1.3 Social Engineering

 Social Engineering: Common Types Of Attacks

Social engineering is a nontechnical method of breaking into a system or network. It’s the process of deceiving users of a system and convincing them to give out information that can be used to defeat or bypass security mechanisms. Social engineering is important to understand because hackers can use it to attack the human element of a system and circumvent technical security measures. This method can be used to gather information before or during an attack.

It is the use of influence and persuasion to deceive people for the purpose of obtaining information or persuading a victim to perform some action. A social engineer commonly uses the telephone or Internet to trick people into revealing sensitive information or to get them to do something that is against the security policies of the organization. By this method, social engineers exploit the natural tendency of a person to trust their word, rather than exploiting computer security holes. It’s generally agreed that users are the weak link in security; this principle is what makes social engineering possible

Social engineering includes the acquisition of sensitive information or inappropriate access privileges by an outsider, based on the building of inappropriate trust relationships. The goal of a social engineer is to trick someone into providing valuable information or access to that information. It preys on qualities of human nature, such as the desire to be helpful, the tendency to trust people, and the fear of getting in trouble. Hackers who are able to blend in and appear to be a part of the organization are the most successful at social-engineering attacks. This ability to blend in is commonly referred to as the art of manipulation

It is much easier to gain information by social engineering than by technical methods. People are usually the weakest link in the security chain. A successful defense depends on having good policies in place and teaching employees to follow the policies. Social engineering is the hardest form of attack to defend against because a company can’t protect itself with hardware or software alone.

Case Study or Example: some security professionals entered office by pretending themselves as higher authority people and bypassed the security measures. 

What Are the Common Types Of Attacks?

Human-based Human-based social engineering refers to person-to-person interaction to retrieve the desired information. An example is calling the help desk and trying to find out a password.

1. Impersonating an employee or valid user
2. Posing as an important user
3. Using a third person
4. Calling technical support
5. Shoulder surfing
6. Dumpster diving

Computer-based Computer-based social engineering refers to having computer software that attempts to retrieve the desired information. An example is sending a user an e-mail and asking them to reenter a password in a web page to confirm it. This social-engineering attack is also known as phishing.

1. E-mail attachments 
2.  Fake websites 
3.  Popup windows 

Understanding each Attack