Defending against today’s social engineering attacks is difficult but not impossible, security experts say. It requires focusing on the human element of the equation with better security awareness training that gets employees to think twice about clicking on certain emails. Let’s look at some of the social engineering ploys used against enterprises today, what’s helping to fuel them, and strategies that can help a company fend off these attacks and protect its valuable data.
“Before it would have been easier to take advantage of unpatched systems,” says Mike Murr, a certified SANS instructor and author of the upcoming H u m a n C o m p r o mi s e: T h e A r t o f S o ci al E n g i n e e ri n g . “Now it’s often easier for the attacker to get code running on a remote system by persuading a user using social engineering to click on a link, execute code, or enter their password.”
Targeting the insider has never been easier, thanks to the rise of social media like Facebook, LinkedIn, and Twitter, security experts say.
Outsiders researching a company can search the sites to find out who works there, who the top executives are, what they’re talking about, and contact information: all data that can be used to personalize an attack, making it more effective.
For example, someone wanting to break into a defense contractor could first identify five to 20 employees to target, then research those people, says Lance Spitzner, director of SANS Securing the Human Program. From publicly available information on the Internet, they could find out that those employees recently attended a conference and create a spear phishing email that pretends to be follow-up from the conference.
File Type: PDF
File Size: 350 KB
Total Pages: 19
Direct Link Mega:
Direct Link AnonFiles:
Direct Link Mediafire:
Direct Link Solidfiles:
Direct Link Sabercathost:
Direct Link Tusfiles: