1
00:00:06,510 --> 00:00:08,610
- In this lesson, we are going to look

2
00:00:08,610 --> 00:00:11,370
at one of the most
vulnerable threat vectors,

3
00:00:11,370 --> 00:00:13,290
which is the human threat vector.

4
00:00:13,290 --> 00:00:15,960
And in particular, we're
gonna look at the impact

5
00:00:15,960 --> 00:00:17,283
of social engineering.

6
00:00:18,536 --> 00:00:21,090
Now social engineering,
succinctly, is the action

7
00:00:21,090 --> 00:00:23,970
of exploiting human
nature, you and me, right,

8
00:00:23,970 --> 00:00:26,340
rather than technical hacking techniques,

9
00:00:26,340 --> 00:00:30,960
to gain access to mines,
to systems, to data,

10
00:00:30,960 --> 00:00:32,403
or to buildings.

11
00:00:33,390 --> 00:00:37,170
Now social engineering is
very often considered the path

12
00:00:37,170 --> 00:00:38,340
of lease resistance.

13
00:00:38,340 --> 00:00:39,660
If you're looking to get an answer,

14
00:00:39,660 --> 00:00:41,040
if you're looking to get credentials,

15
00:00:41,040 --> 00:00:42,570
if you're looking to get access

16
00:00:42,570 --> 00:00:45,030
into maybe a data center
or into a building,

17
00:00:45,030 --> 00:00:48,720
social engineering is often
the best way to do it.

18
00:00:48,720 --> 00:00:49,553
Why?

19
00:00:49,553 --> 00:00:51,180
Because we're exploiting human beings

20
00:00:51,180 --> 00:00:53,850
and the best of human
nature in many cases,

21
00:00:53,850 --> 00:00:56,550
and because most of us are
so busy just doing our job,

22
00:00:56,550 --> 00:00:58,260
we're focused on whatever we're doing,

23
00:00:58,260 --> 00:01:00,170
that we're not always cognizant

24
00:01:00,170 --> 00:01:02,970
or paying attention or have our antenna up

25
00:01:02,970 --> 00:01:05,490
to the fact that we're
being social engineered.

26
00:01:05,490 --> 00:01:08,220
Now a significant number
of security incidents

27
00:01:08,220 --> 00:01:10,260
and data breaches have started with

28
00:01:10,260 --> 00:01:13,470
or have included a social
engineering component.

29
00:01:13,470 --> 00:01:15,900
I don't have any hard
numbers, but you know,

30
00:01:15,900 --> 00:01:18,560
if I said 98 or 99%

31
00:01:18,560 --> 00:01:21,000
of all significant
security incidents started

32
00:01:21,000 --> 00:01:22,140
with social engineering,

33
00:01:22,140 --> 00:01:24,780
and I had to prove that
number, I bet I could.

34
00:01:24,780 --> 00:01:27,000
I mean, it's just that pervasive.

35
00:01:27,000 --> 00:01:30,900
So social engineering is
a critical training topic

36
00:01:30,900 --> 00:01:34,320
for everybody in your
organization, not just, you know,

37
00:01:34,320 --> 00:01:36,540
for folks on, you know, at the teller line

38
00:01:36,540 --> 00:01:37,950
or on the factory floor.

39
00:01:37,950 --> 00:01:41,313
Everybody up to and including
your board of directors.

40
00:01:44,220 --> 00:01:46,530
Let's look at social engineering tactics.

41
00:01:46,530 --> 00:01:47,760
Social engineers,

42
00:01:47,760 --> 00:01:49,800
and that's really just a
very nice name we're giving

43
00:01:49,800 --> 00:01:51,540
to our attackers,

44
00:01:51,540 --> 00:01:55,230
so our social engineer
attackers, use psychology

45
00:01:55,230 --> 00:01:58,290
to take advantage of some
basic human instincts

46
00:01:58,290 --> 00:01:59,790
and responses.

47
00:01:59,790 --> 00:02:02,400
Now, their two primary tactics are going

48
00:02:02,400 --> 00:02:06,120
to be pretexting and impersonation.

49
00:02:06,120 --> 00:02:08,370
Now, pretexts are fabricated scenarios.

50
00:02:08,370 --> 00:02:11,610
Think of them as a story used
to conceal the true purpose

51
00:02:11,610 --> 00:02:13,200
of an activity.

52
00:02:13,200 --> 00:02:16,380
Now pretexts generally
include just enough truth

53
00:02:16,380 --> 00:02:18,120
to make them appear plausible.

54
00:02:18,120 --> 00:02:19,530
So let me give you an example.

55
00:02:19,530 --> 00:02:23,070
So here in the US, April 15th,
we have to file our taxes.

56
00:02:23,070 --> 00:02:26,670
So let's say around
May 1st, I get an email

57
00:02:26,670 --> 00:02:30,330
or a phone call or a text
saying they're from the IRS

58
00:02:30,330 --> 00:02:32,280
and my taxes are late.

59
00:02:32,280 --> 00:02:34,470
I'm like, no, I know I filed them.

60
00:02:34,470 --> 00:02:36,240
It's like, uh-oh, maybe
they didn't go through

61
00:02:36,240 --> 00:02:37,680
or maybe there's a problem

62
00:02:37,680 --> 00:02:39,300
or maybe the mail didn't make it.

