Cybercrime how to defend against social engineering

There are several attack vectors for cybercriminals, which means that people need to have an equal number or more of ways to defend these attacks. Social engineering is one tactic, and it works in part because the attackers essentially bypass formal defenses such as firewalls or antivirus. Instead, social engineering is “the art of exploiting the human flaws to achieve a malicious objective” (Breda, Barbosa & Morais, 2017). A typical social engineering attack would be a phishing scam, but others would include hackers tricking people into providing information, which is then used against them (Kaspersky, 2020).

Protecting personal information online where social engineering attacks are concerned means training people in how social engineering attacks work, what the attackers need you to do, and how to spot typical scams. This training can often be done with courses, or online, and many security providers offer these services.

Many social engineering attempts are seeking to gain passwords, so it is always valuable to use a password manager, where the actual password is encoded, or otherwise does not need to be typed in. With a password manager, this limits the risk of social engineering techniques like shoulder surfing.

Training is the most important line of defense in cybersecurity. The hard defenses like firewalls and antivirus protection can be bypassed by innovative attackers, but training against cyberattacks will limit their impact. By protecting passwords, using strong passwords, and using two-factor authentication it is possible to defend against social engineering cyberattacks, however they may come.

References

Breda, F., Barbosa, H., Morais, T. (2017) Social engineering and cyber security. Conference Paper.

Kaspersky (2020) What is social engineering? Kaspersky Labs. Retrieved April 15, 2020 from https://usa.kaspersky.com/resource-center/definitions/social-engineering