A colleague of mine asked "What are the configurations I need to have in the firewall to help me curb social engineering attacks?"

So I want to know whether I should respond with:

  1. Firewalls are not for stopping social engineering attacks. You have to look for other security measures.
  2. Yes, a certain set of settings can help to detect at least some of the social engineering attacks. If so, what kind of attacks?'

The scope is social engineering attacks done via mobile device or laptop in internal office networks.

  • 5
    It cannot stop two people from talking to each other, it likely cannot stop phishing links unless there is something very very obvious that deep packet inspection can discover, so I don't think stopping social engineering is a firewalls strong foothold. General awareness around what, why and how of social engineering maybe a better tool for it. – yetdot Sep 21 '16 at 11:45
  • 1
    That depends on the attack. What kind of social engineering attack do you have in mind? – Philipp Sep 21 '16 at 11:45
  • This question is discuessed on meta. – Anders Sep 22 '16 at 20:21

Generally: No, a Firewall is not to stop social engineering attacks.

The reason for this answer lies in the nature of Social Engineering - Social Engineering is about manipulation people, not about computers.

And while Firewalls of all kinds are a good tool to prevent attacks on your infrastructure, they are not a good tool for protecting your staff.

The most common type of social engineering happens over the phone. Other examples of social engineering attacks are criminals posing as exterminators, fire marshals and technicians to go unnoticed as they steal company secrets. Source

And as long as people are able to do bad things, there might be a way to trick them into doing it. To prevent Social Engineering, you need to increase security awareness among your staff.

Additionally, establishing technical safeguards like restriction of access rights, Data Leakage Detection / Prevention and operational safeguards like segregation of duties might make Social Engineering attacks harder to perform.

| improve this answer | |
  • 2
    You can usually use a firewall to limit access such as so the fruits of a social engiinering attack is of no value to the attacker. Imagine you configure the firewall to only allow Submission/IMAP access from computers belongning to the local branches. Then a email password which was social engiinered by a attacker, is of no use of the attacker, since he don't have the required access to be able to authenticate with the password. – sebastian nielsen Sep 22 '16 at 4:23
  • 2
    And in same way you could prevent it by also internally separate things. The receptionist's computer doesn't need to be able to login to the core server, even if correct password is specifyed. So by limiting in this way, any sensitive authentication data gained by a social engiinerer becomes less useful for that attacker. – sebastian nielsen Sep 22 '16 at 4:30

It won't be very helpful by firewall, but it depends on your firewall inspection level.

For example, Application layer firewalls can help to prevent these attacks:

  • Phishing attacks: using e-mail and websites filtering, you can prevent 'noobie users' to open social engineering hosted sites.
  • Information leaking: by filtering and monitoring important data, this is based on your company policy.

Basically, Social engineering attackers understand that employees are often the weakest link in a security system, so if you need to stop social attacks, the main security measure is to educate users.

From Cisco official site:

Some security software is available to combat phishing and pharming, but the best defense against the full range of social-engineering attacks is a corporatewide culture of security awareness.

| improve this answer | |

By definition of social engineering: No, of course not. Social engineering is something where an attacker tries to manipulate a target e.g. by faking an identity or by gaining the trust of the target person by some other way to do something the target person wouldn't do under normal circumstances. This can be (the possibilities are almost unlimited): Revealing confidential information. Inactivate a safeguard to a sensitive object. Etc. etc.
This is an absolutely non-technical thing, so the answer to your question must be "no", it's like "can I stop rain with firewalls".
Of course social engineering is often combined with some hacking activity. But there are hardly technical controls which can prevent this from happening, sometimes the target persons that are being socially engineered believe they are doing a completely legitimate action.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.