# data[].attributes.body
Speaking broadly, social engineering is taking advantage of human psychology to manipulate individuals or groups into a desired action or outcome.

# data[].attributes.headline
A more in depth introduction from CompTIA:

# data[].attributes.subject
A more in depth introduction from CompTIA:

# data[].attributes.attachment_link.readable_text
It's often noted that humans are the weakest link when it comes to cybersecurity. To exploit that vulnerability, many hackers engage in social engineering to support their cyberattack efforts and obtain valuable information. Social engineers target humans, rather than technology, to gather useful intel.

Hollywood frequently glorifies the savvy con man for his ability to charm and disarm. In the movie "Catch Me If You Can," Leonardo DiCaprio portrays a young Frank Abegnale, a notorious con man, who impersonated airline personnel, a lawyer and various other roles to commit check forgery and fraud. Abegnale later used his talents to become a security consultant.

Social engineering brings the con into the digital age. Instead of using personal interactions to build rapport and charm users into certain actions, social engineering leverages a lack of awareness around digital tools and the willingness to share on digital platforms. The end result is the same: psychological manipulation that leads to handing over sensitive info.

Social Engineering Defined

The term social engineering refers to methods employed by hackers to gain the trust of an end user so that the hacker can obtain information that can be used to access data or systems. Social engineering typically involves impersonating representatives of legitimate organizations to manipulate people into supplying information such as passwords or personal details.

Social engineering can involve phone calls, emails or texts. Sometimes referred to as "human hackers," social engineers employ a variety of methods to convince users to divulge information, often masquerading as tech support or bank employees.

How Does Social Engineering Work?

Hackers develop different tactics to support their social engineering pursuits. Most social engineering attacks follow this path:

1. Research the target. The purpose of social engineering is to convince a user that you represent a trusted institution. Social engineers will often attempt to develop a rapport by offering easily obtainable details, such as birthdate or phone number, as evidence of their legitimacy. Much of this information is publicly available, and social engineers typically scout social media to gather this type of vulnerable data.

2. Make contact with the target. The attacker makes contact directly with the target. Social engineers use the information they've gathered to validate their fake identity. The target is then asked to provide sensitive information the hacker can exploit.

3. Attack. Using the details they have covertly obtained, social engineers launch their attack. This could involve accessing systems using acquired passwords, performing a classic case of stolen identity or putting the information to use for personal or political gain.

History of Social Engineering

Social engineering is a practice that is as old as time. As long as there has been coveted information, there have been people seeking to exploit it.

The term social engineering was first used by Dutch industrialist J.C. Van Marken in 1894. Van Marken suggested that specialists were needed to attend to human challenges in addition to technical ones. In 1911, Edward L. Earp wrote Social Engineer as a way to encourage people to handle social relations similarly to how they approach machineries.

In modern times, social engineering has come to reference the practice of deceiving people to obtain valuable information, which is often followed up by a cyberattack.

Here are some of the most famous cybersecurity social engineering examples.

Target Data Breach

In 2013, more than 110 million customers fell victim to a social engineering attack on Target. Social engineering techniques were used on an HVAC company that had remote access to Target's network. The HVAC company was then compromised with malware, which in turn infected Target's systems. The attack resulted in the loss of emails, names, addresses, phone numbers and credit and debit card information.

Yahoo Security Breaches

In 2013 and 2014, two attacks compromised Yahoo email-user information. The second attack was accomplished via a spear-phishing campaign targeted to a Yahoo engineer. The individual took the bait, giving hackers access to names, email addresses, phone numbers, dates of birth and passwords. This attack also gave hackers the ability to access user accounts without passwords.

CIA Attack

A 15-year-old was able to take control of the secure emails of John Brennan, the director of the CIA. Kane Gamble used social engineering to convince Verizon to provide personal details about Brennan, which he later used to impersonate the CIA director. Gamble was able to access Brennan's email by changing security questions and passwords with gathered intel, allowing the 15-year-old to view sensitive military information.

Types of Social Engineering

Social engineering is a general term that refers to a broad range of manipulation tactics used by hackers to acquire information.

