By Jordan Neal, IT Security Engineer at Aureon
In the digital age, where technology influences every aspect of our lives, the threats posed by cybercriminals have escalated. Social engineering is a technique that cybercriminals use to gain information from their targets and involves psychological manipulation. The goal is to get the target to reveal specific information or perform a particular action by using emotions such as fear, greed, curiosity, helpfulness, and urgency to manipulate the target.
Types of Social Engineering
The common types of social engineering are phishing and ransomware attacks. Phishing is a method used for acquiring sensitive data, such as bank account numbers. The perpetrator masquerades as a legitimate business or reputable person to gain this information. Phishing could be used in these forms:
- Angler phishing – the threat actor spoofs a corporate social media account.
- Spear phishing – the threat actor targets specific organizations or individuals.
- Smishing – phishing using text messages.
- Vishing – phishing using phone calls.
- Whaling – phishing attack when targeting high-profile employees such as the CEO or CFO.
The other most common type of social engineering is ransomware attacks. Ransomware attacks have gained notoriety for their destructive impact on both individuals and organizations. These attacks involve encrypting victims’ data and demanding a ransom payment in exchange for the decryption key. Ransomware can cripple businesses, compromise personal data, and cause irreparable harm. The most common types of ransomware attacks to protect against are:
- Scareware – Scaring users into thinking that their device has been infected with a virus and encourages the person to download a program to fix it.
- Ransomware – Encrypting users’ or an organization’s files. It holds the files hostage, until the user pays a ransom.
- Baiting – Deceiving a person with a promise that appeals to their curiosity or greed.
- Diversion Theft – A technique that tricks the user into sending their data or credentials to the wrong person.
- Pretexting – Pretending to be someone or something they are not; an example is someone pretending to be the IRS and introducing a threat of legal consequences for not cooperating.
- Tailgating/piggybacking – Targeting an individual who can give a criminal physical access to a secure building or area. These scams are often successful due to a victim’s misguided courtesy, such as opening a door for an unfamiliar person.
- Water-holing – An advanced social engineering technique to infect a website and its visitors with malware. The infection spreads through a website specific to the victims’ industry.
How To Identify Attacks and Protect Yourself
The best way to identify a threat is recognizing the red flags of these attacks. Things such as unknown phone number, unusual requests, an uncommon sense of urgency, aggressive or coercive demands, unexpected files or file types, accounts that have no common associations or interests, offers that are too good to be true, and poor spelling, grammar, or broken English.
Protect yourself and your organization by not posting sensitive information that could be easily accessible to the public. Information such as work schedules, physical location, conversations, pictures of employees, non-published phone numbers, or user credentials. These bad actors can use this information to earn trust with their target and break down the walls of doubt.
Ask questions to clarify. Does the request seem off? Is the person who they say they are? Double check phone numbers, account numbers, and routing numbers. Other best practices are taking extra measures to enable multifactor authentication, use geofencing, use strong passwords, and keep SSL certificates up to date.
How To Recover from Social Engineering
The best way to recover from the effects of social engineering is preparing a recovery plan if an attack occurs. The best way to do this is to make sure your organization has a corporate incident response plan and follow the procedures if an attack happens. Begin collecting and documenting evidence to report to law enforcement. Notify insurance carriers and any affected parties, if applicable. Do not make any attempts to cover up or provide any banking information to pay the ransom.
Aureon is Here to Help Understanding the techniques employed by social engineering and adopting effective prevention strategies are essential steps towards safeguarding sensitive information. If you want help verifying or vetting your processes, security posture, or assistance with implementing security tools for your organization, visit us at www.Aureon.com or call 800-469-4000.