# data[].attributes.body
As mentioned in my video, attackers have many ways how to use social engineering in cyber attacks.
The most essential action we shall do to prevent this happening is to educate future possible victims. Social engineering is a major factor in 99% of nowadays attacks. In many cases, nothing can save the victim if he or she gives their sensitive data to the attacker.
I have also explain some common ways of how cyber attackers leverage social engineering to go after a target.

# data[].attributes.attachment_link.provider_name
Online Masters Degree in Cybersecurity | Guide to Cybersecurity Graduate Programs

# data[].attributes.attachment_link.readable_text
We all know by now that the most vulnerable aspect of any organization isn't usually a weak point in the hardware or software components of an information system. It's in the wetware, the human minds of the users of the system.

Social engineering defense definitely isn't the sexiest aspect of network and information security, but you defend your weaknesses or you get beat. This means anyone thinking about entering the cybersecurity field today had better be prepared to educate people within the organization on protocols for defending against social engineering attacks.

Social engineering may be the oldest type of attack on information systems, too, going all the way back to the original Trojan Horse... You could even say Odysseus was the first hacker to use social engineering to circumvent security protocols.

But he sure wasn't the last, though.

According to Computer Weekly, social engineering attacks were the most common hacking technique used in 2015. And there's no sign of it slowing down; in 2016 60 percent of enterprises were victims of a social engineering attack of some kind. And according to EMC, phishing attacks-the easiest and most common type of social engineering attacks- resulted in nearly $6 billion in losses in 2013 alone, spread out over some 450,000 separate compromises.

Some hurt worse than others, but all resulted in a serious enough shake up for security managers to recalibrate their respect for the vector, take a long hard look at their protocols, and make educating staff a top priority.

Here's our pick for five of the biggest social engineering attacks of all time.

2011 RSA SecurID Phishing Attack
Security firms should be the most secure targets when it comes to any type of information system attack, but they are also juicy targets that draw more than their fair share of attempts.
In 2011, one of these attacks bit encryption giant RSA and succeeded in netting hackers valuable information about the company's SecurID two-factor authentication fobs.

Although RSA initially denied that the information could help hackers compromise anyone using SecurID, defense contractor Lockheed Martin soon detected hackers attempting to breach their network using stolen SecurID data. RSA backpedaled quickly and agreed to replace most of the distributed security tokens.

All this trouble boiled down to four employees at RSA parent corporation EMC. Attackers sent them email with a spoofed address purporting to be at a job recruitment website, with an Excel attachment titled 2011 Recruitment Plan. It wasn't even clear why the employees would care about a spreadsheet from a third-party website, but they opened it-and a zero-day Flash exploit buried in the spreadsheet installed backdoor access to their work machines that soon laid open the keys to the kingdom.

2015 Ubiquiti Networks Scam
Not all hackers are looking for sensitive information; sometimes they just want cold, hard cash.
In 2015, Ubiquiti, a specialized manufacturer of wifi hardware and software based in San Jose, found this out the hard way when their finance department was targeted in a fraud scheme revolving around employee impersonation.

The company never revealed exactly how the attack was structured, but did say that the accounting department received email purporting to be from the company's Hong Kong subsidiary. Often, such emails contain instructions regarding changes in payment account details or new vendors to be credited. Without verification, the accounting department simply followed the instructions.

The scheme resulted in transfers totaling almost $47 million to various overseas accounts they thought belonged to current vendors... but, in fact, the money simply filtered directly into accounts owned by the hackers.

Ubiquiti was able to recover around $8 million of those funds but most of the rest were permanently lost.

2013 Department of Labor Watering Hole Attack
Watering hole attacks are some of the broadest social engineering exploits but also some of the hardest for cybersecurity professionals to measure in terms of how much information was actually compromised.
In a watering hole attack, cyber criminals set up a website or other resource that appears to be official and legitimate and wait for victims to come to them. Unless those victims come forward, it's hard to know who was snared.

It was particularly difficult in 2013 when a server at the U.S. Department of Labor was hacked and used to host a variety of malware and redirecting certain visitors to a site using a zero-day Internet Explorer exploit to install a remote access Trojan named Poison Ivy.

The pages that were infected were apparently carefully selected: all had something to do with toxic nuclear substances overseen by the Department of Energy. Likely targets were DoL and DOE employees with access to sensitive nuclear data.

The government, understandably, never released how many had been infected or whether sensitive data had been compromised. Perhaps the most disturbing part of the incident is the fact that the attackers were never identified. But considering the nature of the information being sought, the attack illustrates the deadly serious nature of cybsecurity.