63
00:02:39,300 --> 00:02:42,030
So now, there's just enough truth, right?

64
00:02:42,030 --> 00:02:43,530
I had to file my taxes.

65
00:02:43,530 --> 00:02:44,550
Maybe they're not there.

66
00:02:44,550 --> 00:02:45,810
I don't know if they're there or not

67
00:02:45,810 --> 00:02:47,940
'cause I haven't gotten any confirmation.

68
00:02:47,940 --> 00:02:51,390
So there's enough going on to
make me start saying, okay,

69
00:02:51,390 --> 00:02:53,343
I need to pay attention to this.

70
00:02:55,650 --> 00:02:56,970
The second is impersonation,

71
00:02:56,970 --> 00:02:59,760
which is just the act of
pretending to be someone else.

72
00:02:59,760 --> 00:03:02,017
Our social engineer can't
say, "Hey I'm a bad guy,

73
00:03:02,017 --> 00:03:03,360
"I'm the social engineer,"

74
00:03:03,360 --> 00:03:07,050
so they have to be, right,
take on the personality

75
00:03:07,050 --> 00:03:11,220
of someone else, the
IRS agent or FBI agent,

76
00:03:11,220 --> 00:03:14,280
or, you know, your friend in the PTA,

77
00:03:14,280 --> 00:03:16,480
but they need to pretend
to be someone else.

78
00:03:18,300 --> 00:03:19,133
Social engineering

79
00:03:19,133 --> 00:03:21,570
really exploits our human
cognition functions,

80
00:03:21,570 --> 00:03:24,870
and that's one of the
reasons why it is so hard

81
00:03:24,870 --> 00:03:27,960
to get people to really, you know,

82
00:03:27,960 --> 00:03:30,120
recognize that they're
being social engineered.

83
00:03:30,120 --> 00:03:32,280
And it's why social
engineering simulations

84
00:03:32,280 --> 00:03:33,693
are such a useful tool.

85
00:03:34,650 --> 00:03:36,480
So what are the human cognition functions

86
00:03:36,480 --> 00:03:38,250
that social engineers exploit?

87
00:03:38,250 --> 00:03:43,203
Authority, trust,
responsiveness, fear, urgency,

88
00:03:44,280 --> 00:03:48,810
a threat, reward, and curiosity.

89
00:03:48,810 --> 00:03:50,520
Let's talk through those.

90
00:03:50,520 --> 00:03:53,227
We all have the instinct
to respond to authority.

91
00:03:53,227 --> 00:03:54,810
"This is your boss calling."

92
00:03:54,810 --> 00:03:59,257
Or, you know, "This is chief
so-and-so from," you know,

93
00:03:59,257 --> 00:04:01,230
"X, Y, Z agency," right?

94
00:04:01,230 --> 00:04:03,720
Start with authority and
we're like, okay, yep.

95
00:04:03,720 --> 00:04:06,060
We have that instinct to respond.

96
00:04:06,060 --> 00:04:07,680
We have the tendency to trust.

97
00:04:07,680 --> 00:04:10,410
It's human nature to be trusting.

98
00:04:10,410 --> 00:04:12,157
We don't wanna walk around
our whole lives saying,

99
00:04:12,157 --> 00:04:13,627
"Oh I don't believe
anything that person says,

100
00:04:13,627 --> 00:04:15,210
"I don't believe anything
that person says," right?

101
00:04:15,210 --> 00:04:18,210
So we tend to trust.

102
00:04:18,210 --> 00:04:20,550
Responsiveness, we all
like to be responsive.

103
00:04:20,550 --> 00:04:21,810
You ask me to do something,

104
00:04:21,810 --> 00:04:24,150
our natural tendency is to be responsive,

105
00:04:24,150 --> 00:04:26,703
to want to do whatever
I'm being asked to do.

106
00:04:28,530 --> 00:04:31,110
We have fear of doing the wrong thing.

107
00:04:31,110 --> 00:04:33,000
Nobody likes to do the wrong thing,

108
00:04:33,000 --> 00:04:34,380
nobody likes to be embarrassed,

109
00:04:34,380 --> 00:04:36,153
nobody wants to get in trouble.

110
00:04:38,070 --> 00:04:40,800
We have urgency, which
is a need to act quickly.

111
00:04:40,800 --> 00:04:43,440
If someone says, "This
has to happen right away,"

112
00:04:43,440 --> 00:04:45,757
boy, it causes some anxiety
and angst and we're like,

113
00:04:45,757 --> 00:04:47,017
"Okay, okay, I gotta do it.

114
00:04:47,017 --> 00:04:48,327
"Gotta do it right away."

115
00:04:49,350 --> 00:04:53,910
A threat, the threat of harm
to oneself or to someone else,

116
00:04:53,910 --> 00:04:56,100
our colleague or our family member, right,

117
00:04:56,100 --> 00:04:58,710
that's enough to get us to take an action.

118
00:04:58,710 --> 00:05:00,330
The promise of a reward, right?

119
00:05:00,330 --> 00:05:02,160
Who doesn't wanna like, win the lottery,

120
00:05:02,160 --> 00:05:05,010
or even get 10 bucks for
filling out a survey?

121
00:05:05,010 --> 00:05:06,960
How cool to get a reward.

