- Date: 11 April, 2018
Three ways to stay one step ahead of social engineers
70% of hacks start with social engineering. This makes sense when you consider the fact that technological networks are only becoming more secure. This means that humans are more likely to be weakest link. Social engineers know this and readily take advantage of it. They are able to infect IT networks with malware and steal sensitive data. How do you stop these cybercriminals?
Advancements in IT security have made it almost impossible to successfully hack a system without insider information. It's precisely this information that social engineers are looking for. They use many different methods to elicit targeted information regarding an organization from employees, such as striking up a conversation with them at a conference. Social engineers even try to gain information from within the organization itself. For example, they send phishing emails to gain access to the organization.
Three areas of focus
Knowledge is the most effective defense against social engineers. This knowledge spans three different areas. By utilizing all three areas, you can stop social engineers in their tracks.
1 Know the methods social engineers use
What are the manipulation techniques that social engineers use? When are people vulnerable to manipulation? How do they usually approach their targets? You can only outsmart social engineers if you know their methods. You can then apply these general insights to your specific situation within your team and organization.
Social engineers do a lot of preparatory work. They want to know how the organization functions: which teams or team members are responsible for what, what security software do they use, what audits and updates do they carry out, which IT employees do what, and when are they vulnerable? If a social engineer wants to gain physical access to an organization, they try to gain information such as: how long does a visitor pass stay active, how do suppliers gain access, and what time does the concierge have his cigarette break?
2 Change your thinking and response
Human thinking is the result of years of evolution. That's why we now have shortcuts in our brains to help us quickly and accurately assess the safety of a situation. However, there's one problem with this. These shortcuts were formed in the pre-internet age. That means that you're aware of the danger of telling that nice man sitting next to you on the plane about your company's login procedures, or your upcoming birthday party. But this kind of information can be used to penetrate your business network or decipher a password.
By strengthening the weak spots in your human thinking, you can avoid unconsciously leaking information. Potentially risky situations include receiving an email with an overload of information and a conspicuous, persuasive link, or socializing with a person who seems trustworthy and familiar. The first step is to know the social engineer's methods and, over time, your way of thinking, reacting and behaving will change. Trust the knowledge you have. Don't be paranoid, but rather be open. Doing so will actually allow you to more accurately recognize suspicious behavior.
3 Know your risk profile
When are you vulnerable to social engineering? Do you know the inner workings of your organization? Do you have access to confidential information? This is the knowledge social engineers are looking for. By being aware of your risk profile, you can change your behavior. This will make you less likely to fall victim to social engineering.
Social engineers work in a very targeted way. They use profiling. During the preparation phase, they see who they can extract information from and when. If a hack is attempted, it's highly likely that they will have taken advantage of several employees at different moments in time. They then piece together their research to get the information they need.
Knowledge is key
Make sure you know the methods social engineers use, how to respond and when you are vulnerable. Remember that practice makes perfect. Practicing with colleagues and running through simulations helps you to apply your knowledge of social engineering to real life situations. It can help you to recognize and anticipate situations and even turn the tables on social engineers.
Want to know more? Global Knowledge has several training courses on social engineering: