  Social Engineering has emerged as a significant threat in cyber security. In
a dialog based attack, by having enough of a potential victim's personal data
to be convincing, a social engineer impersonates the victim in order to
manipulate the attack's target into revealing sufficient information for
accessing the victim's accounts etc. We utilise the developing understanding of
human information processing in the Information Sciences to characterise the
vulnerability of the target to manipulation and to propose a form of
countermeasure. Our focus is on the possibility of the social engineer being
able to build the victim's profile by, in part, inferring personal attribute
values from statistical information available either informally, from general
knowledge, or, more formally, from some public database. We use an
orthogonalised log linear analysis of data in the form of a contingence table
to develop a measure of how susceptible particular subtables are to
probabilistic inference as the basis for our proposed countermeasure. This is
based on the observation that inference relies on a high degree of
non-uniformity and exploits the orthogonality of the analysis to define the
measure in terms of subspace projections.

Cryptography and Security