122
00:05:06,960 --> 00:05:09,360
And we're all innately curious, right?

123
00:05:09,360 --> 00:05:11,330
We have the desire to be in the know.

124
00:05:11,330 --> 00:05:13,470
We wanna know what's going on.

125
00:05:13,470 --> 00:05:15,600
And particularly things that
maybe we shouldn't even know,

126
00:05:15,600 --> 00:05:17,670
like, I wonder what my boss makes.

127
00:05:17,670 --> 00:05:20,280
So authority, trust, responsiveness, fear,

128
00:05:20,280 --> 00:05:23,100
urgency, threat, reward, and curiosity.

129
00:05:23,100 --> 00:05:25,410
And these are all our
human cognition functions

130
00:05:25,410 --> 00:05:28,563
that our social engineers
know how to exploit.

131
00:05:30,090 --> 00:05:32,520
So let's talk about some
social engineering techniques.

132
00:05:32,520 --> 00:05:33,420
First, remote ones,

133
00:05:33,420 --> 00:05:35,430
meaning that the social
engineer doesn't have

134
00:05:35,430 --> 00:05:38,310
to physically be close to you at all.

135
00:05:38,310 --> 00:05:42,237
Phishing, SMSishing,
vishing and watering hole.

136
00:05:42,237 --> 00:05:44,220
Now I know you're all
familiar with phishing.

137
00:05:44,220 --> 00:05:47,850
Phishing is pretexting an
impersonation using email.

138
00:05:47,850 --> 00:05:49,680
Now the origin of the
term phishing really came

139
00:05:49,680 --> 00:05:51,810
from like casting a wide net.

140
00:05:51,810 --> 00:05:55,380
Spear phishing is targeting a
specific group or individual,

141
00:05:55,380 --> 00:05:58,860
and whaling is when we target
a high profile individual,

142
00:05:58,860 --> 00:06:01,053
like a CEO or a CFO.

143
00:06:02,390 --> 00:06:04,530
S-M-S-ishing, or SMSishing,

144
00:06:04,530 --> 00:06:07,830
is pretexting and
impersonating using text.

145
00:06:07,830 --> 00:06:09,360
Now this one's really interesting

146
00:06:09,360 --> 00:06:12,750
because we tend to respond to text.

147
00:06:12,750 --> 00:06:15,330
While pretty much we don't
respond to phishing emails,

148
00:06:15,330 --> 00:06:18,180
and a lot of our email
programs are really good

149
00:06:18,180 --> 00:06:20,160
at filtering those out,

150
00:06:20,160 --> 00:06:21,960
when we get a text, when your phone buzzes

151
00:06:21,960 --> 00:06:24,270
and you get a text, you pick it up, right?

152
00:06:24,270 --> 00:06:25,920
And you look at it and you read it,

153
00:06:25,920 --> 00:06:30,360
because text opposed to email
still feels very personal,

154
00:06:30,360 --> 00:06:31,193
right?

155
00:06:31,193 --> 00:06:32,587
"If they're texting me, they must know me.

156
00:06:32,587 --> 00:06:34,977
"I probably have to respond to it."

157
00:06:36,750 --> 00:06:37,583
Then we have vishing.

158
00:06:37,583 --> 00:06:40,380
Vishing is pretexting
impersonation using voice,

159
00:06:40,380 --> 00:06:41,790
someone calling you.

160
00:06:41,790 --> 00:06:42,840
Now what's so interesting

161
00:06:42,840 --> 00:06:44,850
with vishing now is that
there's a whole host

162
00:06:44,850 --> 00:06:47,220
of programs that I'll talk
about in just a few moments

163
00:06:47,220 --> 00:06:49,350
that allow voices to be changed,

164
00:06:49,350 --> 00:06:51,480
male to female or female to be male,

165
00:06:51,480 --> 00:06:55,233
to be given an accent, and
to have background noises.

166
00:06:56,220 --> 00:06:58,080
So phishing, SMSishing, and vishing,

167
00:06:58,080 --> 00:07:00,210
all direct communication.

168
00:07:00,210 --> 00:07:03,120
A watering hole describes
the exploitation of a website

169
00:07:03,120 --> 00:07:05,100
or a social media application

170
00:07:05,100 --> 00:07:06,990
that is frequented by the target.

171
00:07:06,990 --> 00:07:08,580
So let's say you're on LinkedIn a lot

172
00:07:08,580 --> 00:07:11,340
or you're on Facebook a
lot and you're the target.

173
00:07:11,340 --> 00:07:14,070
Well, the social engineer is
going to create a profile.

174
00:07:14,070 --> 00:07:15,630
I'm going to maybe comment, you know,

175
00:07:15,630 --> 00:07:18,540
on some of your publications,

176
00:07:18,540 --> 00:07:22,350
maybe become friends with
you, strike up a relationship,

177
00:07:22,350 --> 00:07:25,140
maybe eventually send you a
link or send you a picture,

178
00:07:25,140 --> 00:07:26,130
and there you go.

179
00:07:26,130 --> 00:07:28,430
Now we're down the path
of social engineering.

180
00:07:30,690 --> 00:07:33,480
Now social engineers may also
decide to come right on site,

181
00:07:33,480 --> 00:07:36,810
and we refer to that as local
social engineering techniques.

