…because it consistently works. There is no patch for an untrained user or even an experienced security professional who forgets, in the heat of the moment, to follow what they have been taught.

Path of Least Resistance

A malicious hacker knows it could take hours, weeks, or even months to successfully brute force his way into a network to steal credentials. However, with social engineering tactics, such as the right pretext and a phone call or email, those same credentials can be stolen in just a matter of minutes. An attacker might try to gain physical access to a company’s network computers as well. To accomplish this an attacker might impersonate a delivery man, construction worker, or tech support. Sifting through open source information, dumpster diving, or talking with a disgruntled employee, may yield information that is used to gain illegal access. Once the attacker is inside, a common USB thumb drive is all that’s needed to infect a computer, gaining access to the network. The role played by social engineering becomes greater as software products become more secure and harder to crack. In order to develop a plan to protect from such attacks you must understand what tactics a social engineer will use, how they will use them, and what methodology they will employ in their attack cycle.

On The Rise

Over the past several years, the incidents of social engineering tactics used in cases of fraud and data breaches have continued to increase. Reports released by industry leaders such as Agari, Symantec, and Verizon Enterprises indicate that social engineering tactics (phishing, vishing, and impersonation) are being used in conjunction with digital hacking methods to make attacks more effective and inevitability more profitable for the attackers. According to the 2017 Verizon Data Breach Report, 43% of all documented breaches involved social engineering attacks.

2017 Verizon Data Breach Report

Recent Examples

Vishing Behind Hacker Stealing Millions From Virtual Currency Exchange Bithumb
Vishing Scam Targeting Accountants & Lawyers Nets Attackers 113,000,000 GBP in one Of UK’s Largest Cyber Fraud
Man Impersonating IT Support Department Dupes Bank Manager Out of Rs 19,900 in Vishing Call

Spear Phishing Attacks Breach Podesta, Powell, and the DNC
DOI Phishing Attack Compromises Gmail Accounts
Phishing Attack Victimizes St. Catharine’s Hydro

Man Posing as Construction Worker Steals $15K in Laptops at Memorial Sloan Kettering
Man Poses as Armored Car Employee, Robs Oklahoma Walmart
Man Impersonates Pest Control Worker to Enter Commercial Building

One Of Many

It is notable to mention that social engineering is becoming a common element of malicious attackers. As this framework will outline, the malicious social engineer will have many tools in their arsenal and many attack vectors at their fingertips. Attackers know that most of the time an employee either doesn’t realize they are doing something wrong; or doesn’t understand the value of the information they are disclosing. It is this naivety that creates a perfect atmosphere for a breach. The only way to protect against these attacks, is to create a security-minded culture within your business or organization through continual education and training.