Social engineering revolvesrevolves around psychology. It tries to influence human behavior to gainreach a goal, and unfortunately it often works quite well. In my opinion the best way to educate people is by example. An interesting video is the Social Engineering LIVE demonstration from Defcon.
Most of the time a social engineer will be required to take the initiative, either by sending an email, makemaking a phone call, or even transmitting a fax (as was first presumed in the Rapid 7 DNS hijack). ThereHere are threea few questions you should ask yourself:
- Who is contacting me here? (rememberRemember, most contact details can be found on the internetInternet!)
- Why is he contacting me?
- Is the way he's contacting me normal for this company?
- Is the information he's requesting sensitive?
- Is there a way to verify that this is indeed this person?
A good approach is to use two seperate communication channels which have been established up front. For instance if you get a phone call from a certain person who's requesting that you to perform some action, you put down the phone and call that person back using credentials from a trustabletrusted source. For instance if someone is calling from the helpdesk, check their extension number and name. Then look it up in your companies internal phonebook and see ifwhether it's the same. You might want to call them back yourself and see ifwhether it's still the same person. NEVER EVER use phone numbers provided by the person itself (for this example anyway).
An example for this is the recent Microsoft support scam where attackers pretended to be Microsoft technicians. They let youVictims were instructed to open a cmd
cmd and execute a command, and then the attackers stated "hey, I'm Microsoft because I can do this". They then started to ask you if you couldfollowed this by requesting that victims shut down yourtheir anti-virus and any other security mechanisms. If you do find thisIn cases where victims grew suspicious they will start by pressuring you, the attackers would apply pressure in other ways.
In the case of companiesa company, especially when there are procedures in place for authentication and verification, it must be ensured that there are no loop holes where thereprotocol can be a bypass of protocolbypassed. I recently heard a story of a person trying to increase his credit card limit (often used by scammers to increase their spending ability after stealing a credit card). The person did not get his increase because he couldn't be authenticated. Which is good! But then he called customer support, got really angry and threatened to change bankbanks. Customer support responded, while not by increasing his credit limit without even tryingattempting to authenticate the person,by increasing his limitshim. This shows how presurizingis just one example of pressuring people can be donefor nefarious purposes.
Non-IT minded people might get tricked by this so to educate them give them several examples of social engineering attackattacks. A good piece of advice by David Schwartzberg:
What toshould you do if you are a victim?