From BC New Media
Jump to: navigation, search

Social Engineering

From a technological and information security perspective, social engineering refers to the physiological manipulation of people by tricking them into divulging confidential information. This information could be personal, or work related information that should not be made available to the public.

Techniques

Attackers, otherwise known as 'cons' could use any one or more of the following techniques to get the victim to willingly pass of their information.

Phishing

Fairly commonplace, phishing involves the attackers mimicking a reputable business and tricking the user into entering their details. The decoy would be a realistic looking webpage with company logos and other information. Since most ploys are fairly easy to discount as fake (the hackers are most likely not willing to spend the time to make super-realistic looking pages), they rely on sending out the link to the decoy page to as many people as possible. Its for this reason that most email services will detect a single link being sent to millions of users, and then the service will flag the email as spam.

Spear Phishing

Different than regular phishing, spear phishing is targeting a select number of users rather than millions of users at once. Attackers will send a relatively small amount of highly personalized emails to users in an attempt to fool them. This type of attack isn't easy to perform as information about the end user is required to make the attempt look more believable. It's estimated that this type of decoy accounts for 91% of successful attacks.[1]

Quid pro quo

Quid pro quo is Latin for something for something. This ploy works by attackers calling end users individually and pretending to be a representative from a technology support company. They might state that something is wrong with the user's computer, and provide them with instructions on how to fix the "issue". These instructions might actually be malicious in that they make the user run a command or download something that infects their machine.

Preventative Action/Countermeasures

It's important for a company to take preventive action to halt the effects of an attack prior to it even beginning. There are several ways to do this:

  • Educate employees on current security policies.
  • Make it clear which pieces of information are to never leave the "four walls" of the company.
  • Establish a clear protocol of action should something slip through and an attacker make it's way into the system.
  • Verify that employees are aware of who should be contacting them and how they should be doing it. This works to help identify spam emails.

References