every country's policy formulators. Governments should intervene by educating the vulnerable people on the need to stay vigilant; they should also implement laws to ensure cybercriminals get incarcerated to mitigate the levels of cyber thefts (Sarre et al., 2018). Lastly, there is exponential growth in cyber theft, scholars have embraced innovative methods, and their research is making significant impacts, especially in the United States of America.

When the world continues to grow and become more sophisticated due to technology, the reason for hackers getting motivated to access people's personal information and data also increases. According to Alsalim et al. (2017), a hacker is someone who illegally tampers with information in a computer system. Therefore, the definition of hacking is an attempt to exploit a private network or a computer system to achieve an illicit purpose. The common types of hacking are grey, black, and white hat hackers. Hacking leads to damage of digital data because hackers have skills in using computer software.

Preventive Measure against Social Engineering

Use of Passwords

A strong password is one that both human beings and computers cannot easily detect because it has complex characters that include a combination of words, symbols, and letters, making it difficult for social engineers to access. Salahdine & Kaabouch (2019) argue that a strong password must have eight characters or more; that is, it must be long enough. For instance, instead of using "Password1" as the password, instead, use a strong one like "Inerduytr@1". Using a strong password is because most hackers exploit the systems quickly. Strong passwords are crucial to preventing cyber theft; they need to log in first for someone to access the computer. It is also vital to ensure the password remains a secret that means no one should know your password. After all, criminals guess the password.

Therefore, a strong password is recommended. Research has revealed that approximately 1.5 billion people worldwide get scammed every year due to a lack of strong passwords, giving cybercriminals easy access to people's accounts starting in 2015 (Salahdine & Kaabouch, 2019). Federal Bureau of Investigation (FBI) shows that 60% of financial institutions in the United States faces fraud cases from social engineers due to inadequate knowledge of the risk factors; this has increased cybercrimes rates (Norris et al., 2019). The high speed of hackings emanates from creating weak passwords, enabling cybercriminals to have an opportunity to hack.

An antivirus protects a computer from hacks, spam attacks, viruses, and other related threats. A virus is a program designed by cybercriminals and enters the computer system; it spreads and replicates, affecting computer performance, equivalent to a human body virus. The antivirus enables the computer to counter any virus attacks. It is vital to install an antivirus on the computer because it cannot get eliminated in its absence. Antiviruses are developed by social engineers to illegally steal or hack the computer system to acquire information (Bendovschi, 2015). Researchers argue that it is crucial to verify the security systems to ensure that the antivirus is operating to protect the computer from malicious hackers (Safarkhanlou et al., 2015). Research conducted by Safarkhanlou et al. (2015) note that antivirus applications such as Kaspersky and Avira are essential in curbing virus infection in computers. These applications are used by approximately 20 billion people all over the world. Therefore, to avoid malicious attacks from cyber thieves, every individual or organization needs to install antivirus applications on their computers.

Why Passwords and Antiviruses are not a Solution

People use similar passwords in almost all the online platforms, making it easy for the attackers to access because one disclosure will mean losing all personal information. Numerous online users do not change default passwords; this implies that attackers can quickly access personal data through these passwords. More so, default passwords are freely accessible from all available manuals; additionally, they are pretty simple to figure. Passwords are regularly shared among employees who work in standard organizations (Salahdine & Kaabouch, 2019).

Social engineers use a perpetual scope of strategies. They use persuading messages on the websites to approach individuals to share their usernames to compromise their antivirus security. Most attacks are not virus-based, which makes antiviruses impractical in curbing such attacks. (Safarkhanlou et al., 2015). Antiviruses fail to offer individuals full protection from social engineer's attacks.

The password cracking system has advanced the use of similar passwords for a long time makes it easy for hackers to gees the passwords. Secret key breaking instruments are getting great at speculating passwords due to technological advancement. The innovative advances inside this zone go super quick – it is merely a question of time before passwords are viewed as substantial to getting access. Individuals regularly utilize too weak passwords (Salahdine & Kaabouch, 2019). This can even make it workable for individuals to figure the secret word without the guide.

Antiviruses are effortlessly taken through social designing. A shockingly level of individuals share their login data. Passwords are sent over unstable websites, for instance, the use of an unprotected network, which makes it simple to get the passwords sent through the same means. Associations' secret word information bases get hacked substantially more frequently, and employees do not figure it out. Much of the time, the programmer assault never gets detected, or it takes a long to be noted. It implies that the programmers can utilize the passwords and get the targeted information (Salahdine & Kaabouch, 2019).