2014 Sony Pictures Hack
It would have been funny if it hadn't put tensions on edge between two nuclear powers.
When a group of North Korean hackers targeted Sony Pictures in a successful phishing attack in 2014, all signs pointed to an unlikely motive: The fact that the film production juggernaut was set to release The Interview, a new Seth Rogen comedy about two journalists attempting to assassinate the Supreme Leader of North Koria, Kim Jong Un.

What American audiences thought would be a quick gag was no laughing matter to the North Koreans, apparently. Since internet access in North Korea is tightly controlled, it's all but certain that the attackers were part of a government-led effort aimed at getting the studio to pull the movie.

That's exactly what happened, although not exactly in the way the Korean hackers might have hoped... Citing concerns over the possibility of terrorist action and the fact that some theater chains were refusing to carry the film, Sony released it online for free... essentially shooting the hostage before the Korean's could do so.

The incident escalated to the point where the U.S. National Security Council became involved, concerned that as the incident unfolded, it could spark a war on the Korean Peninsula.

In the end, war was averted but Sony suffered substantial financial losses and had several other pictures and a considerable amount of employee data leaked online thanks to the hackers.

2013 Yahoo Customer Account Compromise
It's easy to get inured to big numbers when you are investigating cyberattacks, but these are people we're talking about here.
Hundreds of probes per second or thousands of accounts being compromised may be no big deal. But when you look at what happened to Internet giant Yahoo in 2013 when a semi-privileged engineer at the company made the mistake of falling for a spearphishing message that ended up in his email inbox, you need to sit down and take firm hold of your chair. With the access they gained, the hackers compromised every single customer account at the company-more than 3 billion accounts.

The data promptly went up for sale on the dark web, likely used from there to launch attacks on other targets using the personal information life from those accounts.

It may be the single largest breach of all time in terms of individual records compromised.

Naturally, Yahoo wasn't eager for the breach to be revealed. Early reports identified a modest 500 million accounts as compromised, and it wasn't until four years later, in October of 2017, that the true number came out.

By then, of course, it was far too late for the other affected users to protect themselves. But it's some indication of what cybersecurity professionals are up against when relying on open-source reporting of major breaches-take it all with a grain of salt.

# data[].attributes.attachment_link.title
Top 5 Social Engineering Attacks of All Time | Online Masters Degree in Cybersecurity

# data[].attributes.attachment_link.description
We all know by now that the most vulnerable aspect of any organization isn't usually a weak point in the hardware or software components of an information system. It's in the wetware, the human minds of the users of the system.

# data[].attributes.attachment_link.readable_text
Social engineering is an attack vector that exploits human psychology and susceptibility to manipulate victims into divulging confidential information and sensitive data or performing an action that breaks usual security standards.

In general, social engineering success relies on a lack of cyber security awareness training and a lack of employee education. Employees are the first line of defense and are frequently the weakest link in an otherwise secure defense in depth strategy.

And it's not just employees organizations need to worry about. Third-party vendors are frequently the largest security threat, all it takes it one third-party to be breached to expose sensitive data. This is why vendor risk management and using vendors with SOC 2 assurance is so important.

Why do cybercriminals use social engineering?

Cybercriminals use social engineering techniques to conceal their true identity and present themselves as a trusted source or individual. The objective is to influence, manipulate or trick victims into giving up personal information or gain unauthorized access in an organization.

Most social engineering exploits people's willingness to be helpful. For example, the attacker may pose as a co-worker who has an urgent problem e.g. an overdue invoice.

Social engineering is an increasingly popular way to subvert information security because it is often easier to exploit human weaknesses than network security or vulnerabilities.

That said, social engineering can be used as the first stage of a larger cyber attack design to infiltrate a system, install malware or expose sensitive data.

How does social engineering work?

Social engineers use a wide range of social engineering tactics that rely on the six principles of influence.

That said, the first step for most social engineering attacks is to gather information on the target.

For example, if the target is an organization, attackers can exploit poor OPSEC practices to gather intelligence on corporate structure, internal operations, industry jargon, third-party vendors and other publicly accessible information listed social media profiles, online and in person.

In many cases, the first target will be a low level employee whose login credentials can be used to gain access to internal information that can be used for spear phishing or other more targeted cyber threats.

Social engineering attacks expose sensitive information, like social security numbers or credit card numbers, and lead to data breaches and data leaks of personally identifiable information (PII) and protected health information (PHI).

What are the six principles of influence?

All social engineering techniques rely on exploiting aspects of human interaction and decision-making known as cognitive biases. Think of biases as vulnerabilities in human software which can be exploited just like software-based vulnerabilities listed on CVE.

Social engineering relies heavily on Robert Cialdini's, Regents' Professor Emeritus of Psychology and Marketing at Arizona State University and best-selling author, theory of influence based on six principles:

1. Reciprocity: People tend to want to return a favour, which explains the pervasiveness of free samples in marketing. A scammer may give the target something for free and then request access to sensitive information.

