The Art of Social Engineering*
11
The Ultimate Heist Time Magazine: Monday November 20 th , 1978 Stanley Mark Rifkin
-
date post
21-Oct-2014 -
Category
Technology
-
view
634 -
download
4
description
Most organizations today consider themselves “security-conscious” and may spend significant budget dollars on technology to protect themselves and their networks from intrusion. However, technology alone cannot protect your systems from your biggest vulnerability – the people who work for you. “Social Engineering” is the practice of gaining information or access to protected systems by tricking insiders into providing it. Most people who fall victim to a social engineering attack are people who would never consciously reveal confidential data, but can provide a skilled hacker with the knowledge they need to destroy files or entire systems. In this presentation we will show you how to think like a hacker trying to infiltrate your organization so you can better protect yourself from social engineering attacks. *This presentation is influenced by the book “The Art of Deception: Controlling the Human Element of Security” by Kevin Mitnick, William Simon, and Steve Wozniak
Transcript of The Art of Social Engineering*
The Ultimate HeistTime Magazine: Monday November
20th, 1978
Stanley Mark Rifkin
Security: Fact or Fiction?
Just Ask!
THE DIRECT ATTACK:
PHONY SITES AND DANGEROUS ATTACHMENTS
www.paypai.com
www.paypal.com
www.paypa1.coma
SIX TENDENCIES SOCIAL ENGINEERS RELY ON
•Authority•Liking•Reciprocation•Consistency•Social validation•Scarcity
SECURITY IS NOT A PRODUCT; IT IS A PROCESS
The reminders must be as well
THE THREAT IS CONSTANT
COMMON SOCIAL ENGINEERING METHODS• Posting as employee of vendor
• Posing as someone in authority
• Sending a virus in an email
• False pop-up Windows
FACTORS THAT MAKE COMPANIES MORE VULNERABLE TO ATTACKS• Large number of employees
• Multiple facilities
• Information on employee whereabouts left in voice mail messages
• Phone extension information made available
• Lack of security training
• Lack of data classification system
• No incident reporting/response plan in place
WARNING SIGNS OF AN ATTACK
