# data[].attributes.attachment_link.title
10 Ways Businesses Can Prevent Social Engineering Attacks | Indusface Blog

# data[].attributes.attachment_link.description
Checkout here “10 Ways Businesses Can Prevent Social Engineering Attacks”. Also You can explore more about the dangers of social engineering here.

# data[].attributes.headline
How social engineering affects cybersecurity

# data[].attributes.subject
How social engineering affects cybersecurity

# data[].attributes.attachment_link.readable_text
It's often noted that humans are the weakest link when it comes to cybersecurity. To exploit that vulnerability, many hackers engage in social engineering to support their cyberattack efforts and obtain valuable information. Social engineers target humans, rather than technology, to gather useful intel.

Hollywood frequently glorifies the savvy con man for his ability to charm and disarm. In the movie "Catch Me If You Can," Leonardo DiCaprio portrays a young Frank Abegnale, a notorious con man, who impersonated airline personnel, a lawyer and various other roles to commit check forgery and fraud. Abegnale later used his talents to become a security consultant.

Social engineering brings the con into the digital age. Instead of using personal interactions to build rapport and charm users into certain actions, social engineering leverages a lack of awareness around digital tools and the willingness to share on digital platforms. The end result is the same: psychological manipulation that leads to handing over sensitive info.

Social Engineering Defined

The term social engineering refers to methods employed by hackers to gain the trust of an end user so that the hacker can obtain information that can be used to access data or systems. Social engineering typically involves impersonating representatives of legitimate organizations to manipulate people into supplying information such as passwords or personal details.

Social engineering can involve phone calls, emails or texts. Sometimes referred to as "human hackers," social engineers employ a variety of methods to convince users to divulge information, often masquerading as tech support or bank employees.

How Does Social Engineering Work?

Hackers develop different tactics to support their social engineering pursuits. Most social engineering attacks follow this path:

1. Research the target. The purpose of social engineering is to convince a user that you represent a trusted institution. Social engineers will often attempt to develop a rapport by offering easily obtainable details, such as birthdate or phone number, as evidence of their legitimacy. Much of this information is publicly available, and social engineers typically scout social media to gather this type of vulnerable data.

2. Make contact with the target. The attacker makes contact directly with the target. Social engineers use the information they've gathered to validate their fake identity. The target is then asked to provide sensitive information the hacker can exploit.

3. Attack. Using the details they have covertly obtained, social engineers launch their attack. This could involve accessing systems using acquired passwords, performing a classic case of stolen identity or putting the information to use for personal or political gain.

History of Social Engineering

Social engineering is a practice that is as old as time. As long as there has been coveted information, there have been people seeking to exploit it.

The term social engineering was first used by Dutch industrialist J.C. Van Marken in 1894. Van Marken suggested that specialists were needed to attend to human challenges in addition to technical ones. In 1911, Edward L. Earp wrote Social Engineer as a way to encourage people to handle social relations similarly to how they approach machineries.

In modern times, social engineering has come to reference the practice of deceiving people to obtain valuable information, which is often followed up by a cyberattack.

Here are some of the most famous cybersecurity social engineering examples.

Target Data Breach

In 2013, more than 110 million customers fell victim to a social engineering attack on Target. Social engineering techniques were used on an HVAC company that had remote access to Target's network. The HVAC company was then compromised with malware, which in turn infected Target's systems. The attack resulted in the loss of emails, names, addresses, phone numbers and credit and debit card information.

Yahoo Security Breaches

In 2013 and 2014, two attacks compromised Yahoo email-user information. The second attack was accomplished via a spear-phishing campaign targeted to a Yahoo engineer. The individual took the bait, giving hackers access to names, email addresses, phone numbers, dates of birth and passwords. This attack also gave hackers the ability to access user accounts without passwords.

