SOCIAL ENGINEERING PREVENTION
BE PREPARED. IT COULD HAPPEN TO YOU!
Defend Your Organization:
Build a Culture of Security
SOCIAL ENGINEERING IS DEFINED
AS THE PROCESS OF DECEIVING
PEOPLE INTO GIVING AWAY ACCESS
OR CONFIDENTIAL INFORMATION.
Social engineering is one of the
key ways attackers gain access
to information about your
organization.
Through email, phone, texting and online platforms, social
engineers attempt to manipulate employees to access sensitive
information.
People are often the weakest link in the daily management of
network security.
Dont Be A Victim.
Defend Yourself and Your Company.
Prepare Yourself for a Social Engineering Attack.
Knowledge is power. One way to avoid
unwanted security breaches is to
understand effective methods to defend
against social engineering attacks.
In this guide we look at the following:
Onsite Social Engineering
Remote Social Engineering
Tricks of the Trade
Social Engineers At Work Based on True Stories
Common Social Engineering Techniques
Best Practices to Mitigate Security Risks
REMOTE SOCIAL ENGINEERING:
Cyber attacks performed via the phone, email or
online to employees, suppliers and contractors with
the intent to obtain an organizations confidential
information.
______________________________________________
ONSITE SOCIAL ENGINEERING:
Attacks designed to gain physical access to the
premises obtaining records, files, equipment,
sensitive information and network access.
Social Engineers Are
Launching Attacks
Did You Know? The official looking gentleman with
the tool kit who said he was onsite
to complete system repairs
More than 600,000
Facebook The phone call from IT asking to
verify your employee number
accounts are
compromised
The nice new employee full of
every day questions about the company that
approached you at lunch
Hacktivisim is the
most common The email from management
asking you to click on a link and
major motivation enter your credentials to test the
strength of your network
behind cyber password
attacks
The camera crew outside the front
48% of enterprises gate filming a so-called corporate
commercial
have been victims
of social
engineering All were strategic maneuvers
executed to gain access to sensitive
attacks information.
All were Social Engineers at work.
TRICKS OF THE TRADE
Social Engineers do not care if you are an entry-level employee or the
CEO of an enterprise. These highly trained individuals leverage their
skills to attack all levels within an organization. Using proven methods
and employing new social media and online tactics to gain access to
sensitive information, they can ruin reputations and cost enterprises
millions in clean-up and recovery.
Talks the Talk
A social engineer will take the time to study and learn the corporate
language of an organization. Their use of acronyms for key phrases or
common corporate sayings works to ensure that their credibility
increases with everyone they talk to during the attack.
Playing You Like a Song
After calling in and recording the corporate phone on-hold music, a
social engineer will use this audio to his advantage. Replicating this
hold music validates his story, and increases the odds of a successful
intrusion.
A Good Connection Gone Wrong
Posing as a potential business contact on LinkedIn, a social engineer will use
the social media platform to send you email that may contain malicious links
or instructions.
Spoofing a Phone Number
Spoofing is the practice of altering the phone number appearing on the
caller ID to trick the person receiving the call. Social Engineers can now
pretend to be whomever they want an internal staff member, trusted
vendor, or a representative of an official sounding organization.
Social Engineers at Work -
Based on a True Story
A social engineer looking to cause harm to a cable
company because he did not agree with the companys
late payment policy, strategically placed five USB drives
throughout the parking garage and grounds of the
corporate headquarters. Each USB drive was titled
2013 Bonuses. Unsuspecting employees fell prey to
the ruse by picking up the drives and connecting the
USB to their corporate device. The USB drives were
loaded with malware which wrecked havoc on the
companys corporate network.
The breach took down the entire corporate network for
a day thus affecting customers access to the
companys external website, personal account
information, and the ability to process payments. The
recovery costs to resolve the breach, paired with the
corporate website down time, cost the organization over
US$3 million dollars.
