2.4 – Social Engineering - Social Engineering

• Social engineering attacks are constantly evolving to bypass security controls.
• Attackers use multiple communication methods and identities to gain trust and unauthorized access.
• Posing as an angry customer to intimidate someone over the phone is a social engineering technique.
• Some social engineering attacks exploit tragic events (e.g., a death in the organization) to solicit donations with malicious links.

Phishing

• Phishing involves spoofing, where attackers imitate trusted entities to steal information.
• A link may appear to direct to your email system, but is a third party website designed to steal your credentials.
• Attackers can be careless and create phishing attempts with visual cues that indicate a scam.
• Phishing can occur through various media, including phone calls, known as voice phishing or vishing.
• Attackers spoof phone numbers to appear local and request sensitive information under false pretenses (e.g., fake security checks or pretending to be from your bank).

Shoulder Surfing

• Shoulder surfing involves observing someone's screen to obtain private information.
• This can occur in public places like airports or coffee shops.
• It's possible to view someone's screen from a distance using binoculars or telescopes.
• Malware can capture screen information and send it to the attacker.
• Preventative measures include:
  • Being aware of your surroundings.
  • Positioning yourself with your back to the wall.
  • Using privacy filters on your screen.
  • Re-positioning your computer on your desk.
  • Avoiding displaying sensitive information in areas where others can see your screen.

Spear Phishing and Whaling

• Attackers research their targets to identify individuals with access to valuable information.
• Spear phishing is a targeted attack on specific individuals, such as the person in charge of finances.
• Whaling is a type of spear phishing that targets executives with access to extensive private information and company finances.

Tailgating and Piggybacking

• Tailgating is entering a secured area by following someone who has authorized access without proper authorization.
• Piggybacking is when someone requests an authorized person to hold the door open for them.
• Organizations should have policies in place for dealing with visitors and ensuring unauthorized individuals are challenged.
• Security measures like single-person entry doors can prevent tailgating.

Impersonation

• Attackers impersonate individuals to gain access to information.
• Attackers may gather information from the internet, third parties, or even through dumpster diving.
• Impersonators use language and jargon to appear credible or friendly to manipulate the victim into providing information.

Dumpster Diving

• Dumpster diving involves searching through a company's trash to find valuable information.
• Discarded items may include telephone directories, financial details, or project information.
• Organizations should be careful about the information they discard and consider shredding sensitive documents.
• Trash should be disposed of immediately.

Evil Twin

• An evil twin is a rogue wireless access point that mimics a legitimate one.
• Attackers use the same SSIDs and logos as the legitimate network to deceive users.
• A powerful evil twin can overwhelm the legitimate access point, causing users to connect to the malicious network.
• Encryption is important to protect data transmitted over wireless networks, using a VPN encrypts everything that’s being sent, not just HTTPS to a website.