182
00:07:36,810 --> 00:07:40,260
Shoulder surfing is covert observation.

183
00:07:40,260 --> 00:07:42,480
It used to really mean literally standing

184
00:07:42,480 --> 00:07:43,313
over somebody's shoulders

185
00:07:43,313 --> 00:07:45,990
so you can see what their
typing, what their password is.

186
00:07:45,990 --> 00:07:48,090
But now, it could be covert observation,

187
00:07:48,090 --> 00:07:49,680
whether nearby or remote, right?

188
00:07:49,680 --> 00:07:54,240
I could have, easily, right,
a camera in a lapel pin

189
00:07:54,240 --> 00:07:56,100
or I could have it in my notebook

190
00:07:56,100 --> 00:07:57,540
or I could have it in a pen,

191
00:07:57,540 --> 00:08:00,150
or I could just drop a
little device, you know,

192
00:08:00,150 --> 00:08:03,750
somewhere on a crezenda, and
that's actually recording.

193
00:08:03,750 --> 00:08:06,423
So shoulder surfing
being covert observation.

194
00:08:07,290 --> 00:08:09,570
Piggybacking, which is
sometimes called tailgating,

195
00:08:09,570 --> 00:08:12,630
is when an unauthorized
person enters a checkpoint

196
00:08:12,630 --> 00:08:16,020
close behind or in concert
with authorized personnel.

197
00:08:16,020 --> 00:08:18,180
So maybe you need to
swipe a badge to get in.

198
00:08:18,180 --> 00:08:21,870
So I'm the social engineer, I
come in and I may be dressed

199
00:08:21,870 --> 00:08:25,320
as a UPS driver and I'm
carrying a heavy package,

200
00:08:25,320 --> 00:08:27,090
and you're like, "Oh, let
me open the door for you."

201
00:08:27,090 --> 00:08:28,740
And there I go.

202
00:08:28,740 --> 00:08:31,890
Or maybe I go out to where
all the cigarette smokers are

203
00:08:31,890 --> 00:08:33,230
and I make friends with
the cigarette smokers,

204
00:08:33,230 --> 00:08:36,420
we all complain about the fact
that we can't smoke, right,

205
00:08:36,420 --> 00:08:37,710
close in on the campus.

206
00:08:37,710 --> 00:08:39,210
I'm not a smoker by the way.

207
00:08:39,210 --> 00:08:41,310
And then we all kinda walk in

208
00:08:41,310 --> 00:08:43,530
as this jovial, you know, cohesive group

209
00:08:43,530 --> 00:08:45,780
and somebody opens the
door and in we all go.

210
00:08:47,010 --> 00:08:48,210
Dumpster diving is the act

211
00:08:48,210 --> 00:08:50,730
of rummaging through trash,
which sounds pretty disgusting,

212
00:08:50,730 --> 00:08:54,180
and recycling in search of information.

213
00:08:54,180 --> 00:08:55,500
And lastly, we have baiting.

214
00:08:55,500 --> 00:08:59,550
And baiting is a really,
really successful technique.

215
00:08:59,550 --> 00:09:01,620
Baiting is the use of a gift, for example,

216
00:09:01,620 --> 00:09:04,290
a USB drive, for infiltration.

217
00:09:04,290 --> 00:09:06,030
So maybe you go to a trade show

218
00:09:06,030 --> 00:09:08,310
and you get to pick up a USB drive,

219
00:09:08,310 --> 00:09:10,470
and in fact, the USB drive has malware

220
00:09:10,470 --> 00:09:12,960
or instructions to phone home.

221
00:09:12,960 --> 00:09:14,070
I did a number

222
00:09:14,070 --> 00:09:17,010
of social engineering
simulations over my career,

223
00:09:17,010 --> 00:09:20,430
and one of the most successful
was when we sent bracelets.

224
00:09:20,430 --> 00:09:22,050
So these kind of rubbery bracelets

225
00:09:22,050 --> 00:09:25,020
that the clasp was actually a USB device,

226
00:09:25,020 --> 00:09:28,050
and it had a little marketing
name on it and said, you know,

227
00:09:28,050 --> 00:09:29,790
isn't this a cool marketing tool?

228
00:09:29,790 --> 00:09:31,320
You know, wanna see our whole catalog?

229
00:09:31,320 --> 00:09:33,060
Just, you know, insert the USB.

230
00:09:33,060 --> 00:09:35,280
And then it was just
designed to phone home

231
00:09:35,280 --> 00:09:36,450
so we knew that they had done it.

232
00:09:36,450 --> 00:09:40,200
And it was incredibly,
extraordinarily successful.

233
00:09:40,200 --> 00:09:43,110
So baiting is a really good technique

234
00:09:43,110 --> 00:09:44,703
that social engineers use.

235
00:09:46,530 --> 00:09:47,940
Another set of techniques

236
00:09:47,940 --> 00:09:50,280
that are really up and coming

237
00:09:50,280 --> 00:09:52,800
are called synthetic content techniques.

238
00:09:52,800 --> 00:09:55,380
And we're seeing these
in the political arena

239
00:09:55,380 --> 00:09:58,410
and we're seeing these
in social engineering,

240
00:09:58,410 --> 00:10:03,123
the use of disinformation,
shallow fakes, and deep fakes.

