>> Hello. Let's talk about Social Engineering.
This is a type of attack that is
geared at internal employees.
Social engineering attacks are by
far the most common direct confidentiality.
In Chapter 1, we actually already talked
about social engineering when we talked about phishing,
spear phishing, whaling, vishing.
I don't know if I mentioned smishing,
which is using SMS text messages.
The bottom line is, phishing,
is all about the impersonation of
someone that should have access to resources.
However, they really should not.
It's means showing up in
a brown uniform and saying I'm a TPS.
Can I get access to the backroom
so I can deliver this package?
Social engineers are really
talented and often successful.
People fall for them because they want to be
helpful and want to avoid conflict.
Social engineers rely on
a lot of principles to do what they do.
They use the principle of
authority by being confident and
giving the impression that they should have
access to something they shouldn't.
They use the principle of scarcity.
Like a salesperson at a car
dealership who suggests that you
better buy the car now
because it might not be there tomorrow.
Social engineers give the
victim the impression that they will get
something precious but they need to respond right away.
Like offering a low-interest loan
to the first 100 people who sign up.
They use the principle of intimidation,
where they are very confident and aggressive and
coerce someone into giving them what they want.
They use the principle of consensus
to convince someone that
everybody else is doing
a certain thing so they should do.
They use the principle of urgency,
where they emphasize that they need something right
away such as for
an important meeting that is about to start.
They rush you into making a decision
quickly without considering the risks.
They use the principle of familiarity,
claiming to know someone you know,
so you will trust them.
They use the principle of trust.
Similar to familiarity,
they use some play to suggest that you should trust them.
This is like someone dressing like a police officer.
You will trust what they say and do what they ask you to.
To mitigate threats with social engineering,
we normally think about training,
but training can't solve everything.
We need good policies in place,
such as separation of duties,
least privilege, and need to know.
We also need to conduct
social engineering pen tests from time
to time to see if employees are following the policies.
Social engineering today is our greatest threat.
It's important to note that also with social engineering,
it's more than just phishing.
An example of social engineering
that involves a person getting an access
to your workspace is called piggybacking or tailgating.
This is where you swipe your key card to get
into the building and a person slips in
behind you or ask you to hold
the door without using their own card to get in.
The best defense against that threat
is have a security guard and a man trap.
A man trap is an area of dead space where you go
in-between the building and where you enter
the rest of the organizational space.
The security guard can monitor
that man trap area to
catch people who are trying to slip in.
Dumpster diving also can
be considered social engineering.
It means someone going through the trash to find
valuable information that people have thrown
away instead of putting it in the shredder.
Another form of social engineering is shoulder surfing.
This is where someone stands
behind you and looks over your shoulder.
They may be looking at your computer screen or
an access pad that you were typing a passcode into.
Our best defense against social engineering is to
train our people so that they know what to watch out for.
Also, we need to implement
the policies of separation of duties.
Need to know and least privilege.
People only know the minimum that they need
to know and only have the access
to the minimum amount of systems and
information that they need the access to.