Baiting: Baiting is a social engineering attack where the attacker entices the user with a free item to lure them into clicking on a link. This may come in the form of a free music or movie download lined up with the user's interests. When the unsuspecting user clicks the link, they become infected with malware.

Phishing: Phishing is a type of social engineering attack that uses email, phone or text to entice a user to click on a malicious link. The communication appears to be from a legitimate source connected to the user. When the user selects the ill-intentioned link, the user's device or system becomes infected with malware and data is often compromised.

Pretexting: This tactic is one more commonly associated with the term social engineering. With pretexting, an individual impersonates a representative from a trusted organization with the goal of acquiring sensitive information. This social engineering technique relies heavily on gathering research before initiating contact with the target.

Quid Pro Quo: The quid pro quo attack is a variation of baiting. Often known as the "something for something" social engineering technique, the quid pro quo attack involves promising a service or benefit for complying with the request of an attacker. For example, a social engineer may promise a free software upgrade to entice a user to download what is actually malware to their system.

Reverse Social Engineering: In this kind of social engineering scheme, the attacker convinces a target that they have a problem or issue and then positions themselves with a solution. The target then initiates contact with the social engineer believing that they are able to solve their problem.

Tailgating: This social engineering tactic is a physical attack. With tailgating, a hacker gains access to restricted areas of a building by following an approved employee into the building and piggybacking on their credentials. In these cases, the social engineer often pretends to be an employee or even a delivery person.

Whaling and Spear Phishing: These attacks are a variation of phishing and, because they target a specific individual, they require a significant amount of research. In whaling attacks, these individuals are high-profile people, often executives or the C-suite.

How to Prevent and Protect Against Social Engineering

The best form of prevention against social engineering attacks is end-user training. Teaching your employees how to recognize social engineering tactics and avoid them is of the utmost importance.

Here are some points to help support your training efforts.

Research any suspicious calls, emails or texts.

Open attachments only from trusted sources.

Immediately delete any emails or texts asking for passwords or personally identifiable information (PII), such as social security numbers or financial information.

Don't open any emails promising prizes or notification of winnings.

Download software only from approved sources.

Be wary of urgent requests or solicitations for help.

Make sure you have spam filters and antivirus software on your device.

When in doubt, contact IT to confirm any technology-related requests.

What's the Difference Between Ransomware vs. Malware vs. Social Engineering vs. Phishing?

Ransomware, malware, social engineering and phishing all encompass different forms of ill-intentioned cyberattacks.

Malware is a general term formed by the words "malicious" and "software" that describes different types of software intended to compromise systems, obtain sensitive data or gain unsanctioned access to a network.

Ransomware is a category of malware where attackers use various methods to encrypt your data, making it inaccessible, or bar you from entry to a particular system or device. Attackers then demand a ransom in exchange for reinstating your access.

Social Engineering, by contrast, is a method used to extract sensitive details by way of human manipulation. With social engineering, hackers connect with users while pretending to represent a legitimate organization and seek to ascertain critical information such as account numbers or passwords.

Phishing is a form of social engineering that involves email, phone, text or illegitimate websites. In both instances, the collected information is used to access protected accounts or data.

While our guide acts as an introduction into the threats posed by social engineering, this is by no means an exhaustive list. Social engineering and the cybersecurity world change on a daily basis, and attacks are becoming increasingly sophisticated. The best way to combat cyberattacks is to stay informed about the latest attacks.
Read more about Cybersecurity.

# data[].attributes.attachment_link.title
What Is Social Engineering - The Human Element in the Technology Scam| Cybersecurity | CompTIA

# data[].attributes.attachment_link.description
It's often noted that humans are the weakest link when it comes to cybersecurity. To exploit that vulnerability, many hackers engage in social engineering to support their cyberattack efforts and obtain valuable information. Social engineers target humans, rather than technology, to gather useful intel.

# data[].attributes.headline
How does the social engineering piece intertwine with the technical aspect of cyber attacks?