241
00:10:04,290 --> 00:10:07,740
Disinformation is false
or misleading information

242
00:10:07,740 --> 00:10:10,140
that is spread deliberately to deceive.

243
00:10:10,140 --> 00:10:13,170
So in a social engineering scenario,

244
00:10:13,170 --> 00:10:15,960
there would be some
disinformation sort of spread

245
00:10:15,960 --> 00:10:17,520
to set the groundwork.

246
00:10:17,520 --> 00:10:19,230
Now there is a difference
between disinformation

247
00:10:19,230 --> 00:10:20,610
and misinformation.

248
00:10:20,610 --> 00:10:22,320
Misinformation is when false

249
00:10:22,320 --> 00:10:24,030
or misleading information is spread,

250
00:10:24,030 --> 00:10:27,180
but it doesn't have the
deception component, right?

251
00:10:27,180 --> 00:10:28,890
It's not being done deliberately.

252
00:10:28,890 --> 00:10:30,480
When we talk about disinformation,

253
00:10:30,480 --> 00:10:32,250
we're talking about false
or misleading information

254
00:10:32,250 --> 00:10:34,293
that is spread deliberately to deceive.

255
00:10:35,700 --> 00:10:38,250
And then we have shallow
fakes and deep fakes.

256
00:10:38,250 --> 00:10:40,260
Shallow fakes is the alteration

257
00:10:40,260 --> 00:10:44,430
of media content using simple
video editing software,

258
00:10:44,430 --> 00:10:46,680
where deep fakes is the
use of machine learning

259
00:10:46,680 --> 00:10:49,560
and/or artificial
intelligence to manipulate

260
00:10:49,560 --> 00:10:53,220
or generate deceptive
audio or video content.

261
00:10:53,220 --> 00:10:54,420
And shallow fakes

262
00:10:54,420 --> 00:10:57,780
and deep fakes really
are starting to be used

263
00:10:57,780 --> 00:11:00,153
in social engineering scenarios.

264
00:11:01,590 --> 00:11:04,320
Matter of fact, back a couple years ago,

265
00:11:04,320 --> 00:11:08,280
the FBI issued a private
industry notification

266
00:11:08,280 --> 00:11:11,940
about leveraging synthetic
content with the headline

267
00:11:11,940 --> 00:11:15,180
that malicious actors
will, almost certainly,

268
00:11:15,180 --> 00:11:17,310
will leverage synthetic content

269
00:11:17,310 --> 00:11:20,733
for cyber and for foreign
influence operations.

270
00:11:26,280 --> 00:11:29,250
So what are some of the tools
that our social engineers use?

271
00:11:29,250 --> 00:11:31,200
Well, they may have a website,

272
00:11:31,200 --> 00:11:34,200
create social profiles,
have a phishing toolkit,

273
00:11:34,200 --> 00:11:37,740
a phone spoofing service,
an audio recorder, spy cams,

274
00:11:37,740 --> 00:11:42,000
a programed USB, or even
clothing and collateral,

275
00:11:42,000 --> 00:11:44,010
a website to establish legitimacy,

276
00:11:44,010 --> 00:11:45,480
so you say, "I wanna
know more about them."

277
00:11:45,480 --> 00:11:47,887
Oh, I go out to www dot whatever,

278
00:11:47,887 --> 00:11:49,590
"Wow, they're right there."

279
00:11:49,590 --> 00:11:52,740
Social profiles in social media, right,

280
00:11:52,740 --> 00:11:56,400
in Facebook, in LinkedIn,
in Instagram, right,

281
00:11:56,400 --> 00:11:59,580
to establish trust and relationships.

282
00:11:59,580 --> 00:12:00,540
A phishing toolkit,

283
00:12:00,540 --> 00:12:03,750
if the social engineer wants
to do a phishing attack,

284
00:12:03,750 --> 00:12:04,920
they don't even have to know anything

285
00:12:04,920 --> 00:12:06,210
about how to do it, right?

286
00:12:06,210 --> 00:12:08,940
They can actually just
go out to the dark web

287
00:12:08,940 --> 00:12:10,920
and buy a phishing toolkit.

288
00:12:10,920 --> 00:12:12,930
And that can be used to create, send,

289
00:12:12,930 --> 00:12:14,400
and track phishing emails,

290
00:12:14,400 --> 00:12:16,983
to gather information,
and to destroy malware.

291
00:12:18,330 --> 00:12:22,650
Phone spoofing services can be
used to manipulate caller ID,

292
00:12:22,650 --> 00:12:25,710
disguise a voice, turn a male
voice into a female voice

293
00:12:25,710 --> 00:12:27,360
or a female voice into a male voice

294
00:12:27,360 --> 00:12:30,330
or add some accents, and
change the surroundings.

295
00:12:30,330 --> 00:12:31,800
It can sound like you're in a call center.

296
00:12:31,800 --> 00:12:33,930
It can sound like you're on a busy street.

297
00:12:33,930 --> 00:12:35,490
It can sound like you're out in nature

298
00:12:35,490 --> 00:12:37,640
with some birds chirping
in the background.

299
00:12:39,480 --> 00:12:42,300
Often a social engineer
will use an audio recorder

300
00:12:42,300 --> 00:12:43,560
to record a conversation.

