Social Engineering Attacks Fall Under Two Main Categories

This case study, written in 2009 is not the only case where a major data breach has occurred within organizations. In the late 2011 Sony’s PlayStation Network (PSN) was breached impacting up to 77 million user’s accounts including data on names, address and possibly credit card details. In late 2013 Target had a cyber-attack that compromised a large quantity of its data and had 110 million accounts compromised. Finally in September 2014 Apple had their iCloud server breached by hacking that compromised all the users of the online server. These occurrences still have some unanswered questions and several experts have yet to decipher the actual reason as to why the security breach occurred.

Dhamija, R., Tygar, J. D., & Hearst, M. (2006, April). Why phishing works. InProceedings of the SIGCHI conference on Human Factors in computing systems (pp. 581-590). ACM.

It is recommended that we conduct a test that would simulate that breach. The test results should be anonymous as the goal of the test is to improve the company's security posture in a way that improves the entire company's security. After the test is complete, the results should be used to assist in designing training for employees on understanding and dealing with potential social engineering attacks. After developing the training, new policies and procedures should be disseminated, then the training can include understanding and reviewing the new policies and procedures. After the training is completed another test should be done to measure engagement and effectiveness of the social engineering training. This information should be used to improve training. The goal of the training would be to empower employees with situational awareness skills that would assist them in identifying potential social engineering attempts and how to respond

The data breaches at Target, Home Depot are reminders to CIOs of how deadly social engineering can be. CIO’s and CSO’s realize the dangers of security problems on a massive scale. These are some deliberate security breaches that happen when an employee shares a password or loses a mobile device. An employee might access a website at work that loads malware onto his PC, which then spreads throughout the corporate network. In other cases, security breaches occur when a disgruntled employee leaves the company and takes with him valuable intellectual property that belongs to the company.

Impersonation – This is the practice of pretending to be another person with the goal

Social Engineering has become a career for modern day cyber criminals. Thieves are waiting to prey on the vulnerable, and naïve. The situations, as devastating as they are to the victims, are very real. In some cases, unfortunately, the cybercrimes are life-altering and irreparable. This paper will highlight four real-life cases where social engineering techniques were used to obtain personal and corporate information.

The worse attack on the United States computer network took place in 2008. The Deputy of Secretary of Defense, William J. Lynn III, described the event as a “network administrator’s worst fear: a rouge program operating silently, poised to deliver operational plans into the hands of an unknown adversary” (Lynn, 2010). The common thought that comes to mind when we think of an attack on a network infrastructure is that the attack is a complex attack coordinated by some “black hat ” hacker/cracker that had to decipher lines of code and encrypted algorithm to penetrate the United States network infrastructure. However, the most common attack and the most devastating attack to infect the United States network was a simple social engineering attack.

Social Engineering is the hardest form of attack to defend against because it cannot be defended with hardware or software alone.

The act of tricking individuals into divulging their sensitive information and using it for malicious purposes is not new. Social engineering attacks have occurred on the internet throughout its existence. Before widespread use of the internet, criminals used the telephone to pose as a trusted agent to acquire information. The term “phishing” has origins in the mid-1990s, when it was used to describe the acquisition of internet service provider (ISP) account information. However, today the term has evolved to encompass a variety of attacks that target personal information.

The Art of Deception is an in depth look at the vulnerability that the common man has to the social engineer. Mitnick’s perspective comes from a social angle instead of a technological one, seeing as he is known as the greatest hacker all over media and most of his methods weren’t technologically inclined but socially. A quick look into Mitnick’s background, he was an only child who had a knack for understanding the Nitti Gritty of technology. As a child, he managed to ‘hack’ the bus system in Los Angeles and travel for free, exploited telephone networks as a teen and in college, infiltrated their network and was later hired because it was either that or expulsion. These are just a few of his many hacking exhibitions. He has served jail time because he realised what he did was wrong and is now helping companies avoid similar exploitations through his security company, public talks and through his books.

The keys to prevention and detection of social engineering attacks should be included in the organizations security policy. Social engineering attacks require the same approach and security posture as another type of attacks on an organizations information and data. The organization must identify its assets, turn up span mail features, clarify the line between work and personal, develop effective access management, and conduct training and awareness of

All employees will be required to take a social engineering course and the HR department will document the entire employee training regardless of their position in the company. The company will also provide email training on how to determine if someone is trying to use social engineering on the employee to gain information they should not have. During the training the company procedures and policy will address what can happen when these policies are violated. The company could consider using honey spot server, which would have a fake email server and other application server, in which a hacker will think they are on the live systems, but will really be on a fake systems and have alarms setup to inform the IT staff of any intrusion. To prevent spoofing, the IT staff can set up email authentication using signed and secure email message format. This encryption method will allow the sender encrypt the message with the receiver public key. The receiver will use the sender public key to verify the message and use his or her own private key to decrypt the

This paper will be on the book The Art of Deception by Kevin Mitnick. I will be exclusively summarizing Chapter 3: The Direct Attack: Just Asking for It. First, for a slight background on the author Kevin Mitnick, he is known for being the most famous hacker ever. He used dumpster diving and social engineering to get information from some of the largest companies and he would use passwords and codes to gain access. He has been arrested multiple times the most famous in 1995 after a well-publicized pursuit, where he was arrested in North Carolina for computer hacking and wire fraud. He wrote the book The Art of Deception to show real life examples of how social engineering can be used with hacking, and also how the hacking can be

It is the manipulation of people through deception, lies, fabricated story and tricks. They influence and persuade people to obtain information with or without the use of technology. Social engineering is a powerful tool used by cyber criminals’ especially on seniors because of their level of trust.

Social Engineering is a method for getting data by trickiness. Programmers are very much aware that individuals are the weakest connection in any Information Technology (IT) security or IT confirmation program. They trap clients into uncovering data of interest and inspire clients to perform errands that may bring about mischief to their association. The social engineering assault may be separated into two separate entities; the physical entity and mental/mind entity. The Physical entity gathers data by going to a work location utilizing phone calls, online talk, or email contact. Programmers then utilize this data against the association amid the mind/mental entity. Statements of power, a characteristic propensity to be useful, loving and