Page 2 of 7
Social Engineering Overview
Social Engineering is a con game relying on influence, social skills, and human interaction to obtain information about an organization or computer system. Logical network defenses, security appliances, and anti-malware protection get stronger every day. Over time, industry has strengthened our defenses and as a result, black hat hackers look to penetrate a softer target, the people in an organization, including employees, contractors, and customers by using a Social Engineering attack.
Cyber criminals achieve Social Engineering in many ways. Telephone, online, dumpster diving, shoulder surfing, and simple persuasion. In the right setting, someone can shoulder surf your information by simply watching what you type. You should tell them to step back if they're getting too close. Scam artists work on our emotions, and many times launch an attack that may promise gifts and prizes, important information, or threaten to take action if you do not reply.
Organizations can thwart Social Engineering attacks many times by employing user education and strong spam filters to prevent deceiving emails from getting through to the employees. There are many working parts to a Social Engineering attack, but of course at the heart of this is the victim. But the other components include motive, and that is why cyber criminals use Social Engineering. Reasons include: obtaining money, gaining access into a system, or causing damage to a system.
And method, this is how cyber criminals achieve Social Engineering, using human intervention or technology, or sometimes a combination of both. The hacker themselves must be able to pull off a believable hoax. And the tools used, they include: email, social media, webpages, phishing, or farming. And stimulus, or what is the best way to inspire someone into giving up information? Using fear, need for compliance, or appeal to his or her need for friendship, acceptance, or social validation.
A skilled hacker will most likely try to use Social Engineering before spending any time on more difficult methods to obtain a password, such as password cracking to obtain access to a system. Now getting someone to give up their password is easier than you think. Studies show that over half the individuals tested gave up their user name and password. Some gave it up freely, some for money, and some even for a bar of chocolate.
Social Engineering is one of the hardest threats to defend against. As a result, it should be part of an organization's ethical hacking exercise.