Social Engineering Attacks and How to Prevent Them

World Health Organisation

• A worldwide phishing scam that took advantage of heightened Covid-19 anxieties
• The scam used fake World Health Organization emails to encourage individuals to click on links that contained malware purporting to contain coronavirus information
• This scam affected 450 employee email addresses and passwords

Red Kite Community Housing

• Housing charity Red Kite tricked into sending £932,000 to cyber criminals
• Social engineers created a fake website that looked identical to a supplier’s
• Social engineers fabricated an email history to provide the impression that the email was part of an ongoing conversation
• Red Kite introduced security training for their employees as a new cyber security measure to mitigate future social engineering attacks

What is Social Engineering and how does it work?

Whilst social engineering attacks are inextricably linked with technology, social engineering has been around long before the advent of computers. The most famous example of historic social engineering is the Trojan Horse, which, as we all know, proved to be rather embarrassing for the Greeks.

Ultimately, social engineering aims to deceive individuals into providing business critical data or other sensitive information that benefits the threat actor. This information is then utilised for malicious purposes (e.g. ransomware, whereby hackers hold customers’ sensitive data for ransom to extort a company).

Social engineering recognises that the main weakness within any cyber security system is, more often than not, the individuals that use them. Even the most advanced cyber security systems cannot totally eliminate human vulnerability. These attacks are varied, unique and use increasingly sophisticated methods to exploit human nature. Predominantly relying on trust and by understanding the online behaviours of victims, anyone can fall prey to social engineering attacks.

Types of Social Engineering Attacks

The pandemic exacerbated social engineering attacks. Playing on the heightened emotions of the global population, threat actors turned to more devious tactics than ever before. The first half of 2021 saw a 22% worldwide increase in phishing attacks. Shockingly, further data reveals that the majority of data breaches were caused by social engineering attacks, with 85% exploiting some aspect of human error in cyber security.

These alarming numbers mean it's pivotal you know how to spot a social engineering attack. Furthermore, employees within an organisation must understand key social engineering prevention strategies to prevent revealing sensitive and business-critical data.

Emails

Links in emails asking for sensitive information and requesting participation in a survey are all ways cyber criminals attempt to infiltrate your network. Threat actors can now fabricate email chains with legitimate internal email addresses, pose as your CEO and ask for information that will compromise you and your company. Phishing got sophisticated.

Phone

Deep fake recordings exploit the trust and good nature of many people. These sophisticated methods of social engineering coerce victims to divulge information or send data to a threat actor under the guise of someone they know.

Text scams are also on the rise. With the ubiquity of mobile, social engineering attacks via smartphones are increasingly prevalent. Fearmongering victims into believing that the taxman is around the corner due to missed payments or scaring people that they’ve forgotten to pay a bill are all common social engineering attacks, designed to make users click on links that deliver malware to their device. Cyber security policies rarely extend to smartphones, making this type of attack exceptionally attractive to threat actors.

Online

The most sophisticated social engineering technique is planting malicious links in websites victims frequently visit. While many people are now more savvy to phishing, even cautious individuals click on links when visiting a website they are familiar with. Exploiting trust and user behaviour is textbook social engineering and this type of attack is very hard to detect.

Tailgating

“I’ve forgotten my pass, can you hold the door?”

It may be polite, but you could cost your company £1000s in data losses and reputational damage by falling victim to tailgating. Social engineering isn't siloed behind a screen. Threat actors are real people and an unsuspecting employee innocently holding the door for someone to follow in from behind can lead to a systems breach from an internal computer.

Preventing Social Engineering Attacks

Due to the increasing adoption of remote working and the reliance on email communication for businesses, it has never been more important to ensure your business is protected. There are several tools and preventative measures you can take to limit the chance of a successful social engineering attack.

Education and Training

Most social engineering attacks are successful because the victim is unaware that they are being manipulated to take harmful action.

Implementing security awareness programs within your company is crucial. When educating employees, it’s vital to spell out how social engineering attacks impact your business and how it may affect them personally. You need to explain that it's not just about protecting company information but about protecting identities and personal details in and out of the workplace. Educating and training will not only improve employees’ cyber security awareness but also improve their online interactions, protecting them personally from fraud and crucially, your business.

Recognising Phishing Emails

Phishing is the most common form of social engineering attack. For that reason, your employees must understand how to identify phishing emails.