What Is Social Engineering? How Can It Affect Your Daily To Daily Life?

Raiding Mailboxes - Once the person has selected a victim, raiding that persons mailbox can often lend additional information to be used against them. The more you know about a person the more effective that alternate means of gaining data become.

Phishing is one of the newer forms of social engineering - It involves creating and using e-mails and Web sites designed to look like those of well-known legitimate businesses, financial institutions, and government agencies to deceive Internet users into disclosing their personal information. Phishing scams typically operate counterfeit web sites that lure consumers into revealing their personal and financial data, including social security numbers, bank and credit card account information, and details of online accounts and pbuttwords.

Impersonation - This is a method where the attacker pretends to be someone in an authoritative position. Some of the methods used during impersonation attacks include... acting as an IT support or help desk employee, a repairman, a supervisor or manager, a trusted third party vendor. In a large company acting as a fellow employee is not hard to do at all. There is absolutely no way to know everyone! Many employees really want to impress the boss, so they might do anything to provide requested information to anyone who sounds official.

Pbuttword Harvesting - Is deploying many of several different methods of collecting pbuttwords. While the typical (and easiest) social engineering attempt would be to gain trust and just ask for the pbuttword. Many methods are used to gain pbuttword information. Trojan Horses are often slipped in to collect pbuttwords. Additionally, sniffing a network segment can often provide pbuttword info.

Surfing Company Web Sites A lot of corporate information can be obtained before even talking to anyone by simply surfing company web sites. Employee email addresses and phone numbers, organizational charts, executive titles, financial information and more. I recently dealt with a company who was becoming very frustrated with the large amounts of SPAM they were receiving, and yet all of their executives had their picture on a web page, along with their phone number and email address. Not only were they prime targets for SPAM, but they also provided plenty of information to aid in a social engineering attack.

• Be suspicious of unsolicited email messages phone calls, or visits from individuals asking about employees or other internal information. If dealing with an unknown person claiming to be from a legitimate organization verify their identity directly with the company.
• Never be afraid to question the credentials of someone posing to work for your company.
• Install and maintain firewalls, anti-virus software, anti-spyware software, and email filters.
• Pay attention to the URL of a web site. Malicious web sites generally look identical to a legitimate site, but the URL may use a variation in spelling or a different domain.
• Don't send sensitive information over the Internet before checking a web sites security.
• Don't reveal personal or financial information in email, and do not respond to email solicitations requesting this information. This includes following links sent in email.
• Don't provide personal information or information about your organization to anyone, including the structure of your networks, unless you are certain of a persons authority to have that information.
• Be very careful what is provided on your company web site. Avoid posting organizational charts or lists of key people like officers.
• Shred any document that is discarded that may contain sensitive data.
• Don't allow employees to download from just anywhere.
• Ensure your company has a strong information security policy.
• Conduct in-depth information security training.