2. Commitment and consistency: If people commit, orally or in writing, to a goal or idea, they are likely to honor the commitment because it fits with their self-image, even if the original motivation is removed.

3. Social proof: People tend to do things other people are doing.

4. Authority: People tend to obey authority figures even if asked to do objectionable acts. This is why spear phishing campaigns that use the CEO's name and target low-level employees can be successful.

5. Liking: People are easily persuaded by people they like, hence why spear phishers will often masquerade as a colleague or friend in their spear phishing campaigns.

6. Scarcity: Perceived scarcity increases demand, hence why social engineers often create a sense of urgency.

What are the types of social engineering attacks?

Common social engineering attacks include:

Baiting: A type of social engineering where an attacker leaves a physical device infected with a type of malware in a place it will be found, e.g. a USB. The victim inserts the USB into their computer and unintentionally infects the computer with malicious software.

Diversion theft: Social engineers trick a delivery company into sending the package to a different location and intercept the mail.

Honey trap: A con artistposes as an attractive person online to build up a fake online relationship to make money or gather personally identifiable information (PII) like the victim's phone number and email account.

Phishing: Phishing attacks gather sensitive information like login credentials, credit card numbers, bank account details by masquerading as a trusted source. A common phishing scam is use email spoofing to masquerade as a trusted source like a financial institution to trick the victim into clicking a malicious link or downloading an infected attachment. Phishing emails often create a sense of urgency to make the victim feel that divulging information quickly is important. Despite being a relatively unsophisticated attack, phishing represents one of the largest cybersecurity risks.

Pretexting: Pretexting is lying to gain access to personal data or other privileged information. For example, a fraudster may pose as a third-party vendor, saying they need to know your full name and title to verify your identity.

Quid pro quo: A quid pro quo attack uses the human tendency of reciprocity to gain access information. For example, an attacker may provide free technical support over a phone call to a victim and request that they turn off their anti-virus software or install a trojan that takes control of their operating system.

Rogue security software: Rogue security software or scareware is fake security software that claims malware is on the computer. The end user receives a pop-up that demands payment for removal. If a payment isn't made, pop-ups will continue but files are generally safe.

Spear phishing: Spear phishing is an email spoofing attack targeting a specific organization or individual. Spear phishing emails aim to infect the victim with ransomware or trick them into revealing sensitive data and sensitive information.

Smishing: Smishing or SMS phishing is phishing performed over SMS rather than the traditional medium of email.

Tailgating: Tailgating or piggybacking is when an attacker follows a person into a secure area. This type of attack relies on the person being followed assuming the person has legitimate access to the area.

Vishing: Vishing or voice phishing is conducted by phone and often targets users of Voice over IP (VoIP) services like Skype. Vishing paired with voice deep fakes is a massive cybersecurity risk. According to The Wall Street Journal, the CEO of a UK-based energy firm sent $243,000 to an attacker's bank account believing he was on the phone to his boss.

Waterholing: A watering hole attack is when an attacker targets a specific group of people by infecting a website they know and trust, e.g. by exploiting an outdated SSL certificate, typosquatting, lack of DNSSEC or domain hijacking.

Whaling: Whaling is a form of spear phishing targeting high-profile individuals like public company executives, politicians or celebrities. For example, whaling attacks often come in the form of a fake request from the CEO asking the HR department to change their existing payroll details to those set up by the phisher.

What is the best defense against social engineering?

Organizations can reduce the cybersecurity risk of social engineering by:

Training employees: Security awareness training that is relevant to the employee's position can reduce the risk they'll fall prey to a social engineering attack, e.g. outline what to do when asked for information via email and when someone tries to tailgate them into the office.

Processes: Establishing an information security policy that outlines what to do to avoid social engineering and have an incident response plan to react to data breaches and data leaks to reduce the impact of any one social engineering attack.

Scrutinize information: Teach employees to scrutinize every email they receive and every device they plug into their computer. By identifying what information is sensitive and evaluating how it could be exposed during a social engineering attack can help organizations build in countermeasures and mitigate cybersecurity risk.

Security protocols: Establish and information risk management program that has security protocols, policies and procedures that outline how to handle data security.

Test: Test your organization and perform social engineering attacks against it. Send fake phishing emails designed to test whether staff engage with the message, click links and download attachments.

Inoculation: Just like vaccination, your organization can become more resistant to social engineering attacks if they are exposed to them frequently, this is why testing multiple times a year is important.

Review: Review your countermeasures and training against social engineering attacks over time and improve or discard outdated information.

Waste management: Use a secure waste management service so social engineers can't gather information about your organization from the dumpster and use it to launch spear phishing or other targeted social engineering campaigns.

