What Is Social Engineering?

Social engineering is a method of using human interaction to convince people to break their normal security processes. It can utilize technology, but it isn’t necessary in order to reach a goal. It’s been around since the beginning of time and although it has a modern name, it really is just a con-game for hackers.

According to the SANS (Systems Administration, Networking, and Security) Institute, there are four stages of a social engineering cycle: Information Gathering, Relationship Development, Exploitation, and Execution.

2

Roughly 50% of a social engineer’s time is spent doing research on potential victims. A social engineer will collect data, personal and professional, find weaknesses and use those against their target. So in general, limit the information you make available to strangers, whether business or personal.

2

The con artist will use the information gathered in the first stage and use it to gain trust and rapport with a target. Make sure that relationships are real, regardless of whether they take place at home or in the office. Often this stage takes place outside the office, but information gained will be used inside of it. The relationship can be that of a vendor, customer, or even someone looking for a job who stops by to drop off a resume. Always ask questions about who is in the office and their reason for being there.

2

In this phase, the targeted victim is manipulated into providing some type of information or other assistance to the con-artist that normally would not be given to him or her. This could be passwords, keys, or access to the server room. Once these are granted, the actual attack takes place and in many cases, the victim doesn’t even know he or she was tricked. A social engineer can install malware on a computer in minutes or even less.

 While it’s a good trait to want to help people, it is better find some way to help that won’t result in anything of value transferring hands or traversing networks (as would be the case if malware were placed on a server, for example).

2

This is the exit strategy. Whatever the goal was for the con-artist has been achieved at this stage and he or she moves on. Either disappears or moves to the next phase and the cycle has been completed.

Who uses social engineering tactics and why?

These people are not restricted to the stereotypical hacker sitting in a dark room at a computer. Now nation-state actors, curious kids, and terrorists alike all use social engineering tactics and strategies. The motivation is varied for whomever is performing the activity. The most obvious is for financial gain. However, others could be self-interest such as modifying information about themselves that would be detrimental or beneficial to them, out of sheer curiosity, or even to get revenge.

2

Most of the time, the signs that a con is occurring are so subtle that the targets don’t know what is happening. Exploiting the human desire to be helpful by gaining trust on a personal level is how the game is played.  Taking advantage of a busy person in the office is common and many attacks happen when the social engineer convinces his escort that there is no need to hang around. They can do whatever they are there to do without assistance and quickly.  However, always be aware of who is asking for information and what you provide to them. When it’s sensitive and some type of cost is associated if that information is used in a nefarious manner, just say “No.”