SOCIAL ENGINEERING | 5 MIN READ
Those who carry out social engineering attacks have many tricks up their sleeve. They rely on deception and basic human psychology to steal your personal information. As a Managed Service Provider, we understand the cyber threat landscape, which is why we aim to educate our audience about threats to look out for. Keep reading to learn what social engineering is, the different types, and prevention tips.
Not enough time? Jump to:
How to Prevent Social Engineering
What is Social Engineering?
The online dictionary refers to social engineering as the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes.
While computers are designed to be perfect and make no mistakes, hackers know that humans are prone to errors. After all, if you're a business, it only takes one employee who accidentally reveals the login to a sensitive account for a hacker to have access to all your private information.
Hackers have various tricks up their sleeves that they use to trick victims into revealing personal information such as account logins, which we'll further explain below. But no matter what tactics they use, once they have your information, the consequences are the same.
If a hacker gets certain financial information, they can commit forgery, fraud, or robbery. Some hackers sell the account logins they steal in master lists on the dark web. If a hacker accesses accounts containing sensitive information, they can even encrypt those files and hold them for ransom.
These scenarios leave businesses in a precarious situation that poses a risk to their financial well-being and their reputation.
RELATED: How Does Ransomware Work?
Types of Social Engineering
While the minutiae of social engineering is constantly evolving, the list below describes a few basic forms it can take.
Phishing
The most common form of social engineering is phishing. It involves hackers creating emails disguised as a trusted source like your bank. Within the email are malicious links disguised to look like reputable ones.
When a victim clicks one of these links, malware is downloaded onto their computer, which can wreak havoc on the computer’s hard drive or encrypt valuable files to be held for ransom.
Phishing preys on human psychology by instilling a sense of urgency so the victim reacts quickly without thinking.
A phishing email could be a fake email from your bank saying that you need to click a link to log into your account or you'll lose access. Another variation could involve an email seeming to come from a friend saying to click a link to view an embarrassing photo they found.
RELATED: What Is a Whaling Attack?
Baiting
Baiting involves leaving malware-loaded flash drives in a public space for someone to find. The person who picks up the flash drive might plug it into their computer, either to try and find the owner or out of sheer curiosity. However, when they do plug the flash drive in, malware is loaded onto their computer.
Once malware is on your computer, a hacker can use it to access your personal documents, wreak havoc on your computer, and more. While baiting is pretty uncommon, it is still a social engineering tactic that you should be aware of.
Vishing
Also known as "voice phishing", this social engineering tactic involves an attacker employing impersonating techniques via a phone call to trick the victim into revealing personal information such as credit card numbers.
For instance, a voice phishing scam could involve a hacker calling a victim posing as the authorities, stating that they caught the victim browsing illegal websites and they will arrest the victim unless they pay a fine over the phone.
Sometimes, attackers will do a little research before making a vishing call so they know just enough about the victim to add in convincing details. Vishing is becoming increasingly common as cyber attackers evolve their tactics.
RELATED: Future Social Engineering Trends
How to Prevent Social Engineering
If you are a business, you can prevent your employees from falling for social engineering schemes by educating them on what they are and how to avoid them.
Educational cyber security programs train employees on ways to avoid common social engineering schemes as well as how to create secure account logins. You can even send out phishing tests to all your employees.
Phishing tests are a fake version of a phishing email that are sent to all employees. All employees who fall for the fake scheme and click the link in the email will immediately be sent to a within your company and send those who fall for them to a cyber security seminar.
Here are a few general tips you can follow to avoid falling for social engineering schemes:
- Pause. Before opening an email or clicking a link on a website, examine the source and its intentions. For instance, if you're on a website and are about to log into a personal account, double check the URL and make sure that you're actually on the correct website and not a fake one designed to resemble the real thing.
- When in doubt, copy and paste links. If you see a link from a source that seems a little untrustworthy, copy and paste it into a search engine. If it shows up in the search results and seems legitimate, then you know the link won't download malware on your computer.
- Be cautious about downloads. If an email coming from an external source or a website asks you to download something, be extra cautious. Hackers can easily manipulate download links to install malware on your computer.
- Be wary about messages and links that instill a sense of urgency or fear in you. When we are afraid or feel pressured to make a decision, we don't always think clearly. Hackers use these psychological tricks to carry out social engineering attacks. For instance, if an email tells you to click on a link right now to change your password or you'll permanently lose access to your account, that may be a social engineering scheme at work.
Need help in setting up cyber security educational programs? A Managed IT services provider can assist.
Since they manage your cyber security, they can identify specific weak spots in your network and help mold an educational seminar to fit your company's unique needs.
Avoiding social engineering schemes can prevent you from having you or your company's information sold on the dark web. Read our definitive guide to the dark web so you know how to stay protected.
Want to Learn More?
Network Security Threats of 2018
How Does Ransomware Work?
Phishing Tips - A Simple Guide to Avoid Malicious Emails
Why Your Employees Are Your Biggest Security Risk
What is Downtime Cost?
