Social Engineering

Typically the social engineers have a goal and a reason to attack their victims. Most of the time their goal is to defraud funds. Others may do it simply for revenge or for entertainment purposes. Regardless of their objective, social engineering is unethical and can lead to serious consequences.

Unfortunately, far two many organizations are unaware and unprepared to deal with the impact of the cyber-threat. With this in mine, security awareness training is economical and obvious choice for organization of all sizes. Many companies invest heavily in cyber security education programs for all employees to learn how to protect their computers and personal information and how to be aware of the cyber criminals that sour the Web in search of targets and vulnerabilities. For the most part the training should include educating users on security concepts such as be conversant with social engineering attacks, malware attacks, what to post on face book, twitter, LinkedIn , phishing tactics and other type of threat that are encountered in the work place (http;//net security. about.com) security

As such, our company’s people resources pose the greatest risk for security breach. Our way to help mitigate risk in this area is to keep communication lines open in this area and to continually mandate security knowledge training, with mandatory updates on a regular basis. When the employees are informed of company policy when facing a security matter, they are better equipped to act in the best or right way. In this way knowledge is power – or at least empowerment to act in the best interest of the company’s information security.

The data breaches at Target, Home Depot are reminders to CIOs of how deadly social engineering can be. CIO’s and CSO’s realize the dangers of security problems on a massive scale. These are some deliberate security breaches that happen when an employee shares a password or loses a mobile device. An employee might access a website at work that loads malware onto his PC, which then spreads throughout the corporate network. In other cases, security breaches occur when a disgruntled employee leaves the company and takes with him valuable intellectual property that belongs to the company.

Social engineering is a type of psychological attack where an attacker misleads you into doing something they want you to do. Social engineering is used every day by everyday people in everyday situations. A child trying to get her way in the candy aisle or an employee looking for a raise is using social engineering. Unfortunately, it is also present when criminals, con men, and the like trick people into giving away information that makes them vulnerable to crimes. Like any tool, social engineering is not good or evil, but simply a tool that has many different uses. Social engineering is lying to people to get information. Social engineering is being a good actor. Social engineering is knowing how to get stuff for free. Combining all these

Over the last few years the amount of security breaches that have been reported have had one factor that has been prevalent in majority of the attacks. That factor is the employee’s and how they are manipulated into giving the intruder/hacker exactly what they needed without realizing it. The use of social engineering in data breaches and fraud has been steadily increasing over the years. Confidentiality, integrity, and availability the three components of the CIA triad in network security can all be compromised by the risk of social engineering.

4. Security Awareness: A large percentage of successful attacks do not necessarily exploit technical vulnerabilities. Instead they rely on social engineering and people’s willingness to trust others. There are two extremes: either employees in an organization totally mistrust each other to such an extent that the sharing of data or information is nil; or, at the other end of the scale, you have total trust between all employees. In organizations neither approach is desirable. There has to be an element of trust throughout an organization but checks and balances are just as

Social engineering is a way of manipulating people so that they can provide their personal information to the cyber criminals. These criminals try to trick the individuals to try to get their passwords and bank information or gain access over to that individual’s computer. Criminals think that it is easier to fool someone to give them their password then try to hack their password. Basically they target those people who don’t have any idea that their information can be misused by these criminals so they just give all of their information. These criminals gain trust of those people before they get those people’s information for their own benefit. Social engineering is one of the biggest problem that people should be more aware of so they can

Ans: Social engineering is the art of gaining access to buildings, systems or data by exploiting human psychology, rather than by breaking in or using hacking techniques. The types of information these criminals are seeking can vary, but when individuals are targeted the criminals are usually trying to trick you into giving them your passwords or bank information, or access your computer to secretly install malicious software–that will give them access to your passwords and bank information as well as giving them control over your computer.

Social engineering is a tactic used by fraudsters to gain sensitive information on individuals. Through various tactics information will be collected and combined together to obtain full names, account numbers, addresses, social security numbers, and dates of birth for prospective prospects. The techniques can be used separately or together and can provide sufficient personal information to fraudsters and aid them in many types of activity. As technology improves the various types of social engineering quickly change and adapt to different security systems. The most popular types of social engineering include phishing, vishing, and smishing. Through these activities fraudsters are able to obtain pieces of information through emails, text messages,

Social Engineering – this is an attempt by an outside force to gain the trust of an employee to let them in the system.

The Art of Deception is an in depth look at the vulnerability that the common man has to the social engineer. Mitnick’s perspective comes from a social angle instead of a technological one, seeing as he is known as the greatest hacker all over media and most of his methods weren’t technologically inclined but socially. A quick look into Mitnick’s background, he was an only child who had a knack for understanding the Nitti Gritty of technology. As a child, he managed to ‘hack’ the bus system in Los Angeles and travel for free, exploited telephone networks as a teen and in college, infiltrated their network and was later hired because it was either that or expulsion. These are just a few of his many hacking exhibitions. He has served jail time because he realised what he did was wrong and is now helping companies avoid similar exploitations through his security company, public talks and through his books.

The keys to prevention and detection of social engineering attacks should be included in the organizations security policy. Social engineering attacks require the same approach and security posture as another type of attacks on an organizations information and data. The organization must identify its assets, turn up span mail features, clarify the line between work and personal, develop effective access management, and conduct training and awareness of

Implement a security training program for IT employees and any employee manipulating customer sensitive data

While it is unknown how the customer complaint supervisor’s email address was collected by the attacker, it would be prudent to elevate possible avenues of information leakage in light of the recent intrusion. One avenue of intrusion is the phone; therefore the company should consider limiting phone-based social engineering exposure by establishing a release procedure with clients such as a code phrase exchange (a question and answer agreed upon by the client for information release to them) or some other procedures in the event of a problem confirming the clients immediate need of any given information (Kee, 2008). If possible, secure keyed phones may be an option such as those used by the government or military as well which will ensure the parties are privileged to that information immediately.