Social Engineering - Part 2
Note: This is a continuation of the previous edition of Tech Talk News. To see the first, please reach out to our offices and/or check out our website.
In recent years, social engineering has become an increasingly common tactic used by bad actors in an attempt to gain access to sensitive information and carry out malicious activities online. Social engineering involves using psychological manipulation to trick individuals into divulging confidential information or performing actions that compromise their security.
One of the most common attempts at this might be an email that is seemingly from Microsoft, for example, that asks for your password or tells you you need click to keep your password or something like that. It should be noted that Microsoft will never ask you for your password or ask you to click an email to keep the same password.
There are many types of techniques that someone looking to use social engineering might use. These types include:
Baiting
Baiting involves using enticing offers or promises to trick victims into divulging personal information. This can take the form of a fake contest or survey that requires participants to provide sensitive information to enter. One of the more popular versions of this tactic in popular culture today is the Nigerian price email. A more frequent occurrence in today's landscape that we've been seeing is that you've got a long-lost relative that has passed and left a huge sum of money behind that you can claim.
To protect yourself from baiting attacks, be wary of any unsolicited offers or requests for personal information. If an offer seems too good to be true, it probably is.
Pretexting
Pretexting involves creating a false narrative or pretext to gain access to sensitive information. For example, an attacker may pose as a customer service representative and ask for personal information to resolve an issue. Many times these can come in the form of Amazon customer service or a fake officer who supposedly has a warranty for your arrest.
To protect yourself from pretexting attacks, be cautious when providing personal information over the phone or through online chat services. Always verify the identity of the individual or company before sharing any information.
If you'd like help eliminating more spam and attacks from your organization's emails, receive user training and testing related to these types of threats, are concerned with the legitimacy of an email and/or have concerns about a potentially successful social engineering attempt, please feel free to reach out to our offices so that we can discuss these things with you.
