Social Engineering (An IT Security Threat)

What is Social Engineering?

Social engineering is an IT security threat in which psychological manipulation is used to trick people into divulging information that should not be provided.

And criminals who implement social engineering scams are patient.

They will work slowly to gather all of the data they need, accessing information on a company’s website, as well as on personal and professional social media profiles.

They will even phone a company to surreptitiously gather necessary information.

This information is then used to perpetrate scams that are so well-developed that they seem legitimate.

Social Engineering in Organizational Setting

Social engineering in the organizational setting is used to create more effective spear phishing emails.

Specific people in the organization are targeted (based on the research gathered) to successfully trick recipients into wiring money, releasing password information, or clicking on links that result in ransomware threatening your network.

Why Is Social Engineering So Successful?

By doing a little more homework, cybercriminals are able to craft email messages that elicit an emotional response from the recipient.

Common tactics include:

• Posing as the CEO and expressing displeasure to someone in the finance department in regards to an unpaid invoice. The ensuing fear response over being in trouble with the boss may cause that person to wire money without ensuring that the invoice is real.
• Pretending to be a colleague who desperately needs information to finish a project. The sense of urgency created can cause the recipient to divulge the information without making sure the sender was really who they claimed to be.
• Pretending to be a vendor, coworker, or boss who needs something done quickly that would require opening a file or clicking on a link.

In each case, the success of the attack comes from knowledge.

The criminal knows enough about the sender to make the request seem legitimate while creating a false sense of urgency or fear to cause an immediate response (click the link, send the money, provide the secure information).

There’s No App for Human Error

Security is about trust.

Do you know who you’re communicating with?

Do you know where you’re really sending money or information to when responding to email messages?

Every organization struggles with addressing the one gap in security they can’t patch with software or an app: the human element.

How To Prevent Social Engineering

So how do you help your employees avoid being exploited by social engineering scams?

First, you keep as much of the email from reaching them as possible. Then, you hold employees accountable for having restraint.

1. Implement firewalls and virus protectors as a first-layer solution.
2. Add threat detection and malware detection to sift out more attacks.
3. Use a hosted email solution and email security protocols that keep the worst of the attacks from reaching the recipients.
4. Train your employees (and train them again, and again). Download our email security guide.
5. Establish policies to prevent immediate actions that might compromise security:
   1. Require two people to authorize a wire transfer.
   2. Have strict policies regarding what kind of information can be transmitted by email; require the recipient to verify by phone and provide the information by phone if legitimate, to avoid data loss.
   3. Require stringent employee passwords that are changed regularly.
   4. Limit information access to only essential personnel.
   5. Have offsite data backup and recovery solutions so that if the worst does happen, you can quickly recover and minimize downtime for your customers.
6. Hold employees accountable for breaching policies designed to prevent such attacks from succeeding.

The ITeam is dedicated to helping Calgary- and Alberta-based businesses avoid these sophisticated attacks. We do this by providing essential IT support and customized services designed to meet the needs of your business. The ITeam will work with you to develop a cost-effective and comprehensive flat-rate IT strategy that will help you thrive. Contact us for a free consultation.