1 / 24

Social Engineering: The Human Element How Does Social Engineering Work and to What Purpose?

Social Engineering: The Human Element How Does Social Engineering Work and to What Purpose?. Chuck McGann. Objective:. A discussion on types of “social engineering” and how it can be both damaging to your business and to home environments.

wynn
Télécharger la présentation

Social Engineering: The Human Element How Does Social Engineering Work and to What Purpose?

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Social Engineering: The Human ElementHow Does Social Engineering Work and to What Purpose? Chuck McGann

  2. Objective: A discussion on types of “social engineering” and how it can be both damaging to your business and to home environments. [We may touch on the dangers of Social Media if there is time.]

  3. Social Engineering is defined as the process of deceiving people into giving away access or confidential information by establishing a contrived relationship of trust. Wikipedia defines it as: "is the act of manipulating people into performing actions or divulging confidential information. While similar to a confidence trick or simple fraud, the term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access; in most cases the attacker never comes face-to-face with the victim."[1] Defining "Social Engineering"

  4. Defining "Social Media" • Social media is the collective of online communications channels dedicated to community-based input, interaction, content-sharing and collaboration. Websites and applications dedicated to forums,microblogging, social networking, social bookmarking, social curation, and wikis are among the different types of social media

  5. Quick Video • Placeholder for the below video • http://www.youtube.com/watch?v=tkgLHoaFeFk&__hssc=&__hstc&hsCtaTracking=70edc2a8-64cf-47f8-9f30-6581d17e4660%7Cd07bcdc2-0e2c-4028-8505-343bc3d1e11d

  6. The Human Element of Trust • Trust is integral to the idea of social influence: it is easier to influence or persuade someone who is trusting. The notion of trust is increasingly adopted to predict acceptance of behaviors by others, institutions (e.g. government agencies) and objects such as machines…

  7. Audience/Targets/Victims • Employees • Customers • Competitors • Hackers • Family • Friends

  8. Targeted Organizations

  9. By Industry

  10. Real World Example • Fall of 2012, USPS was targeted by an external social engineering attack • Over 150 USPS users opened the phishing eMail • 80 recipients provided their User ID and Passwords • CIRT issued a requirement to reset all WebVPN user account passwords • Lost work hours

  11. Research by Check Point Software Technologies • 850 IT and Security professionals in North America, Australia, and New Zealand were surveyed • 48% of large businesses have suffered from socially engineered attacks at least 25 times • Resulting in losses of between $25,000 and $100,00 per incident

  12. Social Engineering • Types of Attacks • Phishing – Spear/Whale • Impersonation of Help Desk Agent • Fake software • Trojans • Watering Hole • Drive by download

  13. Phishing • Use of deceptive mass emailing • Can target specific entities (“Spear phishing and Whale phishing”) • Prevention: • Honeypot email addresses • Education • Awareness of network and website changes • Awareness of links and format of actual address • Note -http://www.usps.com

  14. Phishing Example • ----- Forwarded message ----- • From: Express Mail Service [mailto:support@universalpost.com] Sent: Friday, April 26, 2013 10:13 AMSubject: Shipping Info • Delivery information, Your parcel can not be delivered by courier service. Status:Postal code is not specified. LOCATION OF YOUR ITEM:St.LouisSTATUS OF YOUR ITEM: not delivered SERVICE: Local Pickup NUMBER OF YOUR PARCEL:U588850982NU INSURANCE: No Print a label and show it at your post office.An additional information If the parcel is not received within 30 working days our company will have the right to claim compensation from you for it is keeping in the amount of $6.10 for each day of keeping of it. You can find the information about the procedure and conditions of parcels keeping in the nearest office.Thank you for attention.DHL Customer.

  15. Impersonation on Help Desk Calls • Calling the Help Desk pretending to be someone else • Usually an employee or someone with authority with a need-to-know • Prevention: • Assign pins for calling the Help Desk • Don’t do anything on someone’s order • Stick to the scope of the Help Desk

  16. Fake Software • Fake login screens • The user is aware of the software but thinks it’s trustworthy • Prevention: • Have a system for making real login screens obvious (personalized key, image, or phrase) • Education • Antivirus (will not be able to detect zero day exploits – new virus signatures)

  17. Trojans • Appears to be useful and legitimate software before running • Performs malicious actions in the background • Does not require interaction after being run • Prevention: • Don‘t run programs on someone else’s computer • Only open attachments you’re expecting • Use an up-to-date antivirus program

  18. Security Awareness Testing • Method, Tools, and Approach • Email • Email will contain an URL which would be redirected to a data collection and metrics web site • Data Collection and Metrics Web Site • Redirect user to a webpage which will contain information for security awareness

  19. What Can You Do? • Keep software and antivirus current • Strong security awareness program • Use “least privilege” for users • Periodic technology assessments • Assign the responsibility to someone

  20. Places for Help • SANS – Securing the Human • http://www.sans.org/security-awareness/ • Multi-State Information Sharing and Analysis Center (MSISAC) • http://msisac.cisecurity.org/resources/videos/free-training.cfm • Dept. of Health and Human Services (HHS.Gov) • http://www.hhs.gov/ocio/securityprivacy/awarenesstraining/awarenesstraining.html • Stop Think Connect • http://www.stopthinkconnect.org/

  21. No matter how strong your: Firewalls Intrusion Detection Systems Cryptography Anti-virus software "At the end of the day, people are a critical part of the security process as they can be misled by criminals and make mistakes that lead to malware infections or unintentional data loss“ – Oded Gonda (VP of Check Point) "The weakest link in the security chain is the human element" -Kevin Mitnick Weakest Link?

  22. Questions

  23. Reference • (2013, September 11). Trust (Social Sciences). Retrieved: September 13, 2013, from http://en.wikipedia.org/wiki/Trust_(social_sciences) • http://whatis.techtarget.com/definition/social-media • Schwartz, Mathew J. (2011, September 21). Social Engineering Attacks Cost Companies. Retrieved: September 13, 2013, from http://www.informationweek.com/security/vulnerabilities/social-engineering-attacks-cost-companie/231601868

More Related