Social engineering tactics and methods for protecting individuals and organizations

Social Engineering Tactics

SOCIOLOGY

There is a lot of controversy when it comes to understanding social engineering. Its Mere definition sparks various arguments amongst renowned scholars. "It is basically the act of manipulating a person to do something that may or may not be for the person's best interest "(Social, 2010).It involves making a person to do certain actions, and acquiring information from the person. It might seem like a deceptive way of doing things, but it is what everyone does in their daily lives like an innocent child trying to get candy from their parents, or someone on a campaign trail seeking votes. Its level of complexity and wide scope of use makes it a science. Just like any other type of science, social engineering can be used in almost all kinds of activities and for various reasons (Podgorecki and Alexander, 1996)

This paper will focus on how social engineering is being applied and how individuals and organization can be protected. Due to its wide scope of application key highlights will be on: impersonation, hoaxing, creating confusion, reverse social engineering, spamming and use of fake anti-spyware.

Common social engineering tactics

Impersonation

Impersonation is one of the oldest tricks the engineers persuade their targets to release information or to do something for them through telephones and mails. It usually takes longer than other methods because the engineers need accurate information so as to fully convince their targets. An example, an engineer using this method may pretend to represent your bank, and then give a few details about your account, and then will tell you there is a technical hitch and your account has been disabled so he needs your pin so as to activate your account. This technique requires a lot of effort and research to appear legitimate to the victim.

Hoaxing

A technique like hoaxing is much simpler and easier for engineers. This is tricking people to believe that something is real and it is false. It mostly affects individuals because there are more vulnerable to such ploys than corporations (Thapar, 2008). Another technique similar to hoaxing is creating confusion. This is basically creating a situation and taking advantage of it. An example can be a person causing mayhem in an office thus distracting staff while his accomplices get access to information.

Protecting individuals from social engineering

There are various ways to prevent social engineering when one is using the internet. People should update themselves on the new techniques that social engineers are using. People should always contact their banks or any other financial institution using unknown sites or links. A website can never be assumed to be legitimate just by looking at it, it is important to ensure from experts that a website that is being used to give crucial information is a secured website.

It is also very important to regularly check your online accounts, and passwords should be changed as often as possible. It is not advisable to fill out forms from popup windows or emails. Lastly, account balance should be checked regularly, and bank statements should be demanded from your banker to ensure your account has not been hacked.

Protecting organizations from social engineering

For any organization to combat social engineering, it is important to ensure there is high level security, and creating awareness by educating employees on social engineering. When it comes to security, an organization should have a well documented policy on security containing guidelines on how to use the computer system, telephone and networks as well as email usage. All prospective employees should also be screened so that they don't pose a threat to the organization. Software systems like firewalls and antivirus software should be put in place so as to filter security breach occurrences.

Education and awareness is the most important. Adequate awareness and training will ensure the required standard of behavior is met. Also, well trained personnel will be in a better position to deal with an attack in case of any. By training the personnel, there will be regular audits which might spot irregularities and hence deal with the situation.

Conclusion

Creating secure networks and clear policies might seem as a solution to social engineering, but the unpredictable nature of humans driven by greed and curiosity, will give rise to new techniques to beat the systems. However, organizations should come up with procedures and policies defining the roles and responsibilities of each user not just the security personnel. This should be followed by ensuring policies are properly followed and there is regular training.