301
00:12:43,560 --> 00:12:46,410
They'll use spy cams
to capture live feeds,

302
00:12:46,410 --> 00:12:49,830
or we can have these little
cameras now in pins, pens,

303
00:12:49,830 --> 00:12:52,050
notebooks in our glasses,

304
00:12:52,050 --> 00:12:55,620
having programmed USBs to
initiate commands on a device

305
00:12:55,620 --> 00:12:57,810
or as a way to spread malware,

306
00:12:57,810 --> 00:12:59,910
and to have clothing or collateral,

307
00:12:59,910 --> 00:13:04,080
to really establish
legitimacy and authorization.

308
00:13:04,080 --> 00:13:07,230
So coming in dressed in a
uniform, having a clipboard,

309
00:13:07,230 --> 00:13:10,080
having the hat, having
a work order, right?

310
00:13:10,080 --> 00:13:11,790
All of those things can be used

311
00:13:11,790 --> 00:13:15,573
to really establish
legitimacy and authorization.

312
00:13:17,910 --> 00:13:20,730
So let's just quickly
go through the anatomy

313
00:13:20,730 --> 00:13:22,410
of a social engineering attack.

314
00:13:22,410 --> 00:13:24,180
The first thing the social
engineer is gonna do

315
00:13:24,180 --> 00:13:25,620
is establish their objective.

316
00:13:25,620 --> 00:13:28,110
What are they trying to accomplish?

317
00:13:28,110 --> 00:13:29,940
They will then determine the target.

318
00:13:29,940 --> 00:13:32,070
Who are they going to go after?

319
00:13:32,070 --> 00:13:33,630
They'll then do some reconnaissance.

320
00:13:33,630 --> 00:13:35,550
Reconnaissance, sometimes
called footprinting,

321
00:13:35,550 --> 00:13:38,820
is gathering information about the target.

322
00:13:38,820 --> 00:13:40,860
Maybe, you know, do they have children?

323
00:13:40,860 --> 00:13:45,090
What social channels are they on, right?

324
00:13:45,090 --> 00:13:47,670
Do they drive to work or
take public transportation?

325
00:13:47,670 --> 00:13:50,070
All of those type of things,
are they a sports fan?

326
00:13:50,070 --> 00:13:52,200
And if they are, what
teams do they follow?

327
00:13:52,200 --> 00:13:54,453
Wouldn't they love to
get some free tickets?

328
00:13:56,430 --> 00:13:58,470
So based on what they've learned, right,

329
00:13:58,470 --> 00:14:00,663
they'll do the pretext development,

330
00:14:01,740 --> 00:14:04,320
they'll create the auxiliary
tools and collateral

331
00:14:04,320 --> 00:14:08,130
that's needed, and then
they'll launch their attack.

332
00:14:08,130 --> 00:14:11,280
But generally, they'll launch
it in a relatively small scale

333
00:14:11,280 --> 00:14:13,470
to test it out to see how it's doing.

334
00:14:13,470 --> 00:14:15,630
In the marketing world,
they call it A/B testing.

335
00:14:15,630 --> 00:14:18,510
Well, our social engineers
really do the same thing.

336
00:14:18,510 --> 00:14:21,420
They'll evaluate how well it's going,

337
00:14:21,420 --> 00:14:24,600
they may revise it, and then ultimately,

338
00:14:24,600 --> 00:14:27,153
they will be able to
accomplish their exploit.

339
00:14:28,830 --> 00:14:31,080
So how do we counteract
social engineering?

340
00:14:31,080 --> 00:14:31,913
The key

341
00:14:31,913 --> 00:14:34,440
to counteracting social
engineering is user awareness,

342
00:14:34,440 --> 00:14:36,840
but not user awareness alone.

343
00:14:36,840 --> 00:14:41,190
We have to support it by
technical and physical controls.

344
00:14:41,190 --> 00:14:43,290
So user awareness
techniques include training

345
00:14:43,290 --> 00:14:45,510
to recognize signs of manipulation

346
00:14:45,510 --> 00:14:49,740
and participation in social
engineering simulations.

347
00:14:49,740 --> 00:14:53,280
Technical controls include
email and attachment filtering,

348
00:14:53,280 --> 00:14:57,360
browser security settings,
sandboxing, and patch management.

349
00:14:57,360 --> 00:15:01,080
And physical controls include
surveillance, access controls,

350
00:15:01,080 --> 00:15:02,913
and removable media controls.

351
00:15:04,830 --> 00:15:07,890
One of the best ways to
train our user community

352
00:15:07,890 --> 00:15:12,330
to recognize social engineering
is to do simulations.

353
00:15:12,330 --> 00:15:15,240
Simulations are really
social engineering attacks,

354
00:15:15,240 --> 00:15:18,180
if you will, but it's social
engineering for good, right?

355
00:15:18,180 --> 00:15:21,090
We hire someone to do
the social engineering

356
00:15:21,090 --> 00:15:23,580
as a way to teach our users, you know,

357
00:15:23,580 --> 00:15:25,080
what they might experience.

358
00:15:25,080 --> 00:15:28,260
So they actually go through
the process of experiencing it,

359
00:15:28,260 --> 00:15:31,740
and then we can use those examples

360
00:15:31,740 --> 00:15:33,990
in our training and provide feedback.