Multi-factor authentication: Require users to know something (password), have something (token) and be something (biometrics) in order to make a payment or perform a sensitive action.

Operations security: OPSEC is a process that identifies friendly actions that could be useful for a potential attacker if properly analyzed and grouped with other data to reveal critical information or sensitive data. By employing OPSEC practices, organizations can reduce the amount of information social engineers can gather.

Vendor risk management: It's no longer enough to solely focus on your organization's cyber resilience and cybersecurity. Third-party vendors are increasingly processing large amounts of personally identifiable information (PII) and protected health information (PHI), which makes them prime targets for social engineers who want access to personal data. Develop a third-party risk management framework, vendor management policy and perform a cyber security risk assessment before onboarding new vendors or continuing to use existing vendors. It's much easier to prevent data breaches than clean them up, especially once data has been sold on the dark web. Look for software that can automate vendor risk management and continuously monitor and rate your vendors' cyber security rating.

Leaked credential detection: It can be hard to know when credentials have been exposed during a phishing attack. Some phishers may wait months or years to use the credentials they collect, which is why your organization should be continuously scanning for data exposures and leaked credentials.

Who are notable social engineers?

Notable social engineers include:

Kevin Mitnick: Based in the United States, Mitnick is a computer security consultant, author and hacker, best known for his high-profile arrest in 1995 and five year conviction for various computer and communications-related crimes.

Susan Headley: An American hacker who was active during the late 1970s and early 1980s, known for her expertise in social engineering, pretexting and psychological subversion.

Badir Brothers: Ramy, Muzher and Shaddle Badir, brothers who were all blind from birth, set up an extensive phone and computer fraud scheme in Israel in the 1990s using social engineering, vishing and Braille-display computers.

Frank Abagnale: Frank Abagnale is an American security consultant known for his background as a former con man, check forger, and impostor while he was between the ages of 15 and 21. He may be the world's best known social engineer because of his best-selling book Catch Me If You Can that was adapted into a movie directed by Oscar-winning Steven Spielberg with Abagnale played by Leonardo DiCaprio.

What are examples of social engineering attacks?

The most famous social engineering attack comes from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy, where soldiers hid in a giant wooden horse presented to the Trojan army as a gift of peace.

A more recent example was the successful social engineering attack that led to the 2011 data breach of RSA. Attackers sent two phishing emails over two days to a group of RSA employees with the subject line of "2011 Recruitment Plan" and an infected Excel document that exploited an Adobe Flash vulnerability (CVE-2011-0609).

In 2013, Target suffered a massive data breach which started with a third-party vendor falling for a phishing email. The email contained a trojan and enabled the attackers to gain access to Target's POS system that resulted in the theft of 40 million Target customers' credit card details.

How UpGuard can prevent data breaches and data leaks

Companies like Intercontinental Exchange, Taylor Fry, The New York Stock Exchange, IAG, First State Super, Akamai, Morningstar and NASA use UpGuard to protect their data, prevent data breaches, monitor for vulnerabilities and avoid malware.

We're experts in data breaches, our data breach research has been featured in the New York Times, Bloomberg, Washington Post, Forbes, Reuters and Techcrunch.

UpGuard BreachSight can help combat typosquatting, prevent data breaches and data leaks, avoiding regulatory fines and protecting your customer's trust through cyber security ratings and continuous exposure detection. We'll monitor your organization's phishing risk too.

UpGuard Vendor Risk can minimize the amount of time your organization spends managing third-party relationships by automating vendor questionnaires and continuously monitoring your vendors' security posture over time while benchmarking them against their industry.

Each vendor is rated against 50+ criteria such as presence of SSL and DNSSEC, as well as risk of domain hijacking, man-in-the-middle attacks and email spoofing for phishing.

Each day, our platform scores your vendors with a Cyber Security Rating out of 950. We'll alert you if their score drops.

If you'd like to see how your organization stacks up, get your free Cyber Security Rating.
Book a demo today.

# data[].attributes.attachment_link.title
What Is Social Engineering? Common Examples and Prevention Tips | UpGuard

# data[].attributes.attachment_link.description
Social engineering is an attack vector that exploits human psychology and susceptibility to manipulate victims into divulging confidential information and sensitive data or performing an action that breaks usual security standards. In general, social engineering success relies on a lack of cyber security awareness training and a lack of employee education.

# data[].attributes.attachment_link.title
15 Examples of Real Social Engineering Attacks - Updated 2023

# data[].attributes.attachment_link.description
Learn what social engineering is by exploring 15 examples of real social engineering attacks involving Google, Facebook, Twitter, and more.

# data[].attributes.attachment_link.title
Social Engineering- The art of hacking humans | Prasad Sawant | TEDxElproIntlSchool