Social Engineering and Phishing

In this blog post, we will explain what social engineering and phishing actually are, and how to protect yourself from such attacks.

• Social Engineering
• Phishing
• How to prevent Social Engineering Attacks?
• Wrapping-up

Social Engineering

Social engineering can be considered one of the attack vectors, which directly depends on human interactions. It mainly utilizes psychological manipulation to trick users into making security mistakes or giving away sensitive information, such as gaining unauthorized access to systems, networks, or physical locations or for financial gain.

Social engineering is always part of a con, which can be described as taking advantage of the fact that the perpetrators and their victims never have to meet in real life. The main objective usually involves getting critical credentials from the victim or affecting their system to utilize. Here are some examples:

• Obtain usernames and passwords.
• Install malware on their device.
• Send money via electronic fund transfer, money order, or gift cards.
• Authorize a malicious software plugin, extension, or third-party app.
• Act as a money mule for the purpose of laundering and transferring illicit funds.

Phishing

Phishing is one of the best-known forms of social engineering. The idea is to send a very realistic email to entice victims to click on a link, and then enter passwords or other login information on a fake website so attackers can collect that information.

In addition to mass phishing emails, a more targeted form known as spear phishing is also spreading. In these cases, emails are tailored to a small group of people, individuals, or employees before they are sent.

What is Phishing?

Phishing is a most popular type of social engineering attack that is always used to steal users’ critical data, including login credentials and credit card numbers. It occurs when an attacker pretends to be a trusted entity and tricks the victim into opening an email, instant message, or text message. The recipient is then tricked into clicking on a malicious link; this can lead to the installation of malware, a system freezes as part of a ransomware attack, or the disclosure of sensitive information.

Scammers are widely using emails to trick you into giving them your personal information. They may try to steal your passwords, account numbers, or social ID numbers. If they get that kind of information, they could manage to gain access to your email, bank, or other accounts.

Phishing emails may look like they’re from a well-known company you know or trust. As well as, they may look like they come from a prestigious bank, a social networking site, an online payment website, or an online store.

Phishing emails often tell a realistic story to trick you into clicking on a link or opening an attachment. They,

• Could say they have noticed some suspicious activity or log-in attempts
• Could claim there is a problem with your account or your payment information
• Could say you must confirm some personal information
• Could include a fake invoice
• Could offer a coupon for free stuff

How to prevent Social Engineering Attacks?

“Did you know that the majority of successful social engineering attacks, mostly by Phishing, are caused by human error?”

Social engineering attacks, including ransomware, business email compromise and phishing, are problems that can never be solved. They can only be managed through continuous security awareness training. In addition, phishing emails are increasingly difficult to detect these days, and some can be missed by even the most attentive users. No matter how big or small your company is, you will also be affected at some point by phishing attacks.

You can follow these basic steps by yourself to avoid it: 

1. Never give your personal details in response to an insecure request, either on the phone or on the internet.
2. If you believe the contact may be legitimate, you should also contact the financial institution yourself.
3. Never give your private data such as user name, e-mail, or password.
4. Review account statements regularly to ensure all charges are accurate. 

To-do List (measures) Against Social Engineering & Phishing:

However, as a company, there are more important ways to ensure your security in terms of Social Engineering. Here is a basic to-do list:

1. Start with a basic phishing security test to determine your organization’s basic Phish-prone™ Percentage.
2. Step users through interactive, new-school security awareness training.
3. Run frequent simulated social engineering tests to keep users on their toes with security top of their minds.

Finally, every company should conduct and pay attention to comprehensive cybersecurity training for their employees. Next to phishing, ransomware attacks are a prevalent way hackers operate. Every employee must be aware of ransomware and phishing schemes and know their part in identifying, detecting, preventing, and remediating this kind of cyberattack.

Pro Tip: Have your company checked by professionals. Social Engineering testing can be a part of the pentest package or could be implemented separately. In both cases, experts will simulate a social engineering attack. If you want to learn how we can help you, you can visit our Penetration Testing Services page or read our Blog Post: Pentest Methodologies.

Wrapping-up

Social engineering penetration tests can be a great way for a company to test its security posture at the weakest link of its organization’s technical areas. These pentests can be conducted by either an internal auditing team or an external company that specializes in penetration testing.

Both have their pros and cons, for instance, internal teams save money but do not provide an unbiased opinion whereas external companies provide an unbiased opinion.

Unfortunately, there is no single fool-proof way to prevent phishing attacks, however, all tips outlined in this article would have a vital role to improve your safeguards against these variants of attack. You can train yourself to identify and prevent phishing attacks, moreover, can use security means such as phishing-resistant Multi-Factor Authentication and firewalls. All in all, training your employees, friends, and family members to increase the general awareness of phishing would be the cheapest, most convenient, and most viable way to deal with social engineering attack vectors.

About the Author

Can Adiguzel is the founder of 360 Digital Transformation. He is a TISAX consultant and ISO 27001 Lead Auditor. He has been working in IT project management for more than 11 years. His passion is information security for SMEs and he helps SMEs overcome their information security challenges with a hands-on consulting approach.