What is Social Engineering and why is it so effective?

Types Of Social Engineering Attacks

1. Remote Attacks (Phishing)

Phishing is one of the most popular social engineering tactics attackers use to get sensitive information from their target. It’s usually via email, text messages and phone calls.

– Email Attacks

Attackers send a well-crafted email with a deceptive subject line to trick the recipient into believing the email is from a trusted source. The email may contain seemingly legitimate documents, logos, contact details or a link to a cloned website to trick their target. The attack aims to create a sense of urgency and immediate action from the user. For example, you may receive an email prompting a password change or invoice for payment, which sends the attacker information or money once submitted.

– Phone Call Attacks (Vishing)

A social engineer who attacks over the phone, often called “vishing” for voice phishing, usually pretends to be someone, e.g., an account holder, business partner, staff or a trusted provider of your organisation. They typically gather necessary background information before making the call to avoid suspicion.

– Spear Phishing

Spear Phishing targets a particular person or business. An attacker may use details about your role or relationships to make a message appear genuine. For example, an email that seems to come from your CEO could ask you to make an urgent payment.

– Scareware

Scareware manipulates users through fear by deceiving the target with notifications of a malware infection. It suggests the user buy or download a fake antivirus software to get rid of it. However, the antivirus is a potentially dangerous software that can steal your personal information once installed. It’s common to encounter this type of social engineering attack while browsing the internet or via email.

2. In-Person/Onsite Attacks

Social engineering can also happen in person. Someone may pose as a visitor or service provider to gain access to your premises or confidential information.

– Shoulder Surfing

Shoulder surfing is a physical social engineering attack that uses direct observation techniques to steal information. The attacker stands beside someone and watches them enter their login credentials or PIN at an ATM.

– Tailgating

Tailgating is another onsite social engineering technique used by attackers seeking entry to restricted areas where biometrics, RFID cards, or any electronic access control is present. The attacker waits for the perfect opportunity to walk in behind an authorised person or determines when the next scheduled maintenance may be and arrives dressed like one to get past the front desk successfully.

– Key Loggers

Hardware and network devices often need technical services, so hackers usually take this opportunity. They may impersonate a third-party onsite tech support and install a key logger on shared computer systems to obtain usernames and passwords.

– Baiting

Baiting is the equivalent of a Trojan horse in social engineering. The attacker will leave a malware-infected flash drive in a public place, hoping someone will pick it up and plug it into their computers. Distributed USBs are usually labelled as “Confidential” or “Salary info” to entice the victim to use it, giving access rights to the hacker once opened. Hackers also use online baiting to attract their target with free goods in exchange for personal information.

How To Reduce Your Exposure to Social Engineering

Give your team clear procedures and time to check unexpected requests, particularly when money or confidential information is involved.

• Verify changed bank details and unusual payment requests using a phone number you already know is correct. Use contact details held separately from the message.
• Help staff recognise suspicious requests through regular training, and make it easy to report concerns.
• Use multi-factor authentication and never share passwords or verification codes.
• Keep systems and security software up to date.
• Check unexpected attachments or links with the sender through a trusted contact method before opening them.
• Follow your visitor procedures before allowing someone into restricted areas.

Your IT provider can help assess the technical controls appropriate for your business.

Next Steps

If you would like to discuss your cyber insurance needs with an experienced insurance adviser, you can contact Clear Insurance on 1300 721 132 or email info@clearinsurance.com.au or complete our online enquiry form.

To understand how insurance may respond, read our Cyber Insurance guide. Cover for social engineering and fraudulent transfers varies between policies. Your adviser can explain the relevant conditions and limitations.