CIA Attack

A 15-year-old was able to take control of the secure emails of John Brennan, the director of the CIA. Kane Gamble used social engineering to convince Verizon to provide personal details about Brennan, which he later used to impersonate the CIA director. Gamble was able to access Brennan's email by changing security questions and passwords with gathered intel, allowing the 15-year-old to view sensitive military information.

Types of Social Engineering

Social engineering is a general term that refers to a broad range of manipulation tactics used by hackers to acquire information.

Baiting: Baiting is a social engineering attack where the attacker entices the user with a free item to lure them into clicking on a link. This may come in the form of a free music or movie download lined up with the user's interests. When the unsuspecting user clicks the link, they become infected with malware.

Phishing: Phishing is a type of social engineering attack that uses email, phone or text to entice a user to click on a malicious link. The communication appears to be from a legitimate source connected to the user. When the user selects the ill-intentioned link, the user's device or system becomes infected with malware and data is often compromised.

Pretexting: This tactic is one more commonly associated with the term social engineering. With pretexting, an individual impersonates a representative from a trusted organization with the goal of acquiring sensitive information. This social engineering technique relies heavily on gathering research before initiating contact with the target.

Quid Pro Quo: The quid pro quo attack is a variation of baiting. Often known as the "something for something" social engineering technique, the quid pro quo attack involves promising a service or benefit for complying with the request of an attacker. For example, a social engineer may promise a free software upgrade to entice a user to download what is actually malware to their system.

Reverse Social Engineering: In this kind of social engineering scheme, the attacker convinces a target that they have a problem or issue and then positions themselves with a solution. The target then initiates contact with the social engineer believing that they are able to solve their problem.

Tailgating: This social engineering tactic is a physical attack. With tailgating, a hacker gains access to restricted areas of a building by following an approved employee into the building and piggybacking on their credentials. In these cases, the social engineer often pretends to be an employee or even a delivery person.

Whaling and Spear Phishing: These attacks are a variation of phishing and, because they target a specific individual, they require a significant amount of research. In whaling attacks, these individuals are high-profile people, often executives or the C-suite.

How to Prevent and Protect Against Social Engineering

The best form of prevention against social engineering attacks is end-user training. Teaching your employees how to recognize social engineering tactics and avoid them is of the utmost importance.

Here are some points to help support your training efforts.

Research any suspicious calls, emails or texts.

Open attachments only from trusted sources.

Immediately delete any emails or texts asking for passwords or personally identifiable information (PII), such as social security numbers or financial information.

Don't open any emails promising prizes or notification of winnings.

Download software only from approved sources.

Be wary of urgent requests or solicitations for help.

Make sure you have spam filters and antivirus software on your device.

When in doubt, contact IT to confirm any technology-related requests.

What's the Difference Between Ransomware vs. Malware vs. Social Engineering vs. Phishing?

Ransomware, malware, social engineering and phishing all encompass different forms of ill-intentioned cyberattacks.

Malware is a general term formed by the words "malicious" and "software" that describes different types of software intended to compromise systems, obtain sensitive data or gain unsanctioned access to a network.

Ransomware is a category of malware where attackers use various methods to encrypt your data, making it inaccessible, or bar you from entry to a particular system or device. Attackers then demand a ransom in exchange for reinstating your access.

Social Engineering, by contrast, is a method used to extract sensitive details by way of human manipulation. With social engineering, hackers connect with users while pretending to represent a legitimate organization and seek to ascertain critical information such as account numbers or passwords.

Phishing is a form of social engineering that involves email, phone, text or illegitimate websites. In both instances, the collected information is used to access protected accounts or data.

While our guide acts as an introduction into the threats posed by social engineering, this is by no means an exhaustive list. Social engineering and the cybersecurity world change on a daily basis, and attacks are becoming increasingly sophisticated. The best way to combat cyberattacks is to stay informed about the latest attacks.
Read more about Cybersecurity.