# data[].attributes.subject
How does the social engineering piece intertwine with the technical aspect of cyber attacks?

# data[].attributes.body
As the human component of cybersecurity is often the weakest, social engineering can be used to create cybersecurity vulnerabilities.

# data[].attributes.headline
An example of the intersection between social engineering and cybersecurity:

# data[].attributes.subject
An example of the intersection between social engineering and cybersecurity:

# data[].attributes.headline
What are some of the common ways social engineering affects cybersecurity?

# data[].attributes.subject
What are some of the common ways social engineering affects cybersecurity?

# data[].attributes.body
Social engineering can affect cyber security in a number of ways but most inherently allow a bad actor access to a system that they should not. From there, the affect of exploration depends on the system effected.

# data[].attributes.headline
Common types of social engineering attacks: 

# data[].attributes.subject
Common types of social engineering attacks: 

# data[].attributes.attachment_link.readable_text
Originally published by New Context.
One of the biggest weaknesses in any organization's cybersecurity strategy is human error. Social engineering attacks take advantage of this vulnerability by conning unsuspecting people into compromising security and giving out sensitive information. Social engineers use various psychological hacks to trick you into trusting them or create a false sense of urgency and anxiety to lower your natural defenses. Attackers can then breach your physical or technological security to steal money or confidential information.

The only way to prevent being targeted by social engineering is to study the methods, psychological triggers, and technological tools these attackers use. Scammers use many different types of social engineering attacks, but some common giveaways can help you spot and avoid them.

10 Types of Social Engineering Attacks

To prevent a social engineering attack, you need to understand what they look like and how you might be targeted. These are the 10 most common types of social engineering attacks to be aware of.

1. Phishing

Phishing is the most common type of social engineering attack, typically using spoofed email addresses and links to trick people into providing login credentials, credit card numbers, or other personal information. Variations of phishing attacks include:

Angler phishing - using spoofed customer service accounts on social media

Spear phishing - phishing attacks that target specific organizations or individuals

2. Whaling

Whaling is another common variation of phishing that specifically targets top-level business executives and the heads of government agencies. Whaling attacks usually spoof the email addresses of other high-ranking people in the company or agency and contain urgent messaging about a fake emergency or time-sensitive opportunity. Successful whaling attacks can expose a lot of confidential, sensitive information due to the high-level network access these executives and directors have.

3. Diversion Theft

In an old-school diversion theft scheme, the thief persuades a delivery driver or courier to travel to the wrong location or hand off a parcel to someone other than the intended recipient. In an online diversion theft scheme, a thief steals sensitive data by tricking the victim into sending it to or sharing it with the wrong person. The thief often accomplishes this by spoofing the email address of someone in the victim's company-an auditing firm or a financial institution, for example.

4. Baiting

Baiting is a type of social engineering attack that lures victims into providing sensitive information or credentials by promising something of value for free. For example, the victim receives an email that promises a free gift card if they click a link to take a survey. The link might redirect them to a spoofed Office 365 login page that captures their email address and password and sends them to a malicious actor.

5. Honey Trap

In a honey trap attack, the perpetrator pretends to be romantically or sexually interested in the victim and lures them into an online relationship. The attacker then persuades the victim to reveal confidential information or pay them large sums of money.

6. Pretexting

Pretexting is a fairly sophisticated type of social engineering attack in which a scammer creates a pretext or fabricated scenario-pretending to be an IRS auditor, for example-to con someone into providing sensitive personal or financial information, such as their social security number. In this type of attack, someone can also physically acquire access to your data by pretending to be a vendor, delivery driver, or contractor to gain your staff's trust.

7. SMS Phishing

SMS phishing is becoming a much larger problem as more organizations embrace texting as a primary method of communication. In one method of SMS phishing, scammers send text messages that spoof multi-factor authentication requests and redirect victims to malicious web pages that collect their credentials or install malware on their phones.

8. Scareware

Scareware is a form of social engineering in which a scammer inserts malicious code into a webpage that causes pop-up windows with flashing colors and alarming sounds to appear. These pop-up windows will falsely alert you to a virus that's been installed on your system. You'll be told to purchase and download their security software, and the scammers will either steal your credit card information, install real viruses on your system, or (most likely) both.

