# data[].attributes.headline
Social Engineering and how it intertwines with technical aspects of Cyber-Attacks :-

# data[].attributes.subject
Social Engineering and how it intertwines with technical aspects of Cyber-Attacks :-

# data[].attributes.attachment_link.title
Social Engineering and how it intertwines with technical aspects of Cyber-Attacks

# data[].attributes.headline
Ways when social engineering affects cybersecurity:-

# data[].attributes.subject
Ways when social engineering affects cybersecurity:-

# data[].attributes.body
Social engineering is often the first step in malicious hacking. It often enables attackers to gain physical access to a target's devices and networks and facilitates the gathering and harvesting of credentials (such as username/password combos) for follow-on network-based attacks.

Social engineering and the human element are common ways to gain access to a network, database, or building. Major cyber incidents have occurred as the result of an attacker gaining initial access via social engineering, usually by convincing an insider to unwittingly download or install a piece of malware that opens up the target network to the attacker (e.g., the theft of RSA SecureID tokens in 2011, false reports on Twitter causing the Dow to drop in 2013, the massive breach of personal information of up to 110 million Target customers in 2013).

# data[].attributes.headline
Ways to prevent attackers from leveraging social engineering for their own benefit :-

# data[].attributes.subject
Ways to prevent attackers from leveraging social engineering for their own benefit :-

# data[].attributes.body
Slow down. Spammers want you to act first and think later. If the message conveys a sense of urgency or uses high-pressure sales tactics be skeptical; never let their urgency influence your careful review.

Research the facts. Be suspicious of any unsolicited messages. If the email looks like it is from a company you use, do your own research. Use a search engine to go to the real company’s site, or a phone directory to find their phone number.

Don’t let a link be in control of where you land. Stay in control by finding the website yourself using a search engine to be sure you land where you intend to land. Hovering over links in the email will show the actual URL at the bottom, but a good fake can still steer you wrong.

Email hijacking is rampant. Hackers, spammers, and social engineers taking over control of people’s email accounts (and other communication accounts) have become rampant. Once they control an email account, they prey on the trust of the person’s contacts. downloading.

Beware of any download. If you don’t know the sender personally AND expect a file from them, downloading anything is a mistake.

Foreign offers are fake. If you receive an email from a foreign lottery or sweepstakes, money from an unknown relative, or requests to transfer funds from a foreign country for a share of the money it is guaranteed to be a scam.

# data[].attributes.headline
Three video links social engineering is used for a cyber attack -

# data[].attributes.subject
Three video links social engineering is used for a cyber attack -

# data[].attributes.body
1) https://www.youtube.com/watch?v=B0bZ2aJv9ko

2)https://www.youtube.com/watch?v=xLjZtlBvvjs

3) https://www.youtube.com/watch?v=B0bZ2aJv9ko

# data[].attributes.attachment_link.title
Social engineering: How phishing works and why criminals make more money with email than ransomware

# data[].attributes.headline
Three articles where social engineering being used for a cyber attack -

# data[].attributes.subject
Three articles where social engineering being used for a cyber attack -

# data[].attributes.body
1) https://digitalguardian.com/blog/what-social-engineering-defining-and-avoiding-common-social-engineering-threats

2)https://www.webroot.com/us/en/resources/tips-articles/what-is-social-engineering

3)https://www.csoonline.com/article/2124681/what-is-social-engineering.html

# data[].attributes.attachment_link.readable_text
As social engineering attacks continue to grow in sophistication and frequency, companies should look to employee education as a first line of defense. Learn how to recognize and avoid social engineering attacks in this installment of our Data Protection 101 series.

A Definition of Social Engineering

Social engineering is a non-technical strategy cyber attackers use that relies heavily on human interaction and often involves tricking people into breaking standard security practices. The success of social engineering techniques depends on attackers' ability to manipulate victims into performing certain actions or providing confidential information. Today, social engineering is recognized as one of the greatest security threats facing organizations. Social engineering differs from traditional hacking in the sense that social engineering attacks can be non-technical and don't necessarily involve the compromise or exploitation of software or systems. When successful, many social engineering attacks enable attackers to gain legitimate, authorized access to confidential information.