# data[].attributes.attachment_link.title
What Is Social Engineering - The Human Element in the Technology Scam| Cybersecurity | CompTIA

# data[].attributes.attachment_link.description
It's often noted that humans are the weakest link when it comes to cybersecurity. To exploit that vulnerability, many hackers engage in social engineering to support their cyberattack efforts and obtain valuable information. Social engineers target humans, rather than technology, to gather useful intel.

# data[].attributes.headline
Social engineering used for attack - Article 3

# data[].attributes.subject
Social engineering used for attack - Article 3

# data[].attributes.attachment_link.readable_text
The hack last month at RSA Security has been shrouded in mystery.

How did a hacker manage to infiltrate one of the world's top computer-security companies? And could the data that was stolen be used to impair its SecurID products, which are used by 40 million businesses that are trying to keep their own networks safe from intruders?

The division of the EMC Corporation is staying mum about what exactly was stolen from its computer systems, aside from that it was data related to SecurID.

But on Friday RSA shed some light on the nature of the attack. In a blog post titled " Anatomy of an Attack," the company's head of new technologies, Uri Rivner, described a three-stage operation that was similar to several other recent prominent attacks on technology companies, including a 2009 attack on Google that it said originated in China.

In the attack on RSA, the attacker sent "phishing" e-mails with the subject line "2011 Recruitment Plan" to two small groups of employees over the course of two days. Unfortunately, one was interested enough to retrieve one of these messages from his or her junk mail and open the attached Excel file. The spreadsheet contained malware that used a previously unknown, or "zero-day," flaw in Adobe's Flash software to install a backdoor. RSA said that Adobe had since released a patch to fix that hole.

After installing a stealthy tool that allowed the hacker to control the machine from afar, he stole several account passwords belonging to the employee and used them to gain entry into other systems, where he could gain access to other employees with access to sensitive data, Mr. Rivner said.

Then came stage three: spiriting RSA files out of the company to a hacked machine at a hosting provider, and then on to the hacker himself.

The attacker left few traces. But an unclassified document from the United States Computer Emergency Readiness Team (US-CERT) obtained by the blogger Brian Krebs revealed three Web addresses used in the intrusion, one of which includes the letters "PRC," which could refer to the People's Republic of China - or it could be a ruse.

According to Mr. Rivner, it's difficult for companies with the world's most sophisticated defenses to stop this newfangled "advanced persistent threats," which are made potent by the combination of low-tech "social-engineering" cons and a high-tech zero-day attack that antivirus software won't recognize.

That RSA detected the attack in progress was a victory, he argued. Many other companies hit by similar attacks "either detected the attacks after months, or didn't detect them at all and learned about it from the government," he said. "As an industry, we have to act fast and develop a new defense doctrine; the happy days of good old hacking are gone, and gone too are the old defense paradigms."

But some security experts ridiculed the notion that the attack was sophisticated. Jeremiah Grossman, founder of WhiteHat Security, posted on Twitter: "I can't tell if this RSA APT blog post is actually being serious or an April 1st gag. The content is absurd either way."

# data[].attributes.attachment_link.keywords[]
rsa the security division of emc corporation

# data[].attributes.attachment_link.description
The hack last month at RSA Security has been shrouded in mystery. How did a hacker manage to infiltrate one of the world's top computer-security companies? And could the data that was stolen be used to impair its SecurID products, which are used by 40 million businesses that are trying to keep their own networks safe from intruders?

# data[].attributes.body
1. 2 factor or multi-factor authentication

Don’t rely on one factor – the most basic preventive measure guarantees your account security. Of course, the password ensures security, but we have realized they’re inadequate on its own. Because it is far easier for someone else to guess your password and obtain access to your accounts.

2. Authenticating email sender's identity

Most scams involve the method of falsely obtaining the victim’s information by pretending as a trusted entity. Especially in a phishing attack, attackers send email messages that may appear like they are from a sender you trust like from a credit card company, a bank, a social networking site, or an online store. The emails often tell a story to make you click on the false link, which looks legitimate.