9. Tailgating/Piggybacking

Tailgating, also known as piggybacking, is a social engineering tactic in which an attacker physically follows someone into a secure or restricted area. Sometimes the scammer will pretend they forgot their access card, or they'll engage someone in an animated conversation on their way into the area so their lack of authorized identification goes unnoticed.

10. Watering Hole

In a watering hole attack, a hacker infects a legitimate website that their targets are known to visit. Then, when their chosen victims log into the site, the hacker either captures their credentials and uses them to breach the target's network, or they install a backdoor trojan to access the network.

How to Prevent a Social Engineering Attack

Social engineering represents a critical threat to your organization's security, so you must prioritize the prevention and mitigation of these attacks as a core part of your cybersecurity strategy. Preventing a social engineering attack requires a holistic approach to security that combines technological security tools with comprehensive training for staff and executives.

Your first line of defense against a social engineering attack is training. Everyone in your organization should know how to spot the most common social engineering tactics, and they should understand the psychological triggers that scammers use to take advantage of people. A comprehensive social engineering and security awareness training course should teach staff to:

Determine whether an email has been spoofed by hovering over the sender's name to make sure it matches the email address and checking the email address for spelling errors and other common giveaways.

Be suspicious of any unsolicited communication, especially from someone they don't know.

Avoid downloading suspicious email attachments.

Hover over links in emails to make sure the website URL is valid.

Verify someone's identity through an alternate contact method (e.g. in person or by calling them directly) before providing any sensitive information.

You also need to follow up your security awareness training with periodic tests to ensure your staff hasn't become complacent. Many training programs allow for the administration of simulated phishing tests in which fake phishing emails are sent to staff members to gauge how many people fall for the social engineering tactics. Those staff members can then be retrained as needed.

Creating a positive security culture within your organization is critical for containing a social engineering attack that's already happened. Your staff needs to feel comfortable self-reporting if they believe they've fallen victim to a social engineering attack, which they won't do if they're concerned about facing punishment or public humiliation. If these issues are reported as soon as they occur, the threat can be mitigated quickly before too much damage has occurred.

Finally, you need to implement technological security tools to prevent attacks on your organization and minimize the damage from any successful breaches. These tools should include firewalls, email spam filters, antivirus and anti-malware software, network monitoring tools, and patch management.

# data[].attributes.attachment_link.title
12 Types of Social Engineering Attacks to Look Out For

# data[].attributes.attachment_link.description
Originally published by New Context. One of the biggest weaknesses in any organization's cybersecurity strategy is human error. Social engineering attacks take advantage of this vulnerability by conning unsuspecting people into compromising security and giving out sensitive information.

# data[].attributes.headline
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.subject
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.body
Individual awareness is key, but limiting what information is online or vulnerable in the first place can also help.

# data[].attributes.headline
Lecture on social engineering defense mechanisms:

# data[].attributes.subject
Lecture on social engineering defense mechanisms:

# data[].attributes.attachment_link.title
Social Engineering Defense Mechanisms - FICC 2020 (San Francisco, CA)

# data[].attributes.headline
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.subject
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.body
Again they typically gain access to a system they should not have had access to.

# data[].attributes.headline
An example of targeted social engineering:

# data[].attributes.subject
An example of targeted social engineering:

# data[].attributes.attachment_link.readable_text
Defending, William Harbage QC said Gamble, who is on the autistic spectrum, was "naive" and "childish" and his actions were a response to what he had read about in online chat rooms about US policy.

# data[].attributes.attachment_link.title
Two years for teen 'cyber terrorist' who targeted US officials

# data[].attributes.attachment_link.description
Defending, William Harbage QC said Gamble, who is on the autistic spectrum, was "naive" and "childish" and his actions were a response to what he had read about in online chat rooms about US policy.

# data[].attributes.attachment_link.title
Hacking Humans : Social Engineering Techniques and How to Protect Against Them - Stephen Haunts