Social Engineering in Cyber Attacks by Jarryd Allison

allisonj28 — 2024-03-03 02:50:53 UTC

What is social engineering?

Deceptive and manipulative techniques to expose information. Most people inherently default to being helpful to avoid conflict. This trait opens them up to exploitation as they may reveal private or sensitive information.

Phishing:

Emails designed to look legitimate that actually contain ransomware. Don't open attachments or emails from people you don't know or companies you aren't in business with.

Pretexting:

Using person to person interactions, usually over the phone, to access sensitive information.

Baiting:

Similar to phishing, but incentivizes clicks with tempting offers and prizes (which are of course fake).

Quid Pro Quo:

Offering a practical service, but instead hacking or installing malware on a target.

Piggybacking:

Following employees into areas of restricted access.

allisonj28 — 2024-03-03 02:58:52 UTC

Stealing $100M!!

https://www.justice.gov/usao-sdny/pr/lithuanian-man-pleads-guilty-wire-fraud-theft-over-100-million-fraudulent-business

allisonj28 — 2024-03-03 02:59:34 UTC

Targeting the Department of Labor

Additional Articles

allisonj28 — 2024-03-03 03:00:21 UTC

allisonj28 — 2024-03-03 03:00:59 UTC

Videos

allisonj28 — 2024-03-03 03:02:28 UTC

allisonj28 — 2024-03-03 03:03:40 UTC

allisonj28 — 2024-03-03 03:04:07 UTC

allisonj28 — 2024-03-03 03:04:20 UTC

What are some of the most common ways social engineering affects cybersecurity?

allisonj28 — 2024-03-03 03:06:23 UTC

Social engineering affects cybersecurity by introducing new exploitable gaps in an organizations cyber defenses...namely, people. Through pretexting, phishing, and other methods, hackers are able to bypass the most technically proficient security measures and gain access simply by getting someone to answer the phone or open an email.

What can we do to help prevent attackers from leveraging social engineering for their own benefit?

allisonj28 — 2024-03-03 03:09:40 UTC

The best thing we can do to prevent attackers from leveraging social engineering attacks is to provide education and training about the methods employed. Training "phishing" emails to increase individual vigilance, examples of phone calls, and other annual training requirements are a great start. Additionally, limiting access for those on the front lines, and segregating the data so no one person has access to the entire system provides an excellent moat against these types of attacks.

How do cyber attackers leverage social engineering to go after a target?

allisonj28 — 2024-03-03 03:14:04 UTC

Typically, there is at least some effort, oftentimes much effort, to gather information about the target from publicly available sources like LinkedIn, Facebook, etc. Then, based on the information gathered, and probably with multiple targets in mind, the hackers will employ a variety of techniques to see what sticks. If pretexting, then they will target empathetic or sympathetic responses. If phishing, they will try to incentivize clicks and make them look legitimate. It's target dependent, and we can expect that multiple efforts will be made using a variety of methods, not just one.

What is social engineering?

allisonj28 — 2024-03-03 03:17:33 UTC