1 00:00:00,000 --> 00:00:01,680 In this lesson, we're going to discuss 2 00:00:01,680 --> 00:00:03,990 avoiding social engineering threats. 3 00:00:03,990 --> 00:00:06,390 Now in the complex landscape of cybersecurity, 4 00:00:06,390 --> 00:00:08,250 avoiding social engineering is a topic 5 00:00:08,250 --> 00:00:10,530 that demands our attention and understanding 6 00:00:10,530 --> 00:00:12,960 because it is so prevalent these days. 7 00:00:12,960 --> 00:00:16,170 Social engineering in its most malicious form is deception 8 00:00:16,170 --> 00:00:18,810 where a bad actor attempts to manipulate individuals 9 00:00:18,810 --> 00:00:20,640 into breaking their organization's normal 10 00:00:20,640 --> 00:00:23,970 security procedures by playing on human psychology. 11 00:00:23,970 --> 00:00:26,880 Often, social engineering attacks appear to be innocent, 12 00:00:26,880 --> 00:00:29,460 and this is likely the key that the attackers are going to use 13 00:00:29,460 --> 00:00:31,050 to trick your employees into breaking 14 00:00:31,050 --> 00:00:33,570 your organization's security, which is why awareness 15 00:00:33,570 --> 00:00:36,210 and vigilance are going to be used to create our first line 16 00:00:36,210 --> 00:00:37,620 of defense against these types 17 00:00:37,620 --> 00:00:39,570 of social engineering attacks. 18 00:00:39,570 --> 00:00:41,070 Now, to avoid becoming the victim 19 00:00:41,070 --> 00:00:42,810 of many social engineering attacks, 20 00:00:42,810 --> 00:00:45,570 you simply need to maintain your situational awareness. 21 00:00:45,570 --> 00:00:48,180 Now, situational awareness is a term used to describe 22 00:00:48,180 --> 00:00:51,390 a state of mindfulness about one's immediate surroundings, 23 00:00:51,390 --> 00:00:53,010 the actions you're asked to perform, 24 00:00:53,010 --> 00:00:54,600 and to understand that the action 25 00:00:54,600 --> 00:00:57,870 may have negative consequences if you do perform it. 26 00:00:57,870 --> 00:01:00,750 For example, shoulder surfing is one such attack 27 00:01:00,750 --> 00:01:01,980 that can be prevented by maintaining 28 00:01:01,980 --> 00:01:03,690 good situational awareness. 29 00:01:03,690 --> 00:01:05,820 Shoulder surfing involves the attacker attempting 30 00:01:05,820 --> 00:01:07,050 to peek over your shoulder 31 00:01:07,050 --> 00:01:09,540 to look at sensitive information on your screen. 32 00:01:09,540 --> 00:01:12,030 To counter this kind of an attack, you must always be aware 33 00:01:12,030 --> 00:01:14,640 of your surroundings, especially in public spaces, 34 00:01:14,640 --> 00:01:16,500 and use a privacy screen protector, 35 00:01:16,500 --> 00:01:18,270 as well as being cautious about reading any 36 00:01:18,270 --> 00:01:21,810 confidential information outside of your secured areas. 37 00:01:21,810 --> 00:01:23,370 Eavesdropping is another attack, 38 00:01:23,370 --> 00:01:25,050 and it's similar to shoulder surfing, 39 00:01:25,050 --> 00:01:27,540 but with eavesdropping, our attacker is attempting 40 00:01:27,540 --> 00:01:30,240 to listen in on our private conversations or our meetings 41 00:01:30,240 --> 00:01:32,100 in order to breach our security. 42 00:01:32,100 --> 00:01:34,770 To prevent this, you should only hold sensitive discussions 43 00:01:34,770 --> 00:01:36,720 in soundproofed or secure areas, 44 00:01:36,720 --> 00:01:39,780 and always be aware of any smart devices like smartphones, 45 00:01:39,780 --> 00:01:41,580 smart watches, or other devices 46 00:01:41,580 --> 00:01:43,230 that may have been brought into the room, 47 00:01:43,230 --> 00:01:45,360 because these could be hacked to remotely record 48 00:01:45,360 --> 00:01:47,670 and listen to a given conversation. 