Social Engineering
Computer Science: Cambridge International GCSE, topic 1.6.11
Social Engineering
No matter how much money is spent on securing a network, human error is always a very real threat.
Social engineering
- People are often the weak point in any network security package.
- Social engineering is a form of attack that involves tricking people into giving away critical information or access details.
Cold calling
- Social engineers often cold call victims and pretend to be from an organisation such as:
- A bank.
- A utility company.
- The social engineer will then ask a victim to confirm their details, so that they can use these details to access their account later.
Fear
- Fear is often used to put people off-guard and make them more likely to comply.
- Social engineers know that people will make irrational decisions when panicked.
- A common attack would be to call someone pretending to be a bank, and ask why they have emptied out their account:
- This would panic the victim, who would then want to sign into their account straight away over the phone.
Protecting Against Social Engineering
Social engineering is very difficult to protect against. But there are a few tactics employed by organisations to cut down on the amount of successful attacks.
Education and training
- The most effective means of protection against social engineering is education and training.
- People are made aware of the tactics of fraudsters:
- This makes it more likely that they will recognise a fraudulent phone call.
Company security policies
- Company security policies include instructions that employees must follow to uphold security.
- For example:
- Don't discuss a user account without the user having confirmed their PIN number.
Public awareness campaigns
- Banks and governments often run public awareness campaigns to educate members of the public about the risks of social engineering.
- These often include case studies of what could happen if people do not take care.
Test yourself on Social Engineering
What is the weakest point in most networks?
A Social Engineering Attack
How do company security policies help to protect against social engineering?