Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members requires trust that, in this day and age, is hard to pass along.
What strategies do modern businesses use to ensure that employee activity is secure, mitigating the risk of invalid server access in an automated fashion?
You cannot prevent social engineering entirely, so you need to work on damage limitation. Social engineering only works on people who have the privilege to do something, or know something important. If you remove the sensitive information and risky privileges, you massively reduce your security footprint.
What you're looking for is separation of duties, combined with proper authentication. That is, you give each user the absolute minimum privileges they need to do their job, but allow them to escalate a task or procedure to a superior that has the required privileges, or pass the operation onto an alternate department that has the required privilege. You also provide proper authentication mechanisms to enforce identity.
For example, in a bank you might give the call centre staff the ability to change your credit limit, but not the ability to flag a transaction as fraudulent. The fraud department would be able to flag a transaction, but not change your credit limit. Furthermore, the call centre staff could not approve a loan directly, but would be able to send the loan application to their manager, who can approve or reject the application. All access to the system should be enforced by a password and hardware token (e.g. swipe card, RSA Securekey, etc.) at minimum, so that identity is enforced and a chain of custody can be proven.
In order to access privileged locations (e.g. server room, or a login via SSH) you should require multi-factor authentication. Social engineering is effective at getting things you know, but nowhere near as effective at getting things you have or are. Use proper physical security and digital authentication that requires two-factor or three-factor authentication in order to gain access. In cases where a highly sensitive asset is being accessed, require multi-factor authentication from more than one employee.
On top of all of this, use audit logging everywhere. Every single change that a person makes should be logged, with appropriate measures taken to ensure that logs cannot be destroyed or falsified. This provides a way to identify problems, and leaves you with legal recourse should an employee do something malevolent.
The best way to automate the process is to make social engineering impossible. For example, if passwords are not stored, then no amount of "please could you tell me my password" will work.
In cases where allowing human intervention is necessary, make sure that exceptions to standard procedures are flagged and pushed upstairs proportionally to the degree of deviation. About every third time I'm in a supermarket, some glitch occurs and the checker has to wave-in a supervisor to do some meaningless clearing process. It seems meaningless because it's routine, but I presume it's intended to keep some type of fraud from happening.
I do not want to sound trite, but the best automated process is to not allow your employees admin access.
Assign permissions as needed for them to do their job, when they need them. Create global alerts whenever anyone is assigned to admin groups.
This limits the damage one user can do, and it is easier to automate monitoring of their actions, as well as when and how you assign temporary privs.
It is annoying and inconvenient, but it is fundamental: least privileges.
Truthfully, I think automating something is one of the worst things you can do to prevent a social engineer attack. Humans are dynamic, and as such so do the strategies you employ to prevent a human from compromising your system with social techniques.
Take for instance if you call your cell phone provider. I know that my cell phone provider is going to ask for my address and date of birth. This, in essence, is poor security because if I was planning to attack a target all I would need to find out would be that information. The employees are simply drones asking the questions put in front of them.
A more secure (albeit, more troublesome) solution would be to periodically change security questions. You could ask a wider variety of questions, or ask customers to answer new (randomly selected) security questions every 6 months.
Past efforts to automate security (see RSA attack or Google two-factor authentication) have proven to be less effective than hoped.
