Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -2 down vote favorite

Thinking about this week's topic I thought of something I would love to hear more about:

What is so special about Social Engineering? Is SE a bigger threat than breaking-and-entering?

This is not about if the threat is real or not, I think it is, but I have this feeling that people are treating it differently than other attacks. Like it was "THAT THING", the holy grail, quantum cryptography, only real. Even the Topic suggests so "The often-overlooked people-related side of security".

I feel like it is sometimes used as a thought-terminating cliché, sometimes for smugness.

Conning and breaking-and-entering have been around since time, but people talk and worry a lot about the first and not the latter.

Is SE a bigger threat than breaking-and-entering?

share|improve this question
2  
This is quite a loaded question, and could do with being edited down for neutrality. Please try to state the question without bias, otherwise you risk getting answers consisting entirely of opinion and very little fact. – Polynomial Aug 12 '12 at 13:13
I am working on it, but it is hard. Also this questions is being voted down, but I think the question is valid when comparing SE to other attacks. – Tie-fighter Aug 12 '12 at 13:25
@Tie-fighter It is hard to answer the question objectively. All answers given will be subjective and open to discussion. – Terry Chia Aug 12 '12 at 13:28
2  
@Tie-fighter Discussion isn't encouraged here. Unless you can edit it to fit the site better, it would probably be closed. – Terry Chia Aug 12 '12 at 13:31
1  
@Tie-fighter The entire of StackExchange has guidelines as to what types of questions are allowed. Subjective questions are likely to produce opinion, not fact, which is bad for the site. – Polynomial Aug 12 '12 at 13:33
show 2 more comments

closed as off topic by Hendrik Brummermann♦ Aug 12 '12 at 16:11

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

1 Answer

up vote -3 down vote

No, social engineering is not hyped at all. Advancement in modelling, datamining and all-present connectivity allows whole new range of attacks and protections based on it.

Analysing / modelling the society via multiple layers in real-time - finance, travel, police record is one part of it - see Domain Monitoring System.

Also social engineering can be used to break thru the protection when encryption cannot be cracked, hence it's a major part of the security.

Social engineering has to do also with stupidity of the users, hence the education and training is also very important. Actually this is the true nature of the social engineering. If Mat Honan would have basic training on how to keep his data secure, he would definitely avoid this kind of hack.

And user training is in pair with crypto, as in the question. Simply not enough training cannot be mitigated with stronger crypto, which secures the layers. When you login with password, you are using crypto to get access to another layer. Because of that both SE and crypto are equal threat, if there was either poor training, or poor crypto, both weaken the system the same way and affect the same thing - authentication.

share|improve this answer
This doesn't really answer the question. You've not provided any objective analysis of any part of social engineering, nor have you compared it to other types of attack. Just yet more opinions about the "evil government" and a random quip about Mat Honan. – Polynomial Aug 12 '12 at 13:31
2  
Andrew - not only do your comments not make any sense, WE DON'T USE COMMENTS FOR DISCUSSION. THIS IS NOT A FORUM! Also, answer edited to remove tinfoil hattery. – Rory Alsop♦ Aug 12 '12 at 15:40
OKOK I just wanted to tell about dual nature of authentication - that it can be challenged with analysis of human factor and physical attack on crypto, like breaching into email and breaching the PC. – Andrew Smith Aug 12 '12 at 17:15
1  
@curiousguy You pedantic bugger ;) – Polynomial Aug 12 '12 at 22:46
1  
@AndrewSmith "Yet I see the bottom of this that the idea of the physical security belongs to person, and not cloud." I have no idea what you are trying to say. Anyway, what matters here is that both Amazon and Apple cloud customer support failed, and pretty badly. – curiousguy Aug 13 '12 at 2:17
show 3 more comments

Not the answer you're looking for? Browse other questions tagged or ask your own question.