49 00:01:47,670 --> 00:01:49,680 Now, if you're having a conversation with a colleague 50 00:01:49,680 --> 00:01:52,380 about work matters during lunch at a local coffee shop, 51 00:01:52,380 --> 00:01:54,630 you could easily fall victim to eavesdropping. 52 00:01:54,630 --> 00:01:56,430 So it's really important that you're always aware 53 00:01:56,430 --> 00:01:57,900 of where you're having your discussions 54 00:01:57,900 --> 00:02:00,120 about your confidential workplace information 55 00:02:00,120 --> 00:02:02,850 to prevent eavesdropping from being successful. 56 00:02:02,850 --> 00:02:05,460 Now, as you can see, shoulder surfing and eavesdropping 57 00:02:05,460 --> 00:02:07,710 usually require the attacker to get close to you 58 00:02:07,710 --> 00:02:10,380 to execute their attack, and one of the ways they may try 59 00:02:10,380 --> 00:02:12,510 to enter your secure office building is to use 60 00:02:12,510 --> 00:02:15,660 social engineering attacks like piggybacking or tailgating, 61 00:02:15,660 --> 00:02:18,690 where unauthorized individuals slip into secure premises 62 00:02:18,690 --> 00:02:20,850 undetected by closely following somebody 63 00:02:20,850 --> 00:02:22,830 who has legitimate access. 64 00:02:22,830 --> 00:02:25,830 To prevent this, your organization should use access control 65 00:02:25,830 --> 00:02:28,080 vestibules to limit entry into your buildings, 66 00:02:28,080 --> 00:02:30,990 to one person at a time, and to ensure your employees 67 00:02:30,990 --> 00:02:32,970 maintain their situational awareness to ensure 68 00:02:32,970 --> 00:02:35,520 no one is trying to sneak through the door or security gate 69 00:02:35,520 --> 00:02:38,640 behind them as they enter that secured facility. 70 00:02:38,640 --> 00:02:41,400 Dumpster diving is yet another social engineering attack 71 00:02:41,400 --> 00:02:42,660 that you need to be aware of, 72 00:02:42,660 --> 00:02:44,880 and this is one where the attackers sift through garbage 73 00:02:44,880 --> 00:02:46,530 to look for any discarded information 74 00:02:46,530 --> 00:02:49,080 that might be pieced back together to form a bigger, 75 00:02:49,080 --> 00:02:51,960 more informative picture of your confidential data. 76 00:02:51,960 --> 00:02:54,360 Again, by having good situational awareness, 77 00:02:54,360 --> 00:02:56,100 your employees might be able to catch somebody 78 00:02:56,100 --> 00:02:58,170 going through the trash can or recycle bin 79 00:02:58,170 --> 00:02:59,700 who's trying to steal information 80 00:02:59,700 --> 00:03:02,160 that somebody else carelessly threw away. 81 00:03:02,160 --> 00:03:04,530 Now, amid all of these multifaceted threats, 82 00:03:04,530 --> 00:03:07,110 we also need to look at operational security. 83 00:03:07,110 --> 00:03:09,600 Operational security, also known as OPSEC, 84 00:03:09,600 --> 00:03:11,400 is one of those things that is a critical shield 85 00:03:11,400 --> 00:03:14,250 in your defensive posture, and OPSEC is really a term 86 00:03:14,250 --> 00:03:15,990 that was originally coined by the military, 87 00:03:15,990 --> 00:03:18,240 and it involves a protection of critical information 88 00:03:18,240 --> 00:03:19,950 that might indicate your activities 89 00:03:19,950 --> 00:03:21,690 to a potential adversary. 