35% of incidents
involved a
negligent employee
-2013 Cost of a Data Breach Study: Global Analysis, Ponemon Institute Study, May 2013
Social Engineers at Work
Based on a True Story
Jane received a call from a social engineer posing as a
manger in the Corporate Communications Department,
successfully obtaining her employee number. The social
engineer then called HR exploiting this knowledge to access
her cost center identifier. The employee and cost center
intelligence was leveraged to acquire the companys internal
phone and email directory.
The social engineer then conducted a phishing expedition
whereby he crafted an e-mail appearing to be from the VP of
Technology and sent the correspondence to 100 random
employees. The email asked that each recipient click the
embedded link to test the strength of their network password.
Taking advantage of the employees natural inclination to
respect and respond to senior management, 95% of the
targeted employees did as instructed, providing the social
engineer with an entry to the corporate network and access to
50,000 customer records.
In this scenario, one breach costs the company targeted by the
attacker millions in damages.
Common Social
Engineering Techniques
Social Media Stalking
Social platforms like Facebook, LinkedIn and Twitter are a treasure
trove of personal and corporate information. Using these sites, a social
engineer can gain knowledge that can be used to plan and launch an
attack against an individual or an entire company.
Utilizing Tech Talk
To appear credible and intimidate, a social engineer may use technical
jargon to prey on his victims lack of technical knowledge, literally tricking
them into divulging sensitive information that provides easy access to the
equipment or network.
Piggybacking
Following closely behind a legitimate or authorized employee to gain
physical entry into a restricted area or pass a security checkpoint. (also
referred to as tailgating).
Phishing
Crafting emails that appear to be from an internal source requesting the
recipient take action by clicking on a link that subsequently introduces
malware into the organization.
Tips & Tactics:
Defend Against Social Engineering Attacks
Be friendly, but cautious. A Remember, social engineers
social engineer preys on a use social media sites to gain
persons willingness to help inside knowledge. Be careful
others. what you post online about
your work practices.
Be suspicious of emails
asking you to verify your Out of office messages can
account. be used for reconnaissance.
Limit what you disclose.
Do not leave your computer Be suspicious of unsolicited
unlocked. phone calls asking about
Be leery of website employees or other internal
addresses with misspelled information
words. Dispose of documents with
sensitive data by shredding
Type the website address material according to
into your browser to view vs. corporate policy.
clicking on a link shared via
social media or email Avoid completing online
forms that ask for personal
Get to know your co- information.
workers and clients and
beware of impersonators. Be wary of alarmist email
messages with urgent
Validate the credentials of requests.
those requesting access to
sensitive areas or
information.
When leaving for the day,
dont forget to lock up
sensitive data.
Knowledge is Power
SecurED Threats to your information
security can come in many
A security awareness forms. Unaware employees,
education program from poor design of your network
Digital Defense, Inc. architecture or lack of
(DDI), that combines physical site security can
serious security expertise lead to malicious attacks
with fun, engaging and breaches.
characters to deliver
Effective security
memorable messages
awareness training for your
that employees can
employees and clients can
access anytime,
anywhere, from virtually
improve your overall
any device. security posture, and could
be the most important
investment you make this
Emmy award-winning
year.
comedy sketch writer
DDIs Security Awareness
Hollywood talent Education program,
SecurED helps
Fun & Engaging organizations provide
relevant, entertaining, web-
Convenient based training that helps to
establish a culture of
security.
Cost-Effective
Training That Sticks
LEARN MORE
ABOUT
SecurED
References & Resources
Information and research for this study were collected from a
number of different sources including the following
[Link]
[Link]
[Link]
[Link]
east
[Link]
east
[Link]
[Link]/now/en/pu/images/Promotions/2012/cybercrimeReport/2012_Norton_Cybercrime_Report_Master_FI
NAL_050912.pdf
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
Learn More About
Digital Defense, Inc.
Managed SaaS Solutions
On-Demand SaaS Solution
Security Risk Assessments
Security Awareness Education
Decisive Security Intelligence
Digital Defense, Inc.
9000 Tesoro Drive, Suite 100
San Antonio, TX 78217
888.273.1412
[Link]