Biometric authentication

Biometric authentication is a security cycle that depends on a person's exceptional organic characteristics to check their real identity. Generally, a Biometric authenticator compares the data or the stored information with the captured dater, to affirm the user's credibility. The biometric verification is used to administer both physical and software fraud, for instance, buildings, houses, organizations, rooms, and computer registers (Malathi & Jeberson, 2016).

Biometric authenticators are used by most secret services, for example, the military, to ensure security because it is hard to fake individual biological traits. More so, acknowledging biometric confirmation has been contributed by its convincing character: it is hard to lose data because Thumbprints made on earth seals cannot be used to open or access data on behalf of the owner. A current biometric confirmation has been improved by precise with the appearance of electronic information bases and digitizing all the pieces of information (Malathi & Jeberson, 2016).

Types of biometric authenticators

The retina is the first type of biometric authenticators; it produces a picture of a person's inner vein of the eye using light. Iris examiners are used to identifying users by distinguishing the shape of the pupil of the user's eye. Finger scanning is a computerized adaptation that uses the ideology of ink-and-paper printings, looks at the users' identity by checking the human finger's branches. Finger vein ID: it uses the vascular in a person's body to detect the user, for example, in a person's finger. Facial acknowledgment: it is a framework that works with codes known as face prints that distinguish nodal found in the user's face. Voice recognizable depends on the qualities of the sound made from the state of the speaker's mouth and throat (Malathi & Jeberson, 2016).

· It has High security and assurance. Biometric ensures a high level of confidence; it uses the rightful person by verifying non-duplicable aspects of a person, for example, DNA. A security breach faces other data protection methods because they are readily available or obtained by funders (Malathi & Jeberson, 2016).

· The biometric authenticators make it hard for fraudsters to circumnavigate. Additionally, modern authenticators depend on non-error characters like robots, hard to bribe or pass through if you are not an authorized person. (Malathi & Jeberson, 2016).

· Biometric authenticators are convenient and fast. Malathi & Jeberson (2016) note that the Use biometric authenticators are easy and quick, for instance, placing a finger on the sensor and looking at the scanning device. S More so, forgetting the passwords is a forgone because the primary password is in you, and you have not necessarily remembered it.

· They are Non-transferable. Biometric verification requires its information is available upon approval. You can't move or share a physical biometric carefully – the best way to use most biometric confirmation frameworks is with an actual application

Creating Awareness to Employees

Biometric authentication protects the employer's and employees' information from social engineers. It is vital because it distinguishes real employees from fake ones; the technology gives a person the true identity by storing personal information such as palm print, which uses the palm to verify an individual, making it easy to detect the hackers (Kloppenburg & van der Ploeg, 2018). Since 2008 research has shown that society has become digital, 80% of people use digital technology, thus, increasing the number of cyber-crimes because most users are vulnerable due to inadequate security systems like weak passwords (Kloppenburg & van der Ploeg, 2018).

The employers should educate the employees to ignore unspecified links sent to them and avoid malicious emails from hackers; they should report such to the organization's relevant authorities. Employers should install biometric authentication to mitigate the challenge of cyber theft (Malathi & Jeberson, 2016). The topic is vital because it raises awareness among the employees to embrace biometric authentication to avoid getting hacked.

The technology of biometric authentication security plays a vital role in securing businesses and other large organizations and learning institutions. The Security curbs theft because it includes the iris scanning cameras mounted on walls; they pick unique eye patterns, scan, and store the data to distinguish individuals at the workplace, thus curbing cybercrime (Malathi & Jeberson, 2016). As the world embraces biometric authentication, security posits numerous challenges to people's health and could lead to cancer due to radioactivity. According to Malathi & Jeberson (2016), biometric authentication is harmful to people due to radioactivity. The study notes that those who work in large organizations where biometric technology is used are at a higher risk of contracting cancer due to radioactivity.

Summary

In summary, biometric technology evaluates people's biological features. It is essential in protecting data from social engineers. Social engineering is the act of manipulating people to acquire sensitive information. Social engineers develop attacks and techniques that allow them to penetrate well-protected environments, thus compromising user's data integrity and confidentiality; the damages caused by social engineers most of the time remain untraceable. Most organizations have developed techniques to curb the everlasting cases of hackings due to cyber-attacks. An example of a method is through biometric authentication, which is a process that secures people's data from cybercriminals; this form of security matches the features of an individual to verify who they are as a way of securing their personal information. The paper has discussed how it has resulted in cyber insecurity in the US. An Individual's personality could compel people to become social engineers.