90 00:03:21,690 --> 00:03:23,940 When applied inside of a business context, 91 00:03:23,940 --> 00:03:25,980 operational security underscores the importance 92 00:03:25,980 --> 00:03:27,840 of safeguarding your sensitive data, 93 00:03:27,840 --> 00:03:30,420 whether it's your daily routines, your project details, 94 00:03:30,420 --> 00:03:31,950 or your internal procedures 95 00:03:31,950 --> 00:03:34,350 from manipulative social engineers. 96 00:03:34,350 --> 00:03:36,000 Now, this could mean being more discreet 97 00:03:36,000 --> 00:03:38,490 about your work schedule or upcoming business deals, 98 00:03:38,490 --> 00:03:40,230 even when you're in casual conversations 99 00:03:40,230 --> 00:03:41,760 with your friends or family. 100 00:03:41,760 --> 00:03:42,840 Now, why? 101 00:03:42,840 --> 00:03:45,600 Well, social engineers are really good at piecing together 102 00:03:45,600 --> 00:03:47,850 seemingless innocuous details that are shared 103 00:03:47,850 --> 00:03:49,860 over social media, during phone calls, 104 00:03:49,860 --> 00:03:51,870 or even during personal interactions 105 00:03:51,870 --> 00:03:54,000 to construct a narrative that they can then use 106 00:03:54,000 --> 00:03:55,980 to exploit your organization. 107 00:03:55,980 --> 00:03:57,990 They could then pretend to be part of your work life, 108 00:03:57,990 --> 00:04:00,240 using information you've unknowingly divulged 109 00:04:00,240 --> 00:04:01,620 to gain your trust. 110 00:04:01,620 --> 00:04:04,320 So, operational security isn't just a protocol, 111 00:04:04,320 --> 00:04:06,240 but it's actually a mindset that you need to instill 112 00:04:06,240 --> 00:04:07,860 in all of your employees. 113 00:04:07,860 --> 00:04:10,170 Operational security at its core requires 114 00:04:10,170 --> 00:04:11,610 that you're consistently aware 115 00:04:11,610 --> 00:04:13,530 that any piece of information you have 116 00:04:13,530 --> 00:04:15,540 is really a part of a bigger puzzle 117 00:04:15,540 --> 00:04:17,730 that somebody can then use to craft an attack 118 00:04:17,730 --> 00:04:19,529 against your organization. 119 00:04:19,529 --> 00:04:21,540 Now, all of these types of social engineering attempts 120 00:04:21,540 --> 00:04:23,880 really do underscore the need for constant vigilance 121 00:04:23,880 --> 00:04:26,010 and situational awareness, because our actions 122 00:04:26,010 --> 00:04:28,470 might potentially be watched by an attacker. 123 00:04:28,470 --> 00:04:30,000 Beyond these human threats though, 124 00:04:30,000 --> 00:04:32,010 we also need to worry about technological attacks 125 00:04:32,010 --> 00:04:33,540 that are used by social engineers, 126 00:04:33,540 --> 00:04:35,850 like removable media devices and cables 127 00:04:35,850 --> 00:04:38,310 that are used as part of a baiting attack. 128 00:04:38,310 --> 00:04:40,740 For example, let's imagine you just parked your car 129 00:04:40,740 --> 00:04:43,230 at the office and you're walking towards the front door. 130 00:04:43,230 --> 00:04:46,200 On the ground, you see a USB thumb drive sitting there. 131 00:04:46,200 --> 00:04:47,220 You're worried that it may have fallen 132 00:04:47,220 --> 00:04:48,540 out of one of your coworkers pockets 133 00:04:48,540 --> 00:04:49,620 on their way to the office, 134 00:04:49,620 --> 00:04:52,320 so you simply pick it up and carry it over to your desk. 135 00:04:52,320 --> 00:04:54,240 When you get to your desk, you decide to plug in 136 00:04:54,240 --> 00:04:55,980 that thumb drive into your workstation 137 00:04:55,980 --> 00:04:57,660 to see if you can find the name of the owner 138 00:04:57,660 --> 00:05:00,360 by reading a few of the files that are stored on that drive. 