1.8.3 Social Engineering

Question 1

Social Engineering

Answer 1

The weak point in network security packages is often the people.
Social engineering is a form of attack that involves tricking people into giving away critical information or access details.

Question 2

Cold Calling

Answer 2

Social engineers often cold call victims and pretend to be from an organisation such as:
A bank.
A utility company.
The social engineer will then ask a victim to confirm their details, so that they can use these details to access their account later.

Question 3

Fear

Answer 3

Fear is often used to put people off-guard and make them more likely to comply.
Social engineers know that people will make irrational decisions when panicked.
A common attack would be to call someone pretending to be a bank, and ask why they have emptied out their account:
This would panic the victim, who would then want to sign into their account straight away over the phone.

Question 4

Education and Training

Answer 4

The most effective means of protection against social engineering is education and training.
People are made aware of the tactics of fraudsters:
This makes it more likely that they will recognise a fraudulent phone call.

Question 5

Public awareness campaigns

Answer 5

Banks and governments often run public awareness campaigns to educate members of the public about the risks of social engineering.
These often include case studies of what could happen if people do not take care.

Question 6

Company security policies

Answer 6

Company security policies include instructions that employees must follow to uphold security.
For example:
Don’t discuss a user account without the user having confirmed their PIN number.

Question 7

Phishing : The Attack

Answer 7

Phishing uses fake emails and websites to trick people into giving away their sensitive data.
Emails are sent to thousands of people, claiming to be from a known service such as a bank or utility provider.
Victims are taken to a realistic looking but fake version of the site where they log in. This gives their details to the attackers.

Question 8

Phishing : Protection against Phishing

Answer 8

Never click a link in an email that asks you to update or enter your account details.
Check that the sender’s email address is correct.
Look for clues that the email is not legitimate such as spelling mistakes or generic greetings.