The technology of biometric authentication security plays a vital role in securing businesses and other large organizations and learning institutions. Preventing social engineering requires strong passwords, antiviruses, and awareness for employees to embrace biometric authentication technology. Biometric authenticators are fast and convenient. The reason why passwords are not a solution is because, people use. The study noted that use of antivirus and strong password are essential in securing computers from malicious attacks from the cyber theft. It can also can be used to raise awareness among employees working in various organizations

References

Abass, I. A. M (2018). Social Engineering Threat and defense: A Literature Survey. Journal of Information Security. 9, 257-264. https://doi.org/10.4236/jis.2018.94018.

Alsalom, M., Alsalim, A, M., Al-Madhagi., & Shahen, S, M. (2017). Information Security Threats: Computer Hacking. International Journal of Advanced Research. Vol 5(1), pp. 349-356. http://dx.doi.org/10.21474/IJAR01/2753.

Aldawood & Skinner. (, 2019). Reviewing Cyber Security Social Engineering Training and Awareness Programs—Pitfalls and Ongoing issues. Future Internet. 11(73), pp. 1-17. http://doi:10.3390/fi11030073.

Bossler, A, M., & Beremblum, T. (2019). Introduction: New directions in cybercrime Research. Journal of Crime and Justice. Vol 42, 5, pp.495-499. https://doi.org/10.1080/0735648X.2019.1692426.

Bendovschi, A. (2015. Cyber-Attacks – Trends, Patterns, and Security Countermeasures. Procedia Economics and Finance. Vol 28, pp. 24-31. https://doi.org/10.1016/S2212-5671(15)01077-1.

Fianyi, I., & Zia, T. (2016). Biometric Technology Solutions to Counter Today's Terrorism. International Journal of Cyber Warfare and Terrorism. 6(4). 28-40. https://www.researchgate.net/publication/309818563_Biometric_Technology_Solutions_to_Countering_Today's_Terrorism.

Kumar, A., Chaudhary, M., & Kumar, N. (2015). Social Engineering Threats and Awareness: A Survey. European Journal of Advances in Engineering and Technology, 2(11), 15–19. http://www.ejaet.com/PDF/2-11/EJAET-2-11-15-19.pdf.

Kyeremeh, K., Bright, B., & Mutilda, A. (2019). A Sty into the Social Engineering Risk and Its Effects in the Public Institutions. Electronic Journal. Vol 1, pp. 1-28. https://www.researchgate.net/publication/333981453.

Kloppenburg, S., & van der Ploeg, I. (2018). Securing Identities: Biometric Technologies and the Enactment of Human Bodily Differences. Science as Culture, 1–20. https://doi.org/10.1080/09505431.2018.1519534.

Malathi, R., & Jeberson, R. (2016). An Integrated Approach of Physical Biometric Authentication System. Procedia Computer science. Vol 85, pp. 820-826. https://doi.org/10.1016/j.procs.2016.05.271.

Norris, G., Brookes, A., & Dowell, D. (2019). The Psychology of Internet Fraud Victimisation: a Systematic Review. Journal of Police and Criminal Psychology, 34(3), 231–245. https://doi.org/10.1007/s11896-019-09334-5.

Parsons, D. (2020.). The Impact of Fake News on Company Value: Evidence from The Impact of Fake News on Company Value: Evidence from Tesla and Galena Biopharma Tesla and Galena Biopharma. Retrieved April 25, 2020, from https://trace.tennessee.edu/cgi/viewcontent.cgi?article=3363&context=utk_chanhonoproj.

Safarkanlou, A., Souri, A., Norouzi, M., Hassan, S., & Sadroud, H. (2015). Formalizing and Verification of an Antivirus Protection Service using Model Checking. Procedia Computer Science. Vol 57, pp. 1324-1331. https://doi.org/10.1016/j.procs.2015.07.443.

Salahdine, F., & Kaaabouch, N. (2019). Social Engineering Attacks: A survey. Future Internet. Vol 11(89), pp. 1-17. https://doi.org/10.3390/fi11040089.

Sarre, R., Lau, L. Y.-C., & Chang, L. Y. C. (2018). Responding to cybercrime: current trends. Police Practice and Research, 19(6), 515–518. https://doi.org/10.1080/15614263.2018.1507888.

Williams, E. J., & Joinson, A. N. (2020). Developing a measure of information seeking about phishing. Journal of Cybersecurity, 6(1). https://doi.org/10.1093/cybsec/tyaa001.

The Secure Domain Foundation (2020). Empowering the Internet Community's Fight Against Cybercrime. Securedomain.org. Retrieved November 16, 2020, from https://securedomain.org/.