139 00:05:00,360 --> 00:05:03,330 Well, by doing this, you may have just unknowingly infected 140 00:05:03,330 --> 00:05:06,000 your workstation or the entire organizational network 141 00:05:06,000 --> 00:05:08,970 with malware because that USB drive wasn't dropped 142 00:05:08,970 --> 00:05:10,260 by one of your coworkers. 143 00:05:10,260 --> 00:05:12,630 Instead, it was dropped by a social engineer, 144 00:05:12,630 --> 00:05:14,940 and they used it as part of a baiting technique 145 00:05:14,940 --> 00:05:16,920 to put that thumb drive in the parking lot 146 00:05:16,920 --> 00:05:18,570 outside of this office building, 147 00:05:18,570 --> 00:05:20,760 in the hopes that somebody like you would pick it up 148 00:05:20,760 --> 00:05:22,440 and connect it to their own workstation, 149 00:05:22,440 --> 00:05:23,310 because they were curious 150 00:05:23,310 --> 00:05:25,470 as to what was on that thumb drive. 151 00:05:25,470 --> 00:05:27,090 Now, to prevent this from occurring, 152 00:05:27,090 --> 00:05:29,970 you should never pick up any USB thumb drives that you find, 153 00:05:29,970 --> 00:05:32,700 and if you do pick it up, you should never ever connect it 154 00:05:32,700 --> 00:05:35,160 to your computer because it could infect you with malware 155 00:05:35,160 --> 00:05:37,470 as soon as you plug it into the system. 156 00:05:37,470 --> 00:05:39,930 In recent years, people have become even smarter 157 00:05:39,930 --> 00:05:42,060 and they stopped falling for this USB thumb drive bait 158 00:05:42,060 --> 00:05:45,330 as often, so, social engineers ramped up their capability 159 00:05:45,330 --> 00:05:47,580 as well and moved on to using charging cables 160 00:05:47,580 --> 00:05:50,340 in public areas as their form of bait instead. 161 00:05:50,340 --> 00:05:53,010 These cables can include malware in their firmware 162 00:05:53,010 --> 00:05:54,930 that will infect your iPhone or Android phone 163 00:05:54,930 --> 00:05:57,180 once you connect your phone to that charger. 164 00:05:57,180 --> 00:05:59,730 This type of charging cable bait is particularly effective 165 00:05:59,730 --> 00:06:03,060 in public areas like airports, lounges, coffee shops, 166 00:06:03,060 --> 00:06:05,760 and other places that offer public charging. 167 00:06:05,760 --> 00:06:08,310 For this reason, I recommend that you always carry your own 168 00:06:08,310 --> 00:06:10,830 charging cable and charger with you wherever you go, 169 00:06:10,830 --> 00:06:13,110 so that you're not relying on an untrusted charging cable 170 00:06:13,110 --> 00:06:16,050 or charging unit when your battery gets too low. 171 00:06:16,050 --> 00:06:18,090 Next, let's take a look at some of the more subtle, 172 00:06:18,090 --> 00:06:20,850 more insidious tactics that are employed by social engineers 173 00:06:20,850 --> 00:06:23,070 that rely more on their ability to be a con artist 174 00:06:23,070 --> 00:06:25,140 in order to gain your trust and manipulate you 175 00:06:25,140 --> 00:06:26,640 in a given situation. 176 00:06:26,640 --> 00:06:29,310 For example, you may have received a phone call or an email 177 00:06:29,310 --> 00:06:30,540 from somebody claiming to be from 178 00:06:30,540 --> 00:06:32,760 your information technology support department, 179 00:06:32,760 --> 00:06:35,370 and they're requesting some sensitive information from you. 180 00:06:35,370 --> 00:06:37,320 This social engineer is attempting to create 181 00:06:37,320 --> 00:06:40,110 a sense of urgency or a sense of fear by insisting that you 182 00:06:40,110 --> 00:06:42,750 are facing immediate legal or financial repercussions 183 00:06:42,750 --> 00:06:45,990 if you don't do exactly what they tell you to do right now. 184 00:06:45,990 --> 00:06:48,000 This kind of pressure tactic is designed to make you 185 00:06:48,000 --> 00:06:49,470 act quickly and to bypass 186 00:06:49,470 --> 00:06:52,080 your organization's normal security protocols. 