Social Engineering 101: What it is and how to avoid it
Social engineering may sound like a positive experiment that brings people together, but in reality, it’s a malicious technique used by hackers to exploit human tendencies.
Rather than break into networks using technological methods, social engineering manipulates people to gain access to sensitive information. Social engineering is why most hackers are email experts, not coding wizards.
However, this malicious concept is not limited to internet crime. It can also be used by in-person spies and con-artists to get access to money, products, or important information.
Why social engineering is worrisome
Social engineering is a problem because it supersedes all your security efforts.
You could have the most secure network located inside a technologically secured building, but social engineering could still grant someone access to it. All it takes is for one employee to fall for the ruse, and all your security efforts will be for naught.
For example, social engineers may pose as a bank representative, someone from your own company’s IT department, or even a government agent. While it may sound like a plot out of a movie, it’s more common than you think. And it doesn’t take an Oscar-winning actor to manipulate people — just the right string of words and some luck.
Real-world examples of social engineering
Humans are often optimistic by nature. We want to believe the best. But social engineers often take advantage of that.
For example, they might create a malware link on a friend’s social media account. When that friend says, “Hey, check out this cool link!” — you’ll probably click without thinking.
They can also play on our natural desire to help others. For example, a social engineer might grab a few boxes and pretend to struggle with your building’s door. Since their hands are full, you might feel bad and open the door for them. But what you’ve really just done is granted a criminal access to physical hardware, sensitive documents, and more.
How to stop social engineering
The best way to stop social engineering is to educate employees about the most common tactics used by these scam artists.
Every employee in the company should learn about this particular threat because they can all be targeted by social engineers. This includes part-time, seasonal employees and even CEOs.
A phishing attempt on a CEO is often called whaling because it is such a lucrative target. Social engineers will do their research before making an attempt on a CEO because they understand the payoff can be large.
Final thoughts
Train employees to be skeptical, and help them understand that there’s a difference between being rude and being aware.
Most of the information about your business should be on a need-to-know basis, and you should always remain suspicious of people who ask too many questions.
Make sure everyone knows security procedures and protocols, and enforce strict rules. The best way to prevent social engineering attacks is to recognize and report anything that seems out of place — whether it happens virtually or in-person.
PT 
EN