3. Continuously Monitor Critical System

Make sure your system, which houses sensitive information is being monitored 24 x 7. When certain exploiting tactics are employed like Trojans, they sometimes depend on the system, which is vulnerable. Scanning both external and internal systems with Web application scanning can help to find vulnerabilities in your system.

4. Spam Filter

Enable Spam filters and close the door for offenders of social engineering security threats. Spam filters offer vital services in protecting your inboxes from social engineering attacks.

4. Penetration Testing

The most effective approach among the ways to prevent social engineering attacks is conducting a pen-test to detect and try to exploit vulnerabilities in your organization. If your pen-tester succeeds in endangering your critical system, you can identify which system or employees you need to concentrate on protecting as well as the types of social engineering attacks you may be prone to.

# data[].attributes.headline
Social engineering used for attack - Article 2

# data[].attributes.subject
Social engineering used for attack - Article 2

# data[].attributes.attachment_link.readable_text
Retail giant Target will pay an $18.5 million multistate settlement, the largest ever for a data breach, to resolve state investigations of the 2013 cyber attack that affected more than 41 million of the company's customer payment card accounts.

Announced Tuesday by 47 states and the District of Columbia, the agreement sets new industry standards for companies that process payment cards and maintain confidential information about their customers.
Target confirms massive credit-card data breach
The states' investigation of the breach determined that cyberattackers gained access to Target's computer gateway served through credentials stolen from a third-party vendor in Nov. 2013. Using the credentials to exploit weaknesses in Target's system, the attackers gained access to a customer service database, installed malware on the system and captured full names, phone numbers, email addresses, payment card numbers, credit card verification codes, and other sensitive data.

Along with affecting 41 million customer payment card accounts, the breach affected contact information for more than 60 million Target customers.

"Companies across sectors should be taking their data security policies and procedures seriously. Not doing so potentially exposes sensitive client and consumer information to hackers," said a statement issued by Connecticut Attorney General George Jepsen, who led the investigation along with Illinois counterpart Lisa Madigan.
Target: Data stolen from up to 70 million customers
Target previously provided free credit monitoring services for consumers affected by the breach. As part of a $10 million class-action lawsuit settlement reached in 2015, the company also agreed to pay up to $10,000 to consumers with evidence they suffered losses from the data breach.
Few Target victims to benefit from settlement
Tuesday, the company said it had worked with the state investigators to address claims related to the embarrassing episode.

"We're pleased to bring this issue to a resolution for everyone involved," the Minneapolis-based company said in a written statement. Costs of the settlement are already reflected in liability reserves that Target has previously disclosed, the company added.

Terms of the agreement require Target to:

Develop, implement and maintain a comprehensive information security program

Employ an executive or officer responsible for executing the program

Hire an independent expert to conduct a security assessment

Maintain and support data security software on the company's network

Segregate the cardholder data from the rest of the network

Take steps to control network access, including password rotation policies and two-factor authentication.

As part of the settlement, the states will use their respective shares of the Target payment for attorney fees and other investigation costs, as well as consumer protection law enforcement funds, consumer education or other purposes.
Follow USA TODAY reporter Kevin McCoy on Twitter: @kmccoynyc

# data[].attributes.attachment_link.title
Target to pay $18.5M for 2013 data breach that affected 41 million consumers

# data[].attributes.attachment_link.description
Retail giant Target will pay an $18.5 million multistate settlement, the largest ever for a data breach, to resolve state investigations of the 2013 cyber attack that affected more than 41 million of the company's customer payment card accounts.

