Social Engineering.

What is social engineering?

Social engineering is the act of tricking a person instead of breaking a system. NIST describes it as an attempt to trick someone into revealing information, such as a password, that can be used to attack systems or networks. Another NIST definition says it is the act of deceiving an individual into revealing sensitive information, obtaining unauthorized access, or committing fraud by associating with the individual to gain confidence and trust.

CISA says attackers use human interaction, or social skills, to obtain or compromise information about an organization or its computer systems.

How does a social engineering attack work?

CISA explains that attackers can pose as trusted people, such as employees, repair personnel or researchers, and even offer credentials. CISA also notes that attackers can use current events, such as natural disasters, health scares and holidays, as hooks for their messages.

What does a simple illustration look like?

This is a generic illustration only. Someone contacts an employee, says they are from a trusted team, and asks for a password. If the employee believes the story and shares it, the attacker has information that can be used against the organization without breaking any technology.

What are common forms of social engineering?

• Phishing: CISA describes it as a form of social engineering that uses email or malicious websites to ask for personal information by posing as a trustworthy organization.
• Vishing: CISA describes it as voice-based, and says attackers may use caller ID spoofing, which means faking the number that appears on the receiver’s phone.
• Smishing: CISA describes it as text messages that contain malicious links or phone numbers.

How can you reduce the risk?

CISA lists several steps for people who receive an unexpected request.

• Verify the identity of the person by using contact details you find yourself, not the ones they gave you.
• Do not give out personal information or information about your organization.
• Look for signs of a phishing message, such as a suspicious sender address, a generic greeting, spelling and layout issues or a suspicious attachment.
• Check that a website address starts with https and shows a padlock before you enter sensitive data.
• Enforce multifactor authentication, which asks for more than a password to sign in.
• Install antivirus software, firewalls and email filters.

If you think you gave information to an attacker, CISA advises contacting your financial institution, changing all passwords and reporting the incident to the proper authorities.

How does it relate to nearby terms?

Phishing is one type of social engineering, delivered by email or websites. Vishing is the voice version. Multi-factor authentication is a related term for the sign-in control CISA recommends.

Is social engineering the same as phishing?

No. CISA treats phishing as one form of social engineering. Social engineering is the wider idea of manipulating people, and it can happen by phone, text, email or in person.

Is social engineering a technical attack?

It is aimed at people more than at software. The NIST definitions describe deceiving or tricking an individual, and the goal can be information, access or fraud.

Where does Brandefense fit?

Brandefense monitors phishing and domain abuse that are often used to impersonate trusted organizations.

See also

• Doxing