Social Engineering as a Means of Exploitation Carrie Estes

 What is social engineering?  How is it technical in nature?  How does an average attack progress?  Examples of some attacks.  How can one defend against such attacks? Roadmap

 Social engineering is the art of manipulation to get what you want.  It takes confidence, research, time, and people who believe you are who you say you are. What is social engineering?

 Social engineering itself is only one step in a long list of steps to getting information from a company.  To pull off a successful attack, the attacker needs a lot of information.  This information comes from research and hacking into places in a company. How is it technical in nature?

 When an attacker is getting ready to pull off a social engineering attack, he or she needs to do research on the company and employees. From this, they will gain vital information to be used. Phone calls and s can be sent out to gain even more vital information. How does an average attack progress?

Social engineering techniques

Examples The colors and words puzzle that everyone saw as a kid. Did you know that it is considered social engineering?

 Oscar Grace became a PI  Woman’s husband moved funds  Wants to know where they are due to getting a divorce  Made three phone calls Examples

 Computer center manager fell for attack by a person barely out of their teens.  Danny wanted super secret encryption software from a top manufacturer of secure radio systems.  He didn’t want to steal it. Examples

 There is no concrete way to defend against these attacks.  There are, however, some things that can be done to diminish the risk.  Security awareness training  Mock social engineering drills, etc  Physical security  Background verification How does one defend against such attacks?

 We discussed  What is social engineering?  How is it technical in nature?  How does an average attack progress?  Examples of some attacks.  How one can defend against such attacks. Review

Questions?

 "Social Engineering (security)." Wikipedia. Wikimedia Foundation, 25 Mar Web. 27 Mar  Mitnick, Kevin D., and William L. Simon. The Art of Deception: Controlling the Human Element of Security. Indianapolis, IN: Wiley Pub., Print.  Shetty, Dines. "Social Engineering - The Human Factor | Social Engineering - The Human Factor | SecurityXploded, Web. 27 Mar References

Fun picture