Social engineering is the manipulation of the natural human tendency to trust. A social engineer’s main goal is gaining unauthorized access to systems or information in order to commit fraud. In most cases the social engineer never comes face to face with the victim. Social Engineering is steadily increasing as cyber criminals exploit people in tough economic times. Anyone can be a target for social engineers, including small businesses.
Educate yourself and your employees
As a small business, you may always update your anti-virus software, but what other actions do you take to keep your business secure? For example, have you educated your employees recently on what information is safe to divulge and to whom they can divulge it? Understanding social engineering techniques can help you develop a plan for how to protect your business from them.
Before you give any information away, think about the following:
Recognize the signs
The list below describes some of the more common social engineering techniques:
Posted by Katrina Blake, Risk Analyst
Educate yourself and your employees
As a small business, you may always update your anti-virus software, but what other actions do you take to keep your business secure? For example, have you educated your employees recently on what information is safe to divulge and to whom they can divulge it? Understanding social engineering techniques can help you develop a plan for how to protect your business from them.
Before you give any information away, think about the following:
- Why are you you being asked for this information? Is it usual to be asked for this sort of information in this format?
- Is the request coming from a known source?
- What consequences might come from misuse of the information you've been asked to provide or the action you have to take?
- Is there pressure to take action now?
Recognize the signs
The list below describes some of the more common social engineering techniques:
- Impersonation: They may pose as a repairman, helpdesk tech or trusted third party.
- Name Dropping: They may use names of people from your company/family to make you believe they know you and gain your trust.
- Aggression: They also may try to intimidate you by threatening to escalate to a manager / executive if you do not provide the information/access they have requested.
- Conformity: They may tell you that everyone else has provided the information so it’s fine for you to provide the same.
- Friendliness: Over time, they may contact you with an aim of building up a rapport with you. Eventually the social engineer will ask for sensitive information when he/she feels the trust has been built up.
Posted by Katrina Blake, Risk Analyst
