[et_pb_section fb_built=”1″ fullwidth=”on” _builder_version=”3.13.1″ background_image=”https://www.mdsny.com/wp-content/uploads/2018/10/square-smb-phishing-1.jpg” background_position=”center_right” background_blend=”darken” custom_padding=”0px|0px|0px|0px”][et_pb_fullwidth_header title=”Social Engineering 101″ text_orientation=”center” background_overlay_color=”rgba(0,0,0,0.42)” title_font_color=”#ffffff” _builder_version=”3.13.1″ title_font=”Droid Serif||||” title_text_color=”#ffffff” title_font_size=”37px” background_color=”rgba(255, 255, 255, 0)” background_layout=”light”][/et_pb_fullwidth_header][/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”3.0.65″ custom_padding=”12px|0px|0px|0px”][et_pb_row make_fullwidth=”on” custom_padding=”27px|1px|0px|2px” _builder_version=”3.0.65″][et_pb_column type=”4_4″ _builder_version=”3.0.65″ parallax=”off” parallax_method=”on”][et_pb_text _builder_version=”3.0.74″ text_font=”Droid Serif||||” text_font_size=”18px”]By Jen Trang Nguyen, MDS
Welcome to our series of blog posts dedicated to Cybersecurity Awareness Month! This month, we will update you with the latest security news, share some tips and tricks as well as a special announcement about our very own Cybersecurity Techxpo on October 23, 2018 here in NYC. Stay tuned!
[/et_pb_text][et_pb_image _builder_version=”3.0.74″ animation_style=”slide” animation_direction=”left” animation_duration=”500ms” animation_intensity_slide=”10%”][/et_pb_image][/et_pb_column][/et_pb_row][/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”3.0.74″ background_color=”#e8e8e8″ custom_padding=”0px|0|15px|0px|false|false”][et_pb_row make_fullwidth=”on” custom_padding=”22px|0px|0px|0px” _builder_version=”3.13.1″][et_pb_column type=”1_2″ _builder_version=”3.0.65″ parallax=”off” parallax_method=”on”][et_pb_text _builder_version=”3.0.74″ text_font=”Droid Serif||||” text_font_size=”18px” inline_fonts=”Droid Serif”]
Social engineering is the art and science of human manipulation to acquire confidential information. Social engineers take advantage of the weakest link in security, humans.
Social engineering has less to do with technical, and more to do with emotional responses. For instance, a technical hacker would look for vulnerabilities in the network or software. A social engineer, on the other hand, would exploit the end user’s tendency to trust and pose as an authoritative or familiar figure in order to obtain the information. Before you know it, you might have given the hacker thousands of dollars, thinking you transfer it to Stacey from Accounting.
[/et_pb_text][/et_pb_column][et_pb_column type=”1_2″ _builder_version=”3.0.65″ parallax=”off” parallax_method=”on”][et_pb_image src=”http://media.cleveland.com/business_impact/photo/11731541-large.jpg” _builder_version=”3.13.1″ max_width=”59%” animation_style=”slide” animation_direction=”left” animation_duration=”500ms” animation_intensity_slide=”10%”][/et_pb_image][/et_pb_column][/et_pb_row][et_pb_row make_fullwidth=”on” custom_padding=”1px|0px|16px|0px|false|false” _builder_version=”3.0.65″][et_pb_column type=”4_4″ _builder_version=”3.0.65″ parallax=”off” parallax_method=”on”][et_pb_text _builder_version=”3.0.74″ text_font=”Droid Serif||||” text_font_size=”18px”]
Given the expansive growth of social engineering and the lack of user awareness today, it is extremely important for businesses to be aware and put security protocols in place to prevent such disasters from happening. But first, we are exploring the types of social engineering attacks that hackers employ.
The types of social engineering attacks
1. Phishing
Aka the most common type of social engineering attack. Imagine going fishing, with the attacker as the fisherman and the end user as the fish. The bait is dangling in front of the end user, waiting for them to take action. Despite its infamy, it remains quite successful.
