Social Engineering

Social engineering is a cyberattack based on deceiving users or administrators at a target site into revealing confidential or sensitive organizational or personal information for different motives.

An organization establishes different mechanisms and security controls to safeguard its valuable data. These controls may include encryption, firewalls, access controls, identity and access management, IDS/IPS, policies, standards, personnel security, SIEM, physical security, NAC, security awareness and training, backup, endpoint security and so on. Moreover, people are fundamentally the weakest link and at the same time the key security asset in the security chain of the organization

Social engineering is a type of cyberattack that manipulates and exploits human being’s nature and behavior. This inherently emanates from negligence, trusting, mistake making, easily fooled, fear, desire and so forth characteristics of people. Hackers exploit these natural traits to reveal confidential information and gain unauthorized access to organizational and personal assets.

Hackers exploit these weaknesses to launch various cyberattacks on enterprises. And the best countermeasure to address these delicate attacks is conducting proper and tailored personnel training and awareness raising programs. Crackers regularly launch crafted social engineering attacks on organizations and individuals to avert and evade security controls. They launch these attacks for financial gains, grudge, spying, political or religious belief, corporate espionage, blackmailing and so on motives.

Whys hackers frequent and prefer these attack techniques? Because, unlike exploiting technical controls, focusing on the weakest link, i.e. human being, makes them more productive and effective in penetrating into infrastructures and services and thereby wreak havoc and disrupting businesses.

Common social engineering attacks include, but are not limited to:

• Phishing: Phishing is a form of social engineering attack. It focuses on stealing credential information and identity theft from potential targets and preys through various mechanisms.
• Eavesdropping: An eavesdropping is a social engineering attack which involves maliciously listening to communication traffic and unguided conversations on downstairs.
• Shoulder Surfing: This social engineering attack involves managing to watch when user types on their keyboards and view information on displays.
• Dumpster Diving: This is a form of social engineering attack which involves digging through trashes order to obtain information about a target organization or individual.
• Impersonation (Masquerading): This attack involves the act of taking on someone else’s identity to launch subsequent attacks.

All in all, social engineering attack is the art of human hacking.