In this lesson, we're going to discuss
avoiding social engineering threats.
Now in the complex landscape of cybersecurity,
avoiding social engineering is a topic
that demands our attention and understanding
because it is so prevalent these days.
Social engineering in its most malicious form is deception
where a bad actor attempts to manipulate individuals
into breaking their organization's normal
security procedures by playing on human psychology.
Often, social engineering attacks appear to be innocent,
and this is likely the key that the attackers are going to use
to trick your employees into breaking
your organization's security, which is why awareness
and vigilance are going to be used to create our first line
of defense against these types
of social engineering attacks.
Now, to avoid becoming the victim
of many social engineering attacks,
you simply need to maintain your situational awareness.
Now, situational awareness is a term used to describe
a state of mindfulness about one's immediate surroundings,
the actions you're asked to perform,
and to understand that the action
may have negative consequences if you do perform it.
For example, shoulder surfing is one such attack
that can be prevented by maintaining
good situational awareness.
Shoulder surfing involves the attacker attempting
to peek over your shoulder
to look at sensitive information on your screen.
To counter this kind of an attack, you must always be aware
of your surroundings, especially in public spaces,
and use a privacy screen protector,
as well as being cautious about reading any
confidential information outside of your secured areas.
Eavesdropping is another attack,
and it's similar to shoulder surfing,
but with eavesdropping, our attacker is attempting
to listen in on our private conversations or our meetings
in order to breach our security.
To prevent this, you should only hold sensitive discussions
in soundproofed or secure areas,
and always be aware of any smart devices like smartphones,
smart watches, or other devices
that may have been brought into the room,
because these could be hacked to remotely record
and listen to a given conversation.
Now, if you're having a conversation with a colleague
about work matters during lunch at a local coffee shop,
you could easily fall victim to eavesdropping.
So it's really important that you're always aware
of where you're having your discussions
about your confidential workplace information
to prevent eavesdropping from being successful.
Now, as you can see, shoulder surfing and eavesdropping
usually require the attacker to get close to you
to execute their attack, and one of the ways they may try
to enter your secure office building is to use
social engineering attacks like piggybacking or tailgating,
where unauthorized individuals slip into secure premises
undetected by closely following somebody
who has legitimate access.
To prevent this, your organization should use access control
vestibules to limit entry into your buildings,
to one person at a time, and to ensure your employees
maintain their situational awareness to ensure
no one is trying to sneak through the door or security gate
behind them as they enter that secured facility.
Dumpster diving is yet another social engineering attack
that you need to be aware of,
and this is one where the attackers sift through garbage
to look for any discarded information
that might be pieced back together to form a bigger,
more informative picture of your confidential data.
Again, by having good situational awareness,
your employees might be able to catch somebody
going through the trash can or recycle bin
who's trying to steal information
that somebody else carelessly threw away.
Now, amid all of these multifaceted threats,
we also need to look at operational security.
Operational security, also known as OPSEC,
is one of those things that is a critical shield
in your defensive posture, and OPSEC is really a term
that was originally coined by the military,
and it involves a protection of critical information
that might indicate your activities
to a potential adversary.
When applied inside of a business context,
operational security underscores the importance
of safeguarding your sensitive data,
whether it's your daily routines, your project details,
or your internal procedures
from manipulative social engineers.
Now, this could mean being more discreet
about your work schedule or upcoming business deals,
even when you're in casual conversations
with your friends or family.
Now, why?
Well, social engineers are really good at piecing together
seemingless innocuous details that are shared
over social media, during phone calls,
or even during personal interactions
to construct a narrative that they can then use
to exploit your organization.
They could then pretend to be part of your work life,
using information you've unknowingly divulged
to gain your trust.
So, operational security isn't just a protocol,
but it's actually a mindset that you need to instill
in all of your employees.
Operational security at its core requires
that you're consistently aware
that any piece of information you have
is really a part of a bigger puzzle
that somebody can then use to craft an attack
against your organization.
Now, all of these types of social engineering attempts
really do underscore the need for constant vigilance
and situational awareness, because our actions
might potentially be watched by an attacker.
Beyond these human threats though,
we also need to worry about technological attacks
that are used by social engineers,
like removable media devices and cables
that are used as part of a baiting attack.
For example, let's imagine you just parked your car
at the office and you're walking towards the front door.
On the ground, you see a USB thumb drive sitting there.
You're worried that it may have fallen
out of one of your coworkers pockets
on their way to the office,
so you simply pick it up and carry it over to your desk.
When you get to your desk, you decide to plug in
that thumb drive into your workstation
to see if you can find the name of the owner
by reading a few of the files that are stored on that drive.
Well, by doing this, you may have just unknowingly infected
your workstation or the entire organizational network
with malware because that USB drive wasn't dropped
by one of your coworkers.
Instead, it was dropped by a social engineer,
and they used it as part of a baiting technique
to put that thumb drive in the parking lot
outside of this office building,
in the hopes that somebody like you would pick it up
and connect it to their own workstation,
because they were curious
as to what was on that thumb drive.
Now, to prevent this from occurring,
you should never pick up any USB thumb drives that you find,
and if you do pick it up, you should never ever connect it
to your computer because it could infect you with malware
as soon as you plug it into the system.
In recent years, people have become even smarter
and they stopped falling for this USB thumb drive bait
as often, so, social engineers ramped up their capability
as well and moved on to using charging cables
in public areas as their form of bait instead.
These cables can include malware in their firmware
that will infect your iPhone or Android phone
once you connect your phone to that charger.
This type of charging cable bait is particularly effective
in public areas like airports, lounges, coffee shops,
and other places that offer public charging.
For this reason, I recommend that you always carry your own
charging cable and charger with you wherever you go,
so that you're not relying on an untrusted charging cable
or charging unit when your battery gets too low.
Next, let's take a look at some of the more subtle,
more insidious tactics that are employed by social engineers
that rely more on their ability to be a con artist
in order to gain your trust and manipulate you
in a given situation.
For example, you may have received a phone call or an email
from somebody claiming to be from
your information technology support department,
and they're requesting some sensitive information from you.
This social engineer is attempting to create
a sense of urgency or a sense of fear by insisting that you
are facing immediate legal or financial repercussions
if you don't do exactly what they tell you to do right now.
This kind of pressure tactic is designed to make you
act quickly and to bypass
your organization's normal security protocols.
These types of attacks are quite often effective,
because people are more likely to make mistakes
when they're rushed into taking some form of action.
Finally, it's important for us to avoid
a social engineer's traps by being proactive
and avoiding being reactive.
To do this, you should foster a proactive culture
of security in your organization
by regularly training your employees on cybersecurity,
regardless of their position inside of your company.
It's really important that all of your
organizational employees learn to recognize
phishing attempts, understand the importance
of data privacy, and know what constitutes
safe online behavior.
By creating an environment where employees feel responsible
for safeguarding the data,
and they're encouraged to report suspicious activities,
we can prevent social engineering attacks
from being successful against our organization.
To fully train your employees, it's also important
that you include practical exercises
such as simulated phishing attacks, to test how individuals
might respond to an attempted breach,
and then remediate any employees who happen to fall
for the simulated phishing attack,
so they don't get fooled again in the future.
So remember, in our pursuit of robust cybersecurity,
we must remember that technology alone isn't enough
to keep us safe online,
because we also have to consider the significant weight
that the human element has in our organization security.
Each person is going to be a gatekeeper
to our organization's data,
and they play a pivotal role in thwarting potential
social engineering attempts.
Our employees must remain ever vigilant, aware,
and always maintain a good understanding
of social engineering tactics to best protect
our organization against these types of attacks.