Typically, the hacker sends an email or a text to an unsuspicious target to seek information. The message would appear to come from a trusted source by the victims, such as a bank or a business partner. The message would prompt the user to click on a link to log into their account. The user would then be taken to a fake website, and if they log in to that website, they effectively hand over their credentials to the attacker.
2. Spear Phishing
If phishing attack users on a large scale, spear phishing is its subset. Similar to phishing by nature, spear phishing employs even more sophisticated information gathering techniques to target a very specific set of users (“spear”). Because the hacker does the due diligent in learning about these users, this attack has a higher success rate than phishing.
3. Vishing
Yet another subset of phishing, but this time with voice instead. Typically, the attacker employs the phone to trick users to hand in information. Attackers can recreate the IVR (Interactive Voice Response) system of a trusted company, attach it to a toll-free number and trick people into responding to the prompts and entering their details.
[/et_pb_text][/et_pb_column][/et_pb_row][et_pb_row _builder_version=”3.13.1″][et_pb_column type=”4_4″ _builder_version=”3.13.1″ parallax=”off” parallax_method=”on”][et_pb_image src=”https://www.social-engineer.com/wp-content/uploads/2017/05/Picture3.png” _builder_version=”3.13.1″ max_width=”47%” module_alignment=”center”][/et_pb_image][/et_pb_column][/et_pb_row][et_pb_row make_fullwidth=”on” custom_padding=”1px|0px|16px|0px|false|false” _builder_version=”3.0.65″][et_pb_column type=”4_4″ _builder_version=”3.0.65″ parallax=”off” parallax_method=”on”][et_pb_text _builder_version=”3.0.74″ text_font=”Droid Serif||||” text_font_size=”18px”]
4. Pretexting
Pretexting is all about storytelling. A lot of us has, at one point, received a sobbing message from a distant friend who is in distraught and in dire need for some money transfer. A lot of us has fallen for that sob story and sent attackers money instead. Attackers impersonate another person that we know, or an authoritative figure, in order to extract information and financial gains from the victims. Probably not a good idea to respond to an email titled “URGENT!!!!!!” seemingly from your CEO, but the email has spelling mistakes.
5. Baiting
Remember the Trojan horse of Troy? Baiting is similar – hiding malicious devices inside a seemingly harmless carrier. For instance, attackers might leave infected USB drives in public with files titled “Bonus” or “Private Information” in hope someone naive will use it on their devices. More recently, these baits can be found on the Internet, disguising as download links.
6. Quid Pro Quo
Disguising the attack as a favor is another method attackers employ. Attackers would pose as technical support, and call up employees to claim that they’re contacting regarding an issue. Would you be more likely to give someone on the phone information about your credentials if they’re Tech Support helping you with productivity?
Quid pro quo also involves an exchange of something with the victim, like gift or money for information.
7. Tailgating
Another type of attack would be taking help of an actual authorized person to access restricted areas. It can be as simple as simply following behind them.
These are the most common types of social engineering attacks. In the next blog post, we will discuss how to prevent yourself against such harm.
Don’t wait until sensitive data is already in the sticky hands of hackers to react to a breach. Stay proactive with MDS and work with us to build out a custom, company-wide security protocol that is effective and easy to maintain.
[/et_pb_text][/et_pb_column][/et_pb_row][/et_pb_section][et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”3.0.74″ background_color=”#8d8c91″ custom_padding=”4px|0px|20px|0px”][et_pb_row make_fullwidth=”on” custom_padding=”10px|0px|27px|0px” admin_label=”row” _builder_version=”3.0.47″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.0.47″ parallax=”off” parallax_method=”on”][et_pb_cta title=”Pulling the plug doesn’t have to be your only security solution.” button_url=”https://www.mdsny.com/contact/” button_text=”Contact Us” _builder_version=”3.0.65″ header_font=”Droid Sans|on|||” header_font_size=”31px” body_font=”Droid Sans||||” body_font_size=”19px” use_background_color=”off” background_size=”initial” background_position=”top_left” background_repeat=”repeat” custom_button=”on” button_text_color=”#2d3743″]Don’t become part of a rising statistic — ensure your company is armed against a security hack.
[/et_pb_cta][/et_pb_column][/et_pb_row][/et_pb_section]