O slideshow foi denunciado.
Utilizamos seu perfil e dados de atividades no LinkedIn para personalizar e exibir anúncios mais relevantes. Altere suas preferências de anúncios quando desejar.

What is Social Engineering? An illustrated presentation.

Social engineering relies profoundly on human interaction and often involves the misleading of employees into violating their organization’s security procedures. Humans are naturally helpful, but when it comes to protecting an organization’s security, being helpful to an outsider can do more harm than good.

These slides discuss social engineering, the most common attack methods, and the best means for defending against a social engineering attack.

For more helpful cyber security blog articles, visit www.integritysrc.com/blog.

  • Seja o primeiro a comentar

What is Social Engineering? An illustrated presentation.

  1. 1. What is “Social Engineering”? WHAT IS SOCIAL ENGINEERING? Copyright 2016 Integrity Technology Systems, Inc. All rights reserved. The information contained herein is subject to change without notice.
  2. 2. Social Engineering Using knowledge of human behavior to elicit a defined response. The hacking of humans
  3. 3. Sociology and Psychology • Study of human behavior, interaction and societal norms. • Actions can be predicted quite accurately. • Actions can also be influenced quite easily.
  4. 4. Simple Human Behavior • Two Types of Responses – Natural – Learned Hackers will craft a scenario for you to enter, in order to elicit a response which they believe will give them the result they are looking for.
  5. 5. Types of Attacks & Real World Examples
  6. 6. Why talk about social engineering? Social engineering is a component of the attack in nearly 1 of 3 successful data breaches, and it’s on the rise. Source: 2016 Verizon Data Breach Investigation Report
  8. 8. Dumpster Diving If not properly discarded, sensitive information may be discovered by hackers in waste receptacles and dumpsters. – Printed emails, expense reports, credit card receipts, etc. – Network or application diagrams, device inventory with IP addressing, etc. – Notebooks, binders or other work papers containing sensitive information
  9. 9. Pretexting • Fraudulent phone calls • Used to extract information • Also used to setup other attacks such as facility entry or phishing
  10. 10. Phishing Phishing is the process of crafting emails that appear to be from a trusted source and typically invite the recipient to either supply confidential information or click on a malicious link or attachment.
  11. 11. Phishing… Tips For Identifying Phishing Attempts – The email asks you to update account information – There are unfamiliar layouts/designs with no verification images – The email provides unfamiliar hyperlinks
  12. 12. Common Bait • “Sweet Deals” – Free Stuff – Limited Time Offers – Package Delivery • Help Me, Help You! – Tech Support • You Gotta’ See This!
  13. 13. Facility Access Hackers may rely on a physical approach to complement their technical attacks.
  14. 14. Facility Access - Example • Piggy backing: A hacker’s method of entering a facility with a group of employees or maintenance workers – Identifying unsecure areas: Hackers search for loading docks, maintenance entrances, designated smoking areas or other locations that may not be well secured. Act like you belong. If you believe it, so will everyone else.
  15. 15. Enticement - Example A folder with enticing title/label left on ground outside an employee entrance with a USB thumb drive taped inside. • USB, CD or DVDs left in conspicuous spaces • May be accompanied by fake paper files • Curiosity beats caution Year-End Bonuses
  16. 16. Best Defenses
  17. 17. Putting It All Together • Targeted attacks will always use some form of social engineering • Just like in military operations, intel makes or breaks a mission • Hackers may never even need to use sophisticated technical attacks if you provide the information willingly
  18. 18. Don’t Fall for The Long Con • Social engineering is nothing more than a con-game. • The old “Long Con” has been ported to the digital world. • Good cons are hard to spot.
  19. 19. Helpful Tips • Enforce a strong paper destruction process • Limit facility ingress/egress points • Challenge unknown people in secure areas • Implement technology to screen email and websites for attacks
  20. 20. Employee Training • Prepare for different learning styles (audio, visual, hands-on) • Engage the employee; make a personal plea • Use gamification to enhance learning • Awareness is not training, and training is not awareness
  21. 21. Program Validation • Social engineering testing engagements provide assessments of how well your people, process, and technology are functioning.
  22. 22. Summary • Social engineering is here to stay and it’s growing • Your organization will suffer a data breach due to social engineering • The study of human behavior has been used by criminals for centuries, cybercriminals are no different • Employees must be trained to spot social engineering and how to react
  23. 23. For more information, connect with us online or with a phone call. www.integritysrc.com/blog @IntegritySRC 515-965-3756 Copyright 2016 Integrity Technology Systems, Inc. All rights reserved. The information contained herein is subject to change without notice.