1. Designed By: Jennifer Gohn

3.  “Getting people to do things they wouldn’t ordinarily do for a stranger” –Kevin Mitnick  There are several different types of social engineering, to name a few: ◦ Phone Phreaking: A type of hacking that allows the person to explore the telephone network and obtaining any information available to the phone company. ◦ Crackers or Vandals: Hackers who destroy people’s files or entire hard drives ◦ Grifter: A person who uses deception and persuasion to obtain important, secret information from companies and businesses.

4.  Where can social engineering take place? ◦ It can happen in person, on the phone, or on the computer ◦ At work or even at home ◦ Dumpster Diving  Who can be a social engineer? ◦ ANYONE ◦ They try to trick you into believing they are someone else

5.  Different techniques a social engineer uses to get others to believe they’re who they say they are can be: ◦ Persuasion ◦ Impersonation ◦ Ingratiation ◦ Conformity ◦ Friendliness

6. It requires action on both the physical and psychological levels How to Combat Social Engineering

7.  Training is essential  A company needs well-rounded security policies  Policies remove the responsibility for employees to make judgment calls ◦ Policies can help to eliminate some human error and some human judgment  For example, a policy for a company could be that every employee must verify if the person is who they say they are with a simple check, making sure no social engineer is trying to win one over on the company  Another example could be that private company information is kept private. Anyone who wants to access it must show proper verification.

8.  The policies should address some simple aspects of the company: ◦ Locks ◦ I.D.s ◦ Information access controls ◦ Setting up accounts ◦ Access approval ◦ Password changes

9.  EVERY employee should be trained in the all of the updated security policies  EVERY employee needs to be informed and know about social engineering in order to know how to combat it  Always be suspicious to an extent. Don’t always believe people are who they say they are until you verify with legitimate sources.  Everyone needs to be trained in how to use the computer systems and how to create a good user name and password. ◦ Passwords should be a combination of both letters and numbers as well as upper case and lower case letters. ◦ The password should be something that has no relevance to the user. The more random the password, the more secure it is.

10.  Employees need to be trained on how to tell if information is considered confidential or not  Everyone needs to understand that security is part of all of the jobs taking place in the company, not just the IT department or security department.  All new employees need to go through a security orientation.

11.  There are some signs that can tip you off: ◦ Refusal to give contact information ◦ Rushing ◦ Name-dropping ◦ Intimidation ◦ Small mistakes (misspellings, misnomers, odd questions) ◦ Requesting forbidden information

12.  In the incident that an employee suspects a social engineering attack: ◦ Report the incident (preferable to one person who is in charge of handling and keeping track of all security breaches if they happen) ◦ Notify others so that they won’t be victim of the same con ◦ Follow company security policies. DO NOT give out sensitive information with out proper verification. ◦ DO NOT assume everyone is who they say they are. ◦ Stay calm and be as friendly as possible without giving up any personal or company information

13. Area Of RiskHacker TacticCombat Strategy PhoneImpersonation and persuasionTrain employees/help desk to never give out passwords or other confidential info by phone Building EntranceUnauthorized physical accessTight badge security, employee training, and security officers present OfficeShoulder surfingDon’t type in passwords with anyone else present (or if you must, do it quickly!) DumpstersDumpster divingKeep all trash in secured, monitored areas, shred important data, erase magnetic media Intranet-InternetCreation & insertion of mock software on intranet or internet to snarf passwords Continual awareness of system and network changes, training on password use OfficeStealing sensitive documentsMark documents as confidential & require those documents to be locked General-PsychologicalImpersonation & persuasionKeep employees on their toes through continued awareness and training programs Table courtesy of: http://www.symantec.com/connect/articles/social- engineering-fundamentals-part-ii-combat-strategies

14. Click on the picture to see an example of a training video on what to do if you are being attacked.

15.  If you have any more questions or concerns about social engineer and how to spot it and prevent it check out these sources: ◦ The book The Art Of Deception by Kevin Mitnick ◦ Examples of internet social engineering: http://www.youtube.com/watch?v=ybQaPp7ySpQ&f eature=related http://www.youtube.com/watch?v=ybQaPp7ySpQ&f eature=related ◦ What is social engineering? http://www.youtube.com/watch?v=b- yqbNM3s7c&feature=related http://www.youtube.com/watch?v=b- yqbNM3s7c&feature=related ◦ How to select a secure password: http://www.youtube.com/watch?v=48lZa1d-Htg http://www.youtube.com/watch?v=48lZa1d-Htg