# data[].attributes.headline
Social engineering used for attack -  Article 1

# data[].attributes.subject
Social engineering used for attack -  Article 1

# data[].attributes.attachment_link.readable_text
"This is not a good day for South Carolina." That was Governor Nikki Haley's public reaction to news that a foreign hacker had infiltrated South Carolina's Department of Revenue and made off with 3.6 million social security numbers and 387,000 credit/debit card numbers. Of the compromised cards, state officials believe only 16,000 were unencrypted, though the staggering social security breach affects more than half of South Carolina's 4.6 million population. Governor Nikki Haley held a presser earlier this afternoon confirming the attack - first uncovered by WLTX Columbia. "The number of records breached requires an unprecedented, large-scale response by the Department of Revenue, the State of South Carolina and all our citizens," said Haley before outlining steps that residents can take to discover if their information was exposed.
Millions of residents risk identity theft
Everyone who has filed a tax return in the state since 1998 is urged to call 1-866-578-5422. If you're among the unlucky millions, you'll be given a code that can be redeemed for a year of identity theft protection through Experian's ProtectMyID service. "I want this person slammed against the wall," said Haley of the perpetrator. Authorities have dismissed the possibility that the attack originated from within the United States and are focusing their search internationally. A number of law enforcement agencies have joined the effort including the FBI and US Secret Service.

Numerous attacks have been detected
An initial attack was launched August 27th, though it's believed no data was stolen during this first attempt. But two additional intrusions were recorded in September according to the Department of Revenue, which was made aware of the situation by South Carolina's IT division on October 10th. "We worked with them throughout that day to determine what may have happened and what steps to take to address the situation," said Director James Etter. "We also immediately began consultations with state and federal law enforcement agencies and briefed the governor's office." Security firm Mandiant was recruited to assist in the state's investigation and develop tougher security protocols. Officials have chronicled their response efforts thus far in this document.
Too little, too late
Blindsided by such a sophisticated and malicious attack, Governor Haley signed an executive order calling for the state's government to improve information security policies. Previous regulations were uncoordinated and left South Carolina vulnerable, she said. Cyber security has become a priority of the Obama administration and other government representatives and it stands to reason that a real-world breach of this magnitude will bring that conversation back to the forefront in the days and weeks ahead. If there's any good to come of this, hopefully it will hasten efforts to develop a better and more secure identification system.

# data[].attributes.attachment_link.title
3.6 million social security numbers exposed in unprecedented South Carolina cyber attack

# data[].attributes.attachment_link.description
"This is not a good day for South Carolina." That was Governor Nikki Haley's public reaction to news that a foreign hacker had infiltrated South Carolina's Department of Revenue and made off with 3.6 million social security numbers and 387,000 credit/debit card numbers.

# data[].attributes.attachment_link.title
Twitter: High-profile hacks were part of a 'coordinated social engineering attack'

# data[].attributes.headline
How cyber attackers leverage social engineering

# data[].attributes.subject
How cyber attackers leverage social engineering

# data[].attributes.body
Criminals will often take weeks and months getting to know a place before even coming in the door or making a phone call. Their preparation might include finding a company phone list or org chart and researching employees on social networking sites like LinkedIn or Facebook.

1. Mobile device attack
A social engineer might call and pretend to be a fellow employee or a trusted outside authority (such as law enforcement or an auditor).

2. At work
"Can you hold the door for me? I don't have my key/access card on me." How often have you heard that in your building? While the person asking may not seem suspicious, this is a very common tactic used by social engineers.

3. Social media
Social networking sites have made social engineering attacks easier to conduct. Today's attackers can go to sites like LinkedIn and find all of the users that work at a company and gather plenty of detailed information that can be used to further an attack.

Social engineers also take advantage of breaking news events, holidays, pop culture, and other devices to lure victims. In Woman loses $1,825 to mystery shopping scam posing as BestMark, Inc. you see how criminals leveraged the name of a known mystery shopping company to conduct their scam. Scammers often use fake charities to further their criminal goals around the holidays.

Attackers will also customize phishing attacks to target known interests (e.g., favorite artists, actors, music, politics, philanthropies) that can be leveraged to entice users to click on malware-laced attachments.

# data[].attributes.attachment_link.title
Cybersecurity Expert Demonstrates How Hackers Easily Gain Access To Sensitive Information

# data[].attributes.attachment_link.title
This is how hackers hack you using simple social engineering