The Why and How of Social Engineering

Social engineers are a modern day form of fraudsters or con artists. They may attempt to access computer networks or data stores by gaining the confidence of authorized users or stealing those users' credentials in order to masquerade as trusted insiders. It is common for social engineers to rely on the natural helpfulness of people or to attempt to exploit their perceived personality weaknesses. For example, they may call with a feigned urgent problem that requires immediate network access. Social engineers have been known to appeal to vanity, authority, greed, or other information gleaned from eavesdropping or online sleuthing, often via social media.

Cyber criminals use social engineering tactics in order to convince people to open email attachments infected with malware, persuade unsuspecting individuals to divulge sensitive information, or even scare people into installing and running malware.

Go Deeper

Insider Threat Protection

Types of Social Engineering Attacks

Your organization should take steps toward educating employees on the common types of social engineering attacks, including baiting, phishing, pretexting, quid pro quo, spear phishing, and tailgating. While there are technological solutions that help mitigate social engineering (such as email filters, firewalls, and network or data monitoring tools), having an employee base that is able to recognize and avoid common social engineering tactics is ultimately the best defense against these schemes. Here is a breakdown of common social engineering techniques:

Baiting - Attackers conduct baiting attacks when they leave a malware-infected device, such as a USB flash drive or CD, in a place where someone likely will find it. The success of a baiting attack hinges on the notion that the person who finds the device will load it into their computer and unknowingly install the malware. Once installed, the malware allows the attacker to advance into the victim's system.

Phishing - Phishing occurs when an attacker makes fraudulent communications with a victim that are disguised as legitimate, often claiming or seeming to be from a trusted source. In a phishing attack the recipient is tricked into installing malware on their device or sharing personal, financial, or business information. Email is the most popular mode of communication for phishing attacks, but phishing may also utilize chat applications, social media, phone calls, or spoofed websites designed to look legitimate. Some of the worst phishing attacks make charity pleas after natural disasters or tragedies strike, exploiting people's goodwill and urging them to donate to a cause by inputting personal or payment information.

Pretexting - Pretexting occurs when an attacker fabricates false circumstances to compel a victim into providing access to sensitive data or protected systems. Examples of pretexting attacks include a scammer pretending to need financial data in order to confirm the identity of the recipient or masquerading as a trusted entity such as a member of the company's IT department in order to trick the victim into divulging login credentials or granting computer access.

Quid pro quo - A quid pro quo attack occurs when attackers request private information from someone in exchange for something desirable or some type of compensation. For instance, an attacker requests login credentials in exchange for a free gift. Remember, if it sounds too good to be true, it probably is.

Spear phishing - Spear phishing is a highly targeted type of phishing attack that focuses on a specific individual or organization. Spear phishing attacks use personal information that is specific to the recipient in order gain trust and appear more legitimate. Often times this information is taken from victims' social media accounts or other online activity. By personalizing their phishing tactics, spear phishers have higher success rates for tricking victims into granting access or divulging sensitive information such as financial data or trade secrets.

Tailgating - Tailgating is a physical social engineering technique that occurs when unauthorized individuals follow authorized individuals into an otherwise secure location. The goal of tailgating is to obtain valuable property or confidential information. Tailgating could occur when someone asks you to hold the door open because they forgot their access card or asks to borrow your phone or laptop to complete a simple task and instead installs malware or steals data.

Social engineering is a serious and ongoing threat for many organizations and individual consumers who fall victim to these cons. Education is the first step in preventing your organization from falling victim to savvy attackers employing increasingly sophisticated social engineering methods to gain access to sensitive data.

Tags: Data Protection 101, Social Engineering

# data[].attributes.attachment_link.title
What is Social Engineering? Defining and Avoiding Common Social Engineering Threats

# data[].attributes.attachment_link.description
As social engineering attacks continue to grow in sophistication and frequency, companies should look to employee education as a first line of defense. Learn how to recognize and avoid social engineering attacks in this installment of our Data Protection 101 series.

# data[].attributes.headline
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.subject
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.body
1. Scareware is malware that’s meant to scare you to take action — and take action fast.

2. Phishing is a case where a cybercriminal,  sends a message to a target to ask for some type of information or action that might help with a more significant crime.

3. Baiting is built on the premise of someone taking the bait, meaning dangling something desirable in front of a victim, and hoping they’ll bite.

4. Spear phishing is a highly targeted type of phishing attack that focuses on a specific individual or organization.

5. Physical breaches are when a cybercriminal is in plain sight, physically posing as a legitimate source to steal confidential data or information from you.