If you work for, or with, small to mid-sized companies, you may think the risk of social engineering attacks are lower for you. You know all 30-100 people in your office so a stranger would stick out, you’re accustomed to their requests and how they behave. It may be easy to think that you would never get an unknown phishing email from HR or a vishing call from IT. After all, you know Bob from HR and Linda from IT very well. However, don’t let the small size of an organization give you over confidence or a false sense of […] Continue Reading >
Are All Social Engineers Bad?
When you think about what a social engineer does, and how influence and manipulation are used by good and bad SEs, it is easy think that to be an SE you need to have an evil personality or even have sociopathic tendencies. Is that true, are all social engineers bad? At SECOM, we define social engineering as, “any act that influences a person to take an action that may or may not be in their best interest.” Now, according to grammar rules that I know about that statement can be read in two ways: 1) Any act that influences a […] Continue Reading >
Information Risks of Travel
So, you’re on the road for work again, are you? Or, you’re heading out soon? Regardless of when, if you travel for work you should know about the information risks of travel and how it increases the risk of identity theft and, therefore, future social engineering attempts. How does travel affect identity theft? When you pack up to go on a trip, work or personal, you take at least two items that contain sensitive, personally identifiably information: your license, and your ticket or a device that contains your ticket. A malicious actor’s desire to duplicate this information means travel increases the […] Continue Reading >
What is Critical Thinking?
In the field of security awareness and associated training, the term “critical thinking” is thrown about as an effective defense against social engineering attacks. So, what is critical thinking? And how can it be applied in day-to-day activities to make a user or an entire user–base more secure? According to the Foundation for Critical Thinking, a “well cultivated critical thinker” gathers and assesses relevant information and comes to well-reasoned conclusions and solutions. One also thinks open-mindedly within alternative systems of thought, while recognizing and assessing their assumptions, implications, and practical consequences. Let’s break that down a bit. “Gathers and assesses […] Continue Reading >
Protecting Trade Secrets from Physical Intruders
Companies that hold trade secrets, intellectual property, or proprietary research are under attack. The attack is multifaceted and includes both cyber and physical intrusion. As mentioned in the March 2018 Social-Engineer.org Newsletter, cyberespionage has “changed from isolated and individualized attacks to attacks run by distinct groups resembling traditional Mafia organizations.” Additionally, protecting trade secrets from physical intruders must be a priority. Companies are at risk from social engineering attacks that include physical intrusion. Tailgating is one of the most common methods used by intruders to gain unauthorized entry. An intruder may also pose as a contractor, business contact, delivery person, […] Continue Reading >
It Is Important To Have Ethics In Social Engineering
Over the years of being a professional social engineer (SE), I have been asked questions like, “Are you really testing your clients if you don’t use EVERY method possible?” Or, “You are acting like the bad guys, why do you need to have rules?” And even, “I don’t need to leave them feeling better if I am trying to breach, do I?” It is time to discuss these questions, why ethics in social engineering is so important, and crafting a social engineering code of ethics. How can you maintain a code of ethics and promote professionalism? How can you avoid […] Continue Reading >
Free Yourself from FUD
Fear, uncertainty, and doubt (FUD) hold powerful influence over humans. Fear itself is a deeply powerful emotion that causes specific reactions in the brain, and uncertainty and doubt are feelings that manipulate your actions, your employees’ actions, and your business operations. Examples of FUD have a long-standing history in the information technology and information security industries. In the 1970s, IBM utilized FUD tactics to make buyers question trying new products by casting a shadow of fear over the idea of unknown products compared to IBM’s safe, known offerings. In the 1980s, IBM was given a taste of its own medicine […] Continue Reading >
What Do You Know About Tweedle Beetles?
For that past few years, thanks to having an amazing little addition to my family, I have been reading a lot of Dr. Seuss books, and one of my favorites is “Fox in Socks” If you haven’t read it to your kids, you should. Well…you can try. If you don’t have kids it is an entertaining read anyway. It puts your tongue to the test when read out loud. The last story in the book talks about “tweedle beetles” and for some reason it, got me thinking about phishing. Phishing these days comes in many forms and names, just like […] Continue Reading >
Healthcare: Security in Crisis?
The other day my wife went to the doctor, and a few weeks before that we took our son to the dentist. We had to fill out all the paperwork and give them all the usual PII, including name, address, phone number, alternate contacts, SS#, DOB, driver’s license, insurance info, weight, height, underwear size (just kidding), then we paid them with our credit card. All the while trusting that they are keeping our information safe and secure. Well, they are keeping the information we entrust them with secure, right? How do we know if they are? Let’s look at […] Continue Reading >
Vendors, Educating, and Social Media Marketing
What do professionals inadvertently disclose about the operations security (OPSEC) of their organizations and themselves while giving advice? Becoming a known educator and voice in your area of expertise is effectively done by drawing connections between yourself, your knowledge base, and your audience. Often in Information Security (InfoSec), this involves sharing an anecdote or short story that others can relate to and emphasizing the security benefits or areas of improvement that are seen in the story. However, even the most savvy security professionals should be wary of what information they provide that could be used by an attacker. Where is […] Continue Reading >
- « Previous Page
- 1
- 2
- 3
- 4
- …
- 8
- Next Page »
