Social Engineering: The Human Element Behind Cyber Attacks

Social engineering is the art of manipulating people into giving up confidential information. As the human element in cyber attacks, it is often unpredictable and highly effective. Cyber criminals use social engineering to misrepresent themselves, gain trust, and extract sensitive information without the victim realizing a security breach is occurring. These tactics can involve impersonation via telephone, in person, or through email, often enticing recipients to open attachments that activate malware.

With the increasing number of women engaging with technology, many of whom are new internet users and may not be security-aware, the digital world has become an easier target for cyber criminals. Social engineers target women through various means to obtain sensitive information.

How Social Engineers Target Women

Public Places

Social engineers often exploit public places like cafes, pubs, and movie theaters, as well as various social media platforms. Casual conversations can reveal sensitive information, or someone may overhear your conversation and use the details against you.

Tip: Avoid discussing sensitive information in public places.

Gossips

Casual talks over coffee with friends or colleagues can inadvertently disclose sensitive information. Discussing someone’s personal details for fun might give a social engineer useful information.

Tip: Avoid gossiping, especially with strangers, as it may aid a social engineer.

Personal Pride or Confidence

Boasting about achievements or sharing sensitive information about your family or organization can be risky. A social engineer might pose as a business professional and request network information.

Tip: Be cautious when discussing personal or organizational details with strangers.

Online

Social engineers might impersonate network administrators, sending emails asking for user passwords or sensitive information. The primary goal is unauthorized access to systems or information to commit fraud or other malicious activities.

Tip: Never share your password or sensitive information online.

Vishing

Vishing involves social engineering over the phone, often using Voice over IP (VoIP), to obtain private personal and financial information. The term combines "voice" and "phishing."

Tip: Do not provide financial information over the phone without verifying the caller’s identity with the concerned company or bank.

Phishing

Phishing deceives victims into disclosing personal data such as credit card numbers, passwords, and account information. These attacks often feature official-looking logos and details from legitimate websites.

Tip: If you receive a suspicious email, do not respond or click on any links.

Baiting

Baiting uses physical

media like infected USB drives or CDs left in places where victims might find them. The curiosity or greed of the victim leads them to use the device, activating the malware.

Tip: Avoid using found devices, as they may be infected with malware.

Persuasion

A social engineer may persuade someone to provide confidential information by pretending to be trustworthy or simply asking for it. They might request to see your identity card or inquire about personal details.

Tip: Be suspicious of strangers asking for personal information or making attractive offers.

Dumpster Diving

Dumpster diving, or trashing, involves retrieving information from discarded materials. Company dumpsters and home trash bins can provide a wealth of information.

Tip: Shred confidential documents before disposing of them.

Hoaxing

A hoax aims to deceive victims into believing something false for financial or material gain. This can cause embarrassment or financial loss.

Tip: Don’t trust emails from unknown sources and never provide financial information based on unsolicited messages.

Pre-texting

Pre-texting involves creating a fabricated scenario to engage a victim and extract information. It’s more elaborate than a simple lie and often convinces victims to reveal information or take actions they wouldn’t normally take.

Tip: Be wary of unusual requests for information or actions that seem out of the ordinary.

Protecting Yourself from Social Engineering

• Be Skeptical: Always question unsolicited requests for personal or sensitive information.
• Verify Identities: Confirm the identity of anyone requesting information or making offers, especially through unofficial channels.
• Stay Informed: Educate yourself about common social engineering tactics and stay updated on new threats.
• Secure Communication: Use secure channels for communication, especially when sharing sensitive information.
• Be Cautious Online: Avoid clicking on suspicious links or downloading attachments from unknown sources.