Social engineering is an insidious, and highly successful, method of data theft. Training users to spot social engineering attacks is the key to beating them.
Of all the misunderstandings out there about hacking and network security, one of the biggest may be that network intrusion and data theft are purely a matter of technical ability: clever code and malicious software slicing through a company’s technical defenses. This does happen – but much more common are social engineering attacks, exploits that focus more on human vulnerabilities than technical weaknesses.
Those “human exploits” take a number of forms, including phone calls to customer service impersonating a user to obtain private information and sophisticated email-based spoofs that insert attackers right in the middle of sensitive business conversations.
To stop social engineering attacks, you have to do more than keep pace with the latest technological innovations. You have to take a thoughtful, holistic approach to your security strategy that involves cybersecurity training.
How can your business combat social engineering attacks?
Today, cybersecurity training has to be a priority for everyone – not just the security team. And it’s about much more than not leaving passwords lying around.
With social engineering attacks being so vast and intelligent, your team needs to be aware of the full range of social engineering strategies out there, particularly the ones most relevant to their roles. If an individual’s job is public-facing, it’s essential that they understand common impersonation tactics. You should establish clear and strict procedures dictating what information may be provided, to whom, and under what circumstances. It’s important that your employees understand how important it is to follow these procedures without exception.
Your staff members have another security role to play, too. Many early red flags of network intrusion first make themselves known to your employees, often as seemingly minor complaints about the network. A slow connection, a password that suddenly doesn’t work – these can be important indicators that something more serious is amiss. Social engineering attacks target unassuming employees who might not realize that these irregularities need to be reported immediately.
Having an effective incident response service or plan to respond to signals like these can spell the difference between a successful data theft and a preempted attack. Cybersecurity training that teaches your team to be an integral part of your organization’s security efforts.
5 ways to defend your organization against social engineer attacks
- Pay close attention to email addresses. Spoofers can often acquire a domain name that is close to yours. They might use a .co extension instead of .com, a zero in place of an “o” or a slight misspelling. They also might use a lowercase L in place of an uppercase i or a numeral one. This is where cybersecurity training is key so that your employees are aware of small changes designed to trick them out.
- Purchase any obviously opportune domain variants. This will help minimize the chances of the above spoof strategy. You should also avoid free webmail like Gmail and Yahoo, which is much easier to spoof.
- Make a policy of forwarding emails instead of replying to email chains. This forces senders to always enter a recipient’s email address manually ensuring it’s correct. This might slow you down by a few seconds, but it’s a more secure process.
- Delete all obvious spam emails immediately, without opening them, downloading any attachments, clicking on any links, or replying. It’s important to ensure your staff has appropriate training to understand how to identify spam emails.
- Use a minimum of two forms of communication with major business partners. Verify any major changes through the second mode of communication. Don’t move forward on significant transfers of data or funds based only on email.
How can I avoid social engineering attacks via email?
One important area of concern for social engineering attacks is email. Scammers are able to insinuate themselves into email conversations between business partners through a technique known as “man-in-the-email.”
Social engineering attackers may spoof an email thread between two company executives discussing and then authorizing a transaction. The spoofed email is forwarded to someone at the business who is responsible for transferring funds. If the spoof successfully emulates the executives and creates a sense of urgency, this may prompt the individual to quickly send funds to an unknown bank account – which is of course owned by the bad guys.
In another iteration, the scammers target two companies, generally organizations already doing business with one another, spoofing both sides in order to start a conversation – then invisibly facilitating and editing the dialogue to suit their goals. At an opportune moment, perhaps after a planned transaction, the attacker (pretending to be Company A) tells Company B that they’ve recently changed their bank account. These are common – and commonly successful – social engineering attacks.
Taking a thoughtful approach to cybersecurity
By taking a thoughtful approach to network security that encompasses all of your staff and your broader communication strategies, you’ll have a strong framework for effective security. With this foundation in place, your business should be less susceptible to social engineering attacks.
At CyberMaxx, our fully managed detection and response service, MAXX MDR, offers a holistic approach that secures and protects your environment from cybercrime. Our solutions are focused on people as much as technology and process, meaning that you’ll receive the best protection against social engineering attacks like those discussed above.
