How to educate users about the dangers of social engineering?

Question

What would be the best way to teach and test employees on the topic of social engineering?

What topics would you include?

Answer 1

I work as a technical/customer support representative and have to be aware of Social Engineers on a daily basis. The thing is it's hard to explain why it's effective to a group of people that have not done Customer Support. So, here's what I'd have you do:

• Have everyone that has worked a customer support job recall that experience (raise their hands and tell stories about pleasing the customer and how that eventually becomes the goal of the position; try to get them to express the mindset of not wanting to let a customer down and specifically if they've ever broken policy for a customer)
• Then, transition to how people take advantage of that desire to help the customer (which is typically by pretending to be a person they're not)

That's brief, but basically prepare customers by telling them that malicious people will pretend to be someone (or something, such as an authority or business partner) to gain information. And that they'll often use information that's freely available to make their story more convincing.

One good activity might be to have people play a game like "two lies, one truth." Ultimately, from my experience, it comes down to having a sound business policy that limits the damages of Social Engineering and prevents it.

Answer 2

Here are some ideas:

• Create a capture the flag game with a digital file (and whoever can social engineers it wins)
• Show some examples in real life how people try to manipulate others to find out private information about them (for example: conditions they might have), this tends to help people understand better what social engineering is.

Hope this was helpful, Pesach