361
00:15:33,990 --> 00:15:34,823
How did we do?

362
00:15:34,823 --> 00:15:35,656
Did we do good?

363
00:15:35,656 --> 00:15:36,489
Did we do bad?

364
00:15:36,489 --> 00:15:37,322
Did we respond right?

365
00:15:37,322 --> 00:15:38,223
What didn't we notice?

366
00:15:42,120 --> 00:15:43,530
Now it's really important,

367
00:15:43,530 --> 00:15:45,960
if you're gonna do a social
engineering simulation,

368
00:15:45,960 --> 00:15:47,760
that you get buy-in, right?

369
00:15:47,760 --> 00:15:49,530
You get buy-in from your organization.

370
00:15:49,530 --> 00:15:51,660
Yes, this is what we wanna do.

371
00:15:51,660 --> 00:15:53,250
So how do you get buy-in?

372
00:15:53,250 --> 00:15:54,960
Well, go right to the top, right?

373
00:15:54,960 --> 00:15:57,990
Go up to the CEO or COO, go
to the board of directors,

374
00:15:57,990 --> 00:16:00,273
go as high as an organization as you can.

375
00:16:01,170 --> 00:16:03,180
We're gonna start with briefing them

376
00:16:03,180 --> 00:16:05,340
on the impact of social engineering,

377
00:16:05,340 --> 00:16:08,310
why social engineering is so
dangerous to our organization,

378
00:16:08,310 --> 00:16:10,110
giving examples of like ransomware

379
00:16:10,110 --> 00:16:12,300
or disclosure of information.

380
00:16:12,300 --> 00:16:14,790
We can provide examples
and statistics to them.

381
00:16:14,790 --> 00:16:17,250
Include respected source materials.

382
00:16:17,250 --> 00:16:20,670
If applicable, invoke some
regulatory expectations.

383
00:16:20,670 --> 00:16:23,070
And then you wanna assure
them of confidentiality.

384
00:16:23,070 --> 00:16:24,360
Because one of the roadblocks

385
00:16:24,360 --> 00:16:26,677
of doing a simulation is people say,

386
00:16:26,677 --> 00:16:28,117
"Oh, what if we don't do well?

387
00:16:28,117 --> 00:16:29,580
"Who's gonna know about that?"

388
00:16:29,580 --> 00:16:31,710
Or, "I don't wanna embarrass anybody."

389
00:16:31,710 --> 00:16:34,590
So assure them of
confidentiality and stress

390
00:16:34,590 --> 00:16:38,520
that positive organizational
improvement is really the goal,

391
00:16:38,520 --> 00:16:40,740
opposed to disciplinary action.

392
00:16:40,740 --> 00:16:43,140
We're not looking to
embarrass anybody, right,

393
00:16:43,140 --> 00:16:44,797
we're not looking to say,
"Oh, you did that wrong,

394
00:16:44,797 --> 00:16:46,500
"you know, it's gonna go on your record."

395
00:16:46,500 --> 00:16:48,240
What we're really looking for

396
00:16:48,240 --> 00:16:51,600
is positive organizational improvement.

397
00:16:51,600 --> 00:16:53,677
And once you've done that,
find a champion who says,

398
00:16:53,677 --> 00:16:55,230
"Yes, we should do this,"

399
00:16:55,230 --> 00:16:57,450
and then capitalize on the momentum.

400
00:16:57,450 --> 00:16:59,700
Go and do your social
engineering simulations,

401
00:16:59,700 --> 00:17:03,180
and then have it followed
up by really good training

402
00:17:03,180 --> 00:17:05,793
and positive, positive feedback.

403
00:17:06,750 --> 00:17:08,730
Doing that really can make a difference

404
00:17:08,730 --> 00:17:09,843
in your organization.

405
00:17:11,490 --> 00:17:12,323
All right, my friends,

406
00:17:12,323 --> 00:17:13,650
that brings us to a 3-Second Challenge.

407
00:17:13,650 --> 00:17:14,483
You know how to do it.

408
00:17:14,483 --> 00:17:15,690
Let's go.

409
00:17:15,690 --> 00:17:17,880
Tactics and techniques
used to manipulate people

410
00:17:17,880 --> 00:17:19,560
by deception.

411
00:17:19,560 --> 00:17:21,273
One, two, three.

412
00:17:22,530 --> 00:17:24,330
That's social engineering.

413
00:17:24,330 --> 00:17:26,733
Question two, a fabricated scenario.

414
00:17:27,570 --> 00:17:29,493
One, two, three.

415
00:17:30,420 --> 00:17:31,413
That's pretexting.

416
00:17:32,820 --> 00:17:35,040
Number three, false or
misleading information

417
00:17:35,040 --> 00:17:37,143
that is spread deliberately to deceive.

418
00:17:38,010 --> 00:17:39,903
One, two, three.

419
00:17:41,190 --> 00:17:42,513
Disinformation.

420
00:17:43,560 --> 00:17:47,310
Number four, using machine
learning and/or AI,

421
00:17:47,310 --> 00:17:48,450
artificial intelligence,

422
00:17:48,450 --> 00:17:52,323
to manipulate or generate
deceptive audio or video content.

423
00:17:53,670 --> 00:17:55,890
One, two, three.

424
00:17:55,890 --> 00:17:57,063
That's a deep fake.

