Social Engineering

Question 1

Name examples of SE.

Answer 1

Posing as a fellow employee (easier in a large
organization)
Posing as an employee of a vendor, partner company, or
law enforcement
Posing as someone in authority
Posing as a new employee requesting help
Using insider lingo and terminology to gain trust

Question 2

What are the steps of the SE life cycle?

Answer 2

Research: attackers try to find out as much as possible
beforehand from annual reports, brochures, web site,
dumpster diving
Developing trust: use of insider information,
misrepresenting identity, need for help or authority
Exploiting trust: ask victim for information or other form of
help (or manipulate victim into asking for help)
Utilize information: if final goal not reached yet, go back to
earlier steps

Question 3

What are warning signs of an SE attack?

Answer 3

Unusual request
Refusal to give callback number
Claim of authority
Stresses urgency
Threatens negative consequences in case of
non-compliance
Shows discomfort when questioned or challenged
Name dropping
Compliments or flattery
Flirting

Question 4

How to stop SE attacks?

Answer 4

Have procedures in place for handling suspicious requests:
Make Staff part of the security policy
Training of staff plays an important role
Explain why certain procedures are put in place (blind
obedience doesn’t work)
Staff has to be trained to challenge authority when security
is at stake