97 Things Every Information Security Professional Should Know

Chapter 54. Social Engineering

Marina Ciavatta

You may have never heard the term “social engineering“ before, but you surely have had contact with it, by watching a spy or heist movie, or maybe reading about fraudsters or even suffering because of scammers. You don’t need to go through the headache of identity theft to know how much damage social engineering can cause if used in a malicious way by criminals.

Social engineering is a set of skills and techniques related to exploitation and analysis of human behavior. The goal is to provoke or take advantage of “human error.” This means that the social engineer studies their targets, learning how they behave and exploring their reactions to achieve objectives.

Humans obey commands and have behavior patterns related to the system they live in, a clear parallel on how machines are programmed. The social engineer is able to understand and break this process down, just like a hacker looks for security flaws to exploit. It’s no surprise that social engineering is also known as “human hacking.”

Goals may vary: extracting or stealing confidential data, sabotage or spying, breaking and entering restricted areas, and so forth. The attacks list is even bigger. The most popular ones are based on the “baiting” technique, which is to attract the victim’s attention. Special promos you can’t pass on, benefits (quid pro quo), unexpected prizes…everything ...