The human element has always been the easiest loophole to exploit in a digital world, in itself, social engineering is not a cyber attack but the art of persuasion, a psychological manipulation that either start by gaining the trust or uses threat to force a victim into taking malicious actions.
What is Social Engineering?
There are different definitions as to what exactly social engineering is all about, but in the context of information or cyber security, below are some definition and insight from industry renowned solution providers.
Kasspersky, a very popular security solution provider defined social engineering as “… a manipulation technique that exploits human error to gain private information, access, or valuables.”
While IBM, a renowned IT solution provider ranging from software based security solution to hardware infrastructure explains social engineering as a method used to “…manipulates people into sharing information they shouldn’t share, downloading software they shouldn’t download, visiting websites they shouldn’t visit” as well as “…making other mistakes that compromise their personal or organisational assets or security.”
How Social Engineering Works
We as Humans, have certain traits that are similar and predictable, as such, bad actors capitalise on this behaviour to get sensitive information and gain unauthorised access to individual and company’s systems and infrastructures.
This traits include Greed, Fear and urgency, Trust, curiosity, lack of awareness, Impersonation of people in authority, Human error.
Greed: Human (most of us), are forever in want of more, and when an advert online shows the opportunity to gain a certain monetary value without cost or win the latest gadget with any labour, people tend to jump into it most of the time without checking it’s legitimacy, as a result they get compromised.
Fear and Urgency: This is probably the most used method, humans don’t like loosing, so when a message or email comes in warning of an imminent loss and the need to act with urgency, people fall for this trick without verifying.
E.g An email seemingly coming from your bank, asking you to visit link and carry out certain action else you lose you funds after a certain period.
Trust: Humans are trusting, and easily so, this can been exploited a lot of times to gain unauthorised access, This is because the victim hardly suspect the motive of the trustee until after he/she has been breached.
An example is a stranger asking for access to your person device to carry out a seemingly urgent and pressing need while having an ulterior motive
Curiosity: Curiosity they say kills the cat, Sometimes people do have a certain level of knowledge of cyber security but fall victim due to curiosity, this could be as a result of how convincing the message or the social engineering trick is crafted.
Impersonation of people in authority: Some people have genuine respect for by people for individuals in position or terrified by them, as such any information or instruction coming from them should be acted upon
Lack of awareness: The need for continuous education about measures to put in place in respect to cybersecurity can not be over emphasised, Individuals who are not aware of the techniques above tend to fall as victim.
Some Examples of Social Engineering Techniques
Phishing: This is probably the highest utilised method by cyber criminal, this is when receive a mail or text message claiming to be from a legitimate source and requesting a user to carry out an action that eventually compromise the user.
Pretexting: This is when an individual create a fake scenario just to get access to your sensitive information or data or even device. e.g A stranger asking you for access to your social media account as he/she is trying to recover his or her lost account.
Baiting: This is another common type of social engineering that people fall into, this is because it offers things that are enticing are sometimes irresistible to the victim who is ignorant of this schemes.
Spear Phishing: This a type of phishing attack that is tailored towards a particular target for maximum impact, a lot of effort is put into it to make it look like it’s coming from the legitimate source.
Vishing: As opposed to phishing emails, a victim is contacted via a phone call, seemingly from a legitimate source. The aim to convince the user into revealing sensitive information or carring out an action that ends up compromising the victim.
How to protect yourself from social engineering
-
- Awareness and Education: The fact this is the first on the list isn’t a coincidence, it is crucial for individuals and organisation to learn and educate others on how recognise social engineering indicators and the best practice to handle suspicious requests.
-
- Enable Multi-Factor Authentication: Two Factor or 2FA as it’s usually abbreviated is one of the best methods to improve your security posture, this is because you are mandated to authenticate yourself using multiple personal sources before access is granted. This includes an authenticator app, SMS or email.
- Activate Email Filters: Victims of social engineering are contacted via email most of the time, this type of mails are usually flagged by mail service providers hence the need to activate email filters to reduce coming in contact with such emails.
- Incident Response and Reporting: This is very important for organisation, there should be established protocol for reporting suspicious activities. This help mitigate the potential damage.
- Robust Policies and Procedures: Strong security policy should be put in place, which includes strict access control, good password hygiene and regular cyber security training.
- Cybersecurity technologies: Humans are prone to error, putting good cybersecurity technologies in place can serve as a fail-safe, this include firewalls, intrusion detection and prevention system and endpoint protection solutions.
Conclusions
The risks posed by social engineering attacks can be considerably reduced by individuals and organizations by establishing a culture of security awareness and implementing effective security measures.
A&D Forensics offers cybersecurity services to start-ups and established organisation to help secure there digital environment in an increasingly threatened digital space, check them out here.
