Social engineering

As a security professional in today’s ever-changing world, it is important to be familiar with Social Engineering techniques and the counter-measures available to reduce the likelihood of success. By having this knowledge, one can ensure appropriate (preventative, detective and corrective) measures are implemented to protect the staff and assets of an organization.

What is Social Engineering?

Social engineering is a type of attack where scammers trick people into giving them access to sensitive information through a combination of manipulation and human.

Social engineering techniques — including phishing, smishing, vishing, and in-person attacks — take advantage of a victim’s trust in order to evade perimeter defenses and steal data, access confidential networks, and could lead to financial loss, reputational loss oe compromised credentials and accounts. This could be the first initial steps of realistic, comprehensive attack by an attacker which over the years have increasingly become more convincing and successful.

'Social Engineering' is a threat often overlooked but regularly exploited; to take advantage of what has long been considered the 'weakest link' in the security chain of an organization – the 'human factor'. 

Who performs these attacks?

“Social Engineering Threat Actors” build relationships and take advantage of the human tendency to be open and helpful, all in an effort to steal data, access confidential networks, and run other scams. Attackers (including criminals, scammers, advanced attackers, cybercriminals) could be running anything from low-level scams to complex attack campaigns by advanced attackers 

Attackers are experts who understand that humans are often the weakest chain in an organization’s security and know how to earn your trust, hijacking your typical thought process to make you cooperate on their behalf. These interactions can seem so routine that you may not realize your mistake even after the crime has been committed. Social engineering can range from a malicious link in an email to a "friendly" visitor in the office.

How to build awareness around social engineering? 

Socially engineered attacks are centered on people, not technology. Individuals should be educated on being able to recognize and report attempts that get through.

BSI have significant experience performing social engineering exercises across a broad range of organizations. This exercise can give an organization an appreciation of their information security awareness posture , determine the feasibility of an attack of this nature and their susceptibility.

Before an engagement is undertaken our consultants work with our clients for each exercise on a case-by-case basis to determine requirements, objectives, restrictions scope, etc. prior to progressing. . 

Proofpoint Security Awareness Training

Social engineers build relationships and take advantage of the human tendency to be open and helpful, all in an effort to steal data, access confidential networks, and run other scams. Our partner, Proofpoint’s, interactive training modules go beyond the phishing threat and explains the dangers associated with smishing, vishing, social media, and in-person attacks. Your employees will learn how to recognize and avoid common social engineering techniques and keep your people, areas, and assets secure.

This solution offers a variety of customizable security awareness materials, including posters, images, and articles, all designed to make cybersecurity an ongoing topic of conversation with your end users. Use these materials to raise social engineering awareness, reinforce good behaviour, whilst reducing your vulnerability to these threats.

--

Richard Lambe, Cybersecurity Solutions BDM

Get in contact to learn more about our Social Engineering Assessments

Social Engineering Assessments

People tend to be trusting and helpful by nature and can often be manipulated into providing access or giving away sensitive information. Our Social Engineering Assessments using publicly available methods to research potential weak points within the social structure of the target, designing and using social attacks, and other deceptive techniques to extract account credentials to access controlled systems and/or environments

BSI make use of a mix of passive reconnaissance and active social engineering techniques to perform our social engineering assessments.

Prior to any testing, the terms of reference for the engagement are set out and agreed. This includes items such as the scope and duration of the engagement and legal indemnification to perform the assessment. This agreement will specify the methods of contact, levels of interaction and any other constraints that are required.This clarifies that all testing is performed using a recognised security assessment framework, and also that all actions are performed within the applicable laws of a given territory.

Passive reconnaissance 

Passive reconnaissance is used to passively gather information about the target organisation’s people, technologies and data. Depending on the scope of the engagement, this will typically focus on key staff such as Directors & Board members, Senior Management, organisation structure, key IT staff and systems, the IT/Support Helpdesk and sensitive data (e.g. intellectual property). Interrogating the publicly available information, BSI can demonstrate the demonstrate the feasibility of an attacker to perform a successful social engineering or spear phishing attack and perform prioritized target enumeration.

Active social engineering techniques

Once the targets are enumerated, active attacks are performed against selected targets and locations. A number of options are available for active social engineering assessments based on the client requirement. A sample of methods available are described below.

1. Spear-Phishing

BSI will target an agreed list of personnel by sending a specially crafted email to them in an attempt to glean sensitive or privileged information. BSI will attempt to lure the targets onto a BSI controlled website requiring a login. The website however will be setup to appear similar in look and feel to the organisation’s corporate sites and will request their corporate username and password.

Objective: Obtain corporate or remote access usernames and passwords

2. Telephone

BSI will test the current security awareness of the organisation’s personnel by phoning staff members and requesting details that should not be given out to unauthorised callers. BSI will use scenarios based on customised information gathered to call users and attempt to convince them to provide sensitive information to the unauthorised caller.

Objective: Obtain sensitive corporate information and / or usernames and passwords

3. Physical

BSI consultant will go onsite to the organisation to attempt to gain access to areas which should be restricted to employees only. BSI will attempt to use techniques such as:

• Tailgating to gain access to restricted areas
• Shoulder surfing to gain sensitive information such as employee credentials
• Attempt to install physical key loggers onto employee computers

Objective: Obtain physical access to sensitive areas / computers, obtain usernames and passwords

--

Shane Ryan, EVP of Professional Services

Get in contact to learn more about our Social Engineering Assessments