187 00:06:52,080 --> 00:06:54,450 These types of attacks are quite often effective, 188 00:06:54,450 --> 00:06:56,250 because people are more likely to make mistakes 189 00:06:56,250 --> 00:06:59,040 when they're rushed into taking some form of action. 190 00:06:59,040 --> 00:07:00,930 Finally, it's important for us to avoid 191 00:07:00,930 --> 00:07:03,180 a social engineer's traps by being proactive 192 00:07:03,180 --> 00:07:05,130 and avoiding being reactive. 193 00:07:05,130 --> 00:07:07,470 To do this, you should foster a proactive culture 194 00:07:07,470 --> 00:07:09,180 of security in your organization 195 00:07:09,180 --> 00:07:11,790 by regularly training your employees on cybersecurity, 196 00:07:11,790 --> 00:07:14,460 regardless of their position inside of your company. 197 00:07:14,460 --> 00:07:15,960 It's really important that all of your 198 00:07:15,960 --> 00:07:18,090 organizational employees learn to recognize 199 00:07:18,090 --> 00:07:19,890 phishing attempts, understand the importance 200 00:07:19,890 --> 00:07:22,110 of data privacy, and know what constitutes 201 00:07:22,110 --> 00:07:23,790 safe online behavior. 202 00:07:23,790 --> 00:07:26,070 By creating an environment where employees feel responsible 203 00:07:26,070 --> 00:07:27,420 for safeguarding the data, 204 00:07:27,420 --> 00:07:29,850 and they're encouraged to report suspicious activities, 205 00:07:29,850 --> 00:07:31,440 we can prevent social engineering attacks 206 00:07:31,440 --> 00:07:34,140 from being successful against our organization. 207 00:07:34,140 --> 00:07:36,450 To fully train your employees, it's also important 208 00:07:36,450 --> 00:07:38,250 that you include practical exercises 209 00:07:38,250 --> 00:07:41,130 such as simulated phishing attacks, to test how individuals 210 00:07:41,130 --> 00:07:42,930 might respond to an attempted breach, 211 00:07:42,930 --> 00:07:45,120 and then remediate any employees who happen to fall 212 00:07:45,120 --> 00:07:46,620 for the simulated phishing attack, 213 00:07:46,620 --> 00:07:48,600 so they don't get fooled again in the future. 214 00:07:48,600 --> 00:07:51,720 So remember, in our pursuit of robust cybersecurity, 215 00:07:51,720 --> 00:07:54,150 we must remember that technology alone isn't enough 216 00:07:54,150 --> 00:07:55,650 to keep us safe online, 217 00:07:55,650 --> 00:07:57,960 because we also have to consider the significant weight 218 00:07:57,960 --> 00:08:01,050 that the human element has in our organization security. 219 00:08:01,050 --> 00:08:02,850 Each person is going to be a gatekeeper 220 00:08:02,850 --> 00:08:04,290 to our organization's data, 221 00:08:04,290 --> 00:08:06,450 and they play a pivotal role in thwarting potential 222 00:08:06,450 --> 00:08:08,010 social engineering attempts. 223 00:08:08,010 --> 00:08:10,950 Our employees must remain ever vigilant, aware, 224 00:08:10,950 --> 00:08:12,750 and always maintain a good understanding 225 00:08:12,750 --> 00:08:14,910 of social engineering tactics to best protect 226 00:08:14,910 --> 00:08:17,313 our organization against these types of attacks.