1. JANELL LAYSER Training Manual

2. AWARENESS! Social Engineers are out there, and everyone should be prepared to deal with them! They can contact you by phone, or through email or other online sites, as well as in person! If you know the signs, and are properly trained, you CAN stop social engineers! Social Engineering: -The act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical cracking techniques. 3 Common Techniques Social Engineers use: 1. Pretexting: the act of creating and using an invented scenario to engage a targeted victim in a manner that increases the chance the victim will divulge information or perform activities that would be unlikely in ordinary circumstances. 2. Diversion theft: The objective is to persuade the person responsible for a legitimate delivery that the consignment is requested elsewhere. 3. Phishing: a technique to gain private information. The phisher sends an email pretending to be from a legitimate company, requesting “verification” of information and warning of some dire consequence if it is not provided. *However there are many more scams!

3. Awareness Social Engineers use their excellent social skills to obtain the information they want. He/she may sound polite, respectable, friendly and overall trusting. They may try to act like a new employee, repair person, researcher, or an employee that’s under stress. They may even offer credentials to support that identity. They will study your company and know the inside lingo, and may know other employees names and/or managers name and phone number. BUT- DON’T LET THEM FOOL YOU!!!

4. PREVENTION! All employees should be properly trained!! Do NOT trust anyone! You never know really know who the person is on the phone/internet! Always get verification before giving out private/personal information! Trust your instincts! It’s better to be safe, than sorry! Be suspicious of anyone asking about employees or other internal information. If he claims to be from a certain company, try to verify his identity directly with the company. Do not provide any internal information, or any personal or financial information

5. Stopping Social Engineers Anyone entering the building, must have ID badge, if not they are not allowed on the property. ID must be checked and verified. NO EXCEPTIONS! All financial and other important documents must be locked in a file drawer. (Keys to drawer must always be put back in it’s proper place) All documents with personal or company information must be shredded before throwing away. Always keep dumpsters locked. Never give out user names and definitely never passwords! Passwords should be changed often, and you should be the only one who knows it.

6. ACTION! Mistakes happen, and social engineers are good at their job! It is extremely easy to be tricked by them! If you do fall for their scam, report it immediately! If you think you leaked out personal or private information to a social engineer, report it right away. Report it to the appropriate people. (managers, network administrators, owners) They can then be alert for any suspicious or unusual activity If concerned about financial accounts, contact your financial institution immediately and close any accounts. Watch for any charges to your account that you did not do.

7. Responding to Social Engineering Attacks If you think you are on the phone with a social engineer, do not give them any information. Alert your manager, or a member of the Incident Response Team (IRT). Also, notify other employees, for they may be contacted by the same person. The IRT will then be in charge from there, trying to track them down.

8. WE CAN PROTECT OURSELVES FROM SOCIAL ENGINEERS! BE SMART & RESPONSIBLE!