What Is Social Engineering?

Social engineering attacks are often the critical entry point for advanced cyber threats. These attacks serve as the launchpad for deploying ransomware, executing credential theft, and more, leveraging human vulnerability rather than technical gaps. Because they target people, not systems, social engineering attacks are notoriously difficult to detect and prevent. The first step in defending against these risks is a deep understanding of social engineering tactics and the various attack types associated with them

What is Social Engineering?

Social engineering is the process of manipulating people’s interactions and emotions in a way that gets them to take adverse action, doing things against a company’s or their own best interests.

Social engineering focuses on psychology, using techniques like:

• Authority: Pretending to be someone in a position of power to intimidate a victim
• Likeability: Building trust by appearing credible or easygoing
• Social proof: Establishing trust by pretending close friends or acquaintances endorse an activity
• Reciprocity: Offering value to create a sense of obligation
• Urgency/commitment: Establishing a short time frame for a response as a way to get the victim to ignore risk
• Scarcity: Generating demand by pretending something will run out of supply

These techniques are nothing new and not only related to cyberattacks. A good way to think about social engineering is like a con artist trying to steal money from someone.

Types of Social Engineering Attacks

Social engineering cyberattacks use these methodologies by applying them to the anonymity and speed of the internet. Without visual and social cues, people are likely to be more susceptible to the methods.

Phishing

Phishing accounts for 44% of social engineering incidents. Phishing attacks start with a fake email that appears to be legitimate. Within the text of the email, the attacker suggests that the recipient take action, usually downloading a document or clicking an email. This is how the cybercriminal delivers the payload.

In addition to traditional phishing, cybercriminals also use newer techniques and technologies. Some of these variants include:

• Vishing: Delivering the attack through phone calls instead of emails
• Smishing: Delivering the attack through text messages instead of emails
• Spear phishing: Customizing fake emails that address the victim directly, usually leveraging publicly available information like social media posts
• Whaling: Targeting specific high-profile victims within an organization, like senior leadership, that appear to be from someone else inside the company
• QRishing: Embedding malicious code into a QR code to redirect people to a malicious website

Pretexting

Pretexting can be done physically or digitally. A malicious actor engages in research, creates a realistic story, then pretends to be someone the victim would view as legitimate.

Cybercriminals might try to impersonate:

• Auditors
• Customer service representatives
• IT staff
• Survey takers
• Physical security staff

Tailgating

Pretexting can be used as part of tailgating which is where someone acts like they belong in a physical location to follow someone else into a building or secure location. The criminal may wear a uniform associated with the company or act like they forgot a security keycard.

Baiting

Tailgating can be especially useful to carry out a baiting attack. In these attacks, the cybercriminal uses a physical object, like a USB drive, and leaves it somewhere visible. People are naturally curious and want to help others. In an attempt to return the drive to its owner, they may insert it into a device for information. Then, the malware installs and executes on the device.

Scareware

Scareware is when the criminal creates a sense of urgency by telling someone that if they take an action, they will avoid harm. It may be used as part of another social engineering attack type, like whaling.

Examples of Social Engineering

Between digital and physical social engineering, understanding what an attack might look like is also important.

Phishing

The Cybersecurity and Infrastructure Security Agency (CISA) published an alert that malicious actors were using a phishing campaign to send recipients to a spoofed COVID-19 loan relief website. This is an example of using people’s fears to get them to react without thinking. With many people losing their jobs during the global lockdowns, they were quick to react in a way that would protect their families.

Spear Phishing

CISA published an alert about a sophisticated spear phishing campaign targeting government organizations, intergovernmental organizations (IGOs), and non-governmental organizations (NGOs). The threat actors used a legitimate email marketing software company to send emails to more than 7,000 accounts. The emails contained links that redirected to a malicious URL.

QRishing

The Federal Bureau of Investigation (FBI) issued a warning that cybercriminals were tampering with QR codes that redirected victims to malicious sites. The alert explained that they could tamper with digital or physical QR codes which could then either steal login, financial, or location information.

How to Prevent Social Engineering

Although social engineering attacks use technology, they really target people. This means organizations need to ensure they have the people, processes, and technologies in place to help reduce the likelihood of a successful attack.

[Related Reading: Why Humans Are the Weakest Link in Cybersecurity]

Cybersecurity awareness education

Having the right social engineering training in place can help mitigate many of the risks associated with these attacks. An effective training should teach users to:

• Review sources: Sender email address, email headers, and any URLs
• Check text in body: Images being used to evade spam filters or specifics intending to seem legitimate
• Review emotional language: Anything hinting at urgency or seems “too good to be true”
• Independently validate requests: Directly contacting company without using information in the email
• Never click: Malicious code stored in links and downloads
• Never respond: Provides data and verification of information

Preventive technologies

Preventive technologies add a layer of protection that can help reduce the success of a social engineering attack. Some technologies to consider include:

• Strong spam settings
• Anti-virus software on endpoints
• Security patch deployment automation
• Multifactor authentication (MFA) to protect compromised credentials
• Device attestation prior to connecting to networks

Detection and Response

Although prevention is important, a defense-in-depth approach that incorporates robust monitoring, detection, and response can reduce the impact a social engineering attack can have. Continuous monitoring should include:

• Alerts for abnormal user and device activity
• Monitoring networks for abnormal traffic
• Testing and validating incident response capabilities

Protect Against Social Engineering Attacks

Continuous monitoring, detection, and response is challenging enough when looking at just the technology side of cybersecurity. When companies need to validate their people and processes as well, it can be overwhelming.

With a managed securing service like Fortra’s Alert Logic MDR and Fortra XDR, organizations get the resources to protect themselves from social engineering attacks. These solutions provide global visibility for all threat activity across users, devices, and environments. Our customers gain machine learning detection along with fully automated and human-guided automated response capabilities to ensure they have the ability to respond quickly if an incident occurs.