Social Engineering Attack

Introduction

Simply, Social engineering is a process of converting people’s mindsets by being friendly
in order to get confidential, private information to execute an attack. It’s not easy to protect
systems by using sophisticated hardware and software, security professionals should focus
on the weakness of the employees and educate them in order to protect systems from such
attacks. 

Common Patterns

Social engineering attacks involve 4 common patterns.

1. Collect information about the target.
2. Build trust with the target.
3. Exploit the information and execute the attack.
4. Quit without leaving any proof.

Importance of attack prevention

Social engineering attacks are rapidly increasing and cybercriminals have a high chance of
obtaining valuable and sensitive organizational information. It is the most powerful attack which
cybercriminals use when they cannot find vulnerabilities in software and hardware systems. 

The phishing is the most common social engineering attack reported at the moment and
impersonation of help desk, shoulder surfing, fake software, baiting, tailgating, Pop-up windows,
ransomware, online social engineering, reverse social engineering, phone call social engineering
and robocalls are some of the famous attacks reported recently. By executing aforesaid attacks,
an organization loses not only the sensitive data but also organization reputation and the profit. 

People tend to trust others and extend the help of which the attackers take advantage (using
people’s kindness as a shield ) to reach their goals. Most of the organizations preparing plans
to prevent/minimize social engineering attacks because it executes by taking advantage of
humans’ emotions. 

Attack Mitigation.

Social Engineering attacks are sophisticated and they are very hard to detect. It uses
psychological manipulation for users/employees to make security mistakes or give sensitive
information away. 

There are a few steps than an organization must take in order to minimize the risk of social
engineering attacks.

1. Encourage security education and training
2. Make a security awareness culture in an organization.
3. Provide required tools to detect attacks
4. Create a procedure to report suspected activities to the security team

System users’ responsibility is to report all the abnormal behaviors of the system to the technical
staff as soon as possible in order to minimize the damage. The IR team or any responsible team
will isolate the affected devices from the network to minimize the loss as much as possible in
case of an emergency.

Ways of identification, containment, neutralization, and recovery

Preparation 

The organization should be prepared to avoid any type of attack by following below instructions. 

• Fix all security-related bugs in applications.
• Increase the perimeter level and backend firewalls security.
• Enhance server security(OS level) and update patches regularly.
• Keeping regular backups(snapshots) inside the data center and remote locations. 
• Prepare an incident response plan.
• Provide security awareness training for all users.
• Use resistance building techniques in training sessions. 

 Identification:- 

• Monitor systems and be alert for automated alarms. 
• Use a log analyzing tool or any other sophisticated method to identify attacks. 

Containment:- 

• Isolate the system from the network when an attack is identified. 
• Limit the attack propagation over the companies network.
• Protect evidence for further investigation and forensic purposes. 
• Try to identify the source and attackers if possible. 

Neutralization:- 

• Kill the process of attacks execution by using the endpoint protection system
• Deactivate the network connectivity. 

Recovery:-

• Use backups to restore the system after clean the servers/SANs from attack.