425
00:17:58,830 --> 00:18:00,690
And lastly, exploiting a website

426
00:18:00,690 --> 00:18:02,940
or social media application
that is frequented

427
00:18:02,940 --> 00:18:03,993
by the target.

428
00:18:05,490 --> 00:18:07,770
One, two, three.

429
00:18:07,770 --> 00:18:09,780
And that's a watering hole.

430
00:18:09,780 --> 00:18:12,030
I hope you did well on those.

431
00:18:12,030 --> 00:18:13,830
All right, let's do a Security-in-Action

432
00:18:13,830 --> 00:18:15,633
on the social engineering assault.

433
00:18:16,740 --> 00:18:18,510
A few days ago, a pop-up appeared

434
00:18:18,510 --> 00:18:20,400
on your uncle's computer telling him

435
00:18:20,400 --> 00:18:23,160
to call the Microsoft
helpline immediately,

436
00:18:23,160 --> 00:18:24,600
as his computer was infected

437
00:18:24,600 --> 00:18:27,660
and being used to distribute
child pornography.

438
00:18:27,660 --> 00:18:29,040
He called the number display

439
00:18:29,040 --> 00:18:30,660
and reached what sounded like a very,

440
00:18:30,660 --> 00:18:32,490
very legitimate call center.

441
00:18:32,490 --> 00:18:34,320
They told him that to clear up the issue,

442
00:18:34,320 --> 00:18:38,490
he needed to upgrade his operating
system at a minimal cost.

443
00:18:38,490 --> 00:18:40,530
So he provided his bank
account information

444
00:18:40,530 --> 00:18:43,500
and followed the remote
access instructions.

445
00:18:43,500 --> 00:18:45,150
So my question to you is,

446
00:18:45,150 --> 00:18:49,680
what social engineering psychology
did the criminals employ?

447
00:18:49,680 --> 00:18:52,290
Go ahead and put me on pause,
read through that again,

448
00:18:52,290 --> 00:18:55,620
and jot down, what social
engineering psychology

449
00:18:55,620 --> 00:18:57,123
did those criminals employ?

450
00:19:00,960 --> 00:19:03,840
Well, let's talk through
this human cognition exploit.

451
00:19:03,840 --> 00:19:05,550
The tendency to trust, right?

452
00:19:05,550 --> 00:19:07,867
It was Microsoft, he said,
"Okay, it's Microsoft.

453
00:19:07,867 --> 00:19:09,447
"I must trust them."

454
00:19:10,590 --> 00:19:13,410
The need to act fast, right?

455
00:19:13,410 --> 00:19:16,380
His machine has child pornography.

456
00:19:16,380 --> 00:19:17,760
We gotta do something
about that right away.

457
00:19:17,760 --> 00:19:19,530
It's not legal, you can get in trouble.

458
00:19:19,530 --> 00:19:20,853
There's urgency there.

459
00:19:21,750 --> 00:19:24,060
The instinct to respond to authority,

460
00:19:24,060 --> 00:19:25,260
again, he called the helpline.

461
00:19:25,260 --> 00:19:26,180
The helpline, you know,

462
00:19:26,180 --> 00:19:29,253
is someone who should know
what they're talking about.

463
00:19:30,270 --> 00:19:31,770
The fear of getting into trouble.

464
00:19:31,770 --> 00:19:33,360
Oh my god, what if I find,

465
00:19:33,360 --> 00:19:36,030
what if the police find I
have child pornography, right?

466
00:19:36,030 --> 00:19:38,580
Or I'm distributing child
pornography on my system,

467
00:19:38,580 --> 00:19:40,713
I could go to jail for years and years.

468
00:19:41,670 --> 00:19:44,310
And the desire to be responsive,
to do the right thing.

469
00:19:44,310 --> 00:19:46,260
Of course I have to fix this problem.

470
00:19:46,260 --> 00:19:47,400
Of course.

471
00:19:47,400 --> 00:19:48,750
Yes, I'm willing to pay.

472
00:19:48,750 --> 00:19:50,010
Let's make this happen.

473
00:19:50,010 --> 00:19:52,230
Let's fix this situation.

474
00:19:52,230 --> 00:19:55,620
So trust, urgency, authority,

475
00:19:55,620 --> 00:19:57,960
fear, and responsiveness.

476
00:19:57,960 --> 00:20:01,290
All of these were at
play in this situation.

477
00:20:01,290 --> 00:20:03,270
So being able to explain this,

478
00:20:03,270 --> 00:20:05,460
to talk about this, to train your users

479
00:20:05,460 --> 00:20:07,140
to have them engage in simulations

480
00:20:07,140 --> 00:20:09,090
so they feel these different things

481
00:20:09,090 --> 00:20:11,940
and understand how the social engineers

482
00:20:11,940 --> 00:20:14,670
or how our attackers, our criminals, work,

483
00:20:14,670 --> 00:20:17,283
that my friends, is
definitely security in action.

484
00:20:18,510 --> 00:20:19,440
There's your word cloud.

485
00:20:19,440 --> 00:20:21,090
You know what to do.

486
00:20:21,090 --> 00:20:25,200
When you're ready, we're
gonna do a deep dive quiz.

487
00:20:25,200 --> 00:20:26,033
See you there.