MODEL FOR ASSESSING CORPORATE ENVIRONMENT VULNERABILITY TO SOCMINT ATTACKS BASED ON GRAPH METRICS ANALYSIS

Abstract

The article develops and experimentally validates a method for the quantitative assessment of corporate environment vulnerability to SOCMINT attacks based on the apparatus of complex network theory. The relevance of the study is driven by the rapid growth in the volume of open data on social platforms, which is increasingly exploited by attackers to passively reconstruct an enterprise's internal organizational structure and prepare highly targeted social engineering attacks. It is shown that traditional information security audit approaches fail to provide a quantitative formalization of the personnel contact network topology, which precludes the targeted identification of structurally vulnerable employees. To address this problem, a two-level graph model of the corporate environment is formalized, combining a weighted internal communication graph of official interactions with a vector of employees’ external open exposure. The use of normalized betweenness centrality is justified for identifying nodes that act as structural “bridges” between departments regardless of their hierarchical rank. On this basis, an integral multiplicative vulnerability index is developed, combining the topological visibility of a node with a coefficient of the functional criticality of its role, by analogy with the classical risk paradigm “probability × consequences”. The experiment confirmed the method’s ability to reveal hidden critical data-leakage nodes. A set of differentiated Counter-SOCMINT recommendations has been formulated regarding the compartmentalization of personnel digital footprints, the decentralization of internal information flows, and the transition to continuous monitoring of the organization’s topological risks.