Attackers who exploit employees' intentions are the hardest to prevent, but there are rules to follow to protect your company from being a victim of social engineering scams.

Have you ever been deceived? Social engineers often trick themselves into tricks, and victims often fall for them before they know it. Social engineers often exploit human weaknesses rather than technical/software vulnerabilities to infiltrate protected networks.

Thieves, not robbers

One of the typical scammers is Kevin Mitnick in the United Kingdom, who was in and out of prison three times before and after a computer crime, and after being released from prison, Mitnick decided to change his ways, and now runs a consulting firm, DefensiveThinking, which specializes in protecting employees from social engineering scams.

In his heyday, Mitnick was a scammer who could trick people into revealing everything from passwords to internet accounts to general technical information. We caught up with Mitnick to see what social engineering scammers most often want when they call into a company to find someone.

"It's mostly a phone call and then a password to get out of them," he said, "but there are more sophisticated ways to attack and get all sorts of granular information." ”

For example, if you look at a software company, (which was what Mitnick used to do, first stealing the source code of DEC in the 80s, and then looking for Nokia, Sun, Motorola, and NEC), you wouldn't just go in and go to the IT administrator and say, "How many passwords?"

A skilled attacker will target an easier part of the attack, such as a workstation on a company's local area network, and exploit common technical vulnerabilities. Social engineering can then come in handy to find out which machine on the network is what the attacker really wants, saving a lot of time fumbling around with the LAN and reducing the risk of accidentally hitting a security alert.

How to crack the attack method?

Train employees to weigh sudden "requests" and say that social engineering experts love to wear top hats, such as "Only smart people like you are willing to help me, and I'll send you the file later, please open the attachment." conAd1();” They also use intimidation, "If you don't give me the password to get me into my email address, you're going to be fired." ”

If you can turn down this "out of context" request, you're probably half the battle, "the key is to train employees to understand what is legitimate and what isn't." Mitnick said.

Some simple policies are also easy to follow, almost all social engineers will not show the caller number, "they will make all kinds of excuses, such as my phone battery is running out of battery and so on," Mitnick said, the company only needs to make a rule that if someone calls to request information is **/confidential in nature, employees must really know that there is such a person, and then call back to the other party to confirm, after this level, at least seventy percent of social engineering scams will be exposed.

Whenever someone calls and asks to reset their password, IT staff must call the employee back to confirm, and this policy will definitely help to debunk social engineering scammers.

Mitnick is not an IT security generalist, social engineering is his specialty, Mitnick has also studied the psychological level before to succeed in crime, "Social psychology says that human beings have two modes of thinking, one is systematic, and the other is heuristic," Mitnick explains that when you're in systems mode, you're motivated to think, and in exploratory mode, you're lazy, and you're distracted and thinking about other things, "We spend 90 percent of our time in that state. ”

It is at this time that we are most likely to become complicit in the attacker, and social engineers have a way of convincing their victims that they don't have a chance to think carefully. Worst of all, they often ask for more than the victim does on a day-to-day basis.

"If you talk to someone and you find out that they are from the same country or have the same hobbies and interests, then the attacker will try to cater to your liking, because psychologically, you prefer people who are very similar to you," says Mitnick. ”

"If you find out that the other person has too many coincidences with you, then you should be vigilant. He said.

Set red and yellow light cordons

Mitnick suggested introducing a traffic light system to help employees determine if they had been tricked. conAd2();

Human nature is good, and most people will trust strangers at first, rather than deliberately suspecting each other, which also gives social engineering scammers an opportunity. Have you ever opened a door for a stranger in the same building? Everyone likes to make a good impression, even with strangers, so everyone is happy to give a small favor, and in the same way, if the other person gives something in return, it is also a kind of courtesy, and this human tendency is the biggest vulnerability of the attacker, Mitnick thinks. His most successful examples in the past have been committed in this way.

"If somebody gives you a little favor, you get something back, and that kind of human nature applies everywhere, especially in the United States," he said, "and attackers will pretend to help you solve the problem, or they will deliberately create the problem and then pretend to help you." ”

The attacker may pretend to be a management department to do a spot check, first call the IT maintenance department, ask the original announcement to know the list of repairs, and once the details of a repair order are obtained, the social engineer can pretend to be a maintenance personnel, call the employees who are waiting for help, and help them solve the problem. A few hours later, the attacker can call back and say, "Hey, I'm someone from the IT department who just helped you with your email problem." I'll send you a diagnostic tool, can you do it for me?"

Mitnick says that asking someone to divulge information or perform certain actions on their behalf is similar to that of a salesperson. "It's just using business or marketing skills in a bad place. Therefore, it is important for companies to set up red and yellow light alerts to let employees know exactly what situations are likely to be fooled. ”

In addition to training employees, it is also necessary to supervise and accept, Mitnick said that this risk cannot be completely eliminated, but it can be minimized, where is the evidence?

PrintChapterError();