Problem of protection information systems from multi-step social engineering attacks is still valid for a long time. However, there are a number of unresolved issues, associated with study in this field. One of them is correctly selection configuration of access rights distribution of the organization's employees to critical documents of the information system. Namely, such a model of distribution of access rights should be chosen, which would help to reduce impact of successful social engineering attacks. To achieve this goal, two different configuration of access rights of users to critical documents of information system were considered in this study. In addition, probabilistic estimates of success multi-step social engineering attack implementation by malefactor were presented. Note that the obtained probabilistic estimates are a hybrid model of a linguistic fuzzy variable due to the parameters included in these estimates. From a theoretical standpoint, the study contributes to the development of fuzzy hybrid computing models. In addition, the results can be applied practically in the design of decision support systems in the information security field. The global applicability of the presented results is seen in the development of information systems diagnostics in terms of security against social engineering attacks.