New forms of attack: social engineering

What techniques are used in social engineering?

Common techniques used in social engineering include emotional manipulation, identity theft, creating fake emergency scenarios, collecting information via social networks, creating fake websites or forms to collect information, and using authority or trust to obtain sensitive data.

How do you recognise an attempt at social engineering?

To recognise an attempt at social engineering, it is important to be vigilant and pay attention to certain signs. These may include unusual or urgent requests for confidential information, grammatical or spelling errors in e-mails, unsolicited phone calls asking for personal information, suspicious URLs in e-mails, or unexpected requests for money or money transfers.

How can companies protect themselves against social engineering?

There are a number of measures that businesses can take to protect themselves and reduce the risk of social engineering attacks. Here are a few best practices:

1. Awareness-raising and training: Make your employees regularly aware of social engineering techniques, the associated risks and good security practices. Organise training sessions and simulations of social engineering attacks to reinforce your employees’ vigilance.
2. Security policies: Develop and implement IT security policies that include strict procedures for managing sensitive information, data access, authentication and identity verification.
3. Use security tools: Adopt advanced security solutions such as Altospam’s Mailsafe, which can detect intrusions and block social engineering attacks.
4. Two-factor authentication: Implement two-factor authentication (2FA) for sensitive accounts to add an extra layer of security. This makes it more difficult for attackers to gain access to information even if they manage to obtain credentials.
5. Check for suspicious requests: Teach your employees to verify the authenticity of requests for sensitive information or unusual actions. Encourage them to verify the identity of people requesting information by telephone, e-mail or other means of communication.
6. Monitoring and detection of suspicious activities: Set up mechanisms for monitoring network and system activities to detect suspicious behaviour and social engineering attempts. Use anomaly detection tools to spot unusual activity.
7. Regular updates and security patches: Ensure that all software, operating systems and devices are regularly updated with the latest security patches to reduce vulnerabilities exploited by attackers.
8. Strict password management policy: Implement a strong password management policy, requiring passwords to be complex, regularly changed and securely stored.
9. Internal communication: Foster a culture of open communication and encourage employees to report any suspicious activity or social engineering attempts immediately.