SOCIAL ENGINEERING CYBER ATTACKS AND PREVENTION MECHANISM

The Social Engineering Attack Lifecycle unfolds in Four Critical Phases: PHASE 1: DISCOVERY Thoroughly identify targets, ranging from credentials and sensitive data to unauthorized access, financial assets, and confidential information. PHASE 2: DECEPTION AND HOOK Identify entry points such as email address, phone number and social media account. Craft persuasive hooks to captivate individuals' interest and initiate the engagement. PHASE 3: ATTACK Execute a diverse range of social engineering attacks, leveraging the acquired information to manipulate and compromise targets. PHASE 4: RETREAT Upon successful completion of the mission, disappear without a trace, leaving behind as little evidence as possible. TYPES OF SOCIAL ENGINEERING ATTACKS: PHISHING: Scammers employ various communication channels, often email to 'fish' for sensitive information. SPEAR PHISHING: Unlike general phishing, this targets specific individuals or organizations, tailoring the attack for maximum impact. WHALING: Phishing attacks aimed at high-profile figures, such as executives, government officials, or celebrities, seeking valuable information. Smishing : Use of SMS text messages to blast out messages containing malicious links Vishing : Scammers contact company’s front desk, HR or IT and claim to need personal information about employee BAITING: Scammers lure victims into providing sensitive information by promising them something valuable in return PIGGYBACKING / TAILGAITING:Piggybacking and tailgating both refer to a type of attack in which an authorized person allows an unauthorized person access to a restricted area PRETEXTING: Creation of a fake persona or misuse of a legitimate role, often leading to data breaches from within an organization. BUSINESS EMAIL COMPROMISE (BEC): Scammers use spoofed emails to pose as trusted entities, requesting fraudulent payments, altering payroll details, or soliciting sensitive information. QUID PRO QUO: Quid pro quo translates to “a favor for a favor.” Involves scammers posing as IT personnel or technical service providers, offering help for sensitive information or actions. MALICIOUS QR CODES: When scanned, a malicious QR code can redirect phones to malicious destinations, exploiting unsuspecting users just like clicking on a malicious link. DEEPFAKE: Social engineers are now using deep fakes. Utilizing artificial intelligence, social engineers create hyper-realistic simulations of a person's appearance or voice to trick victims into divulging information or performing actions benefiting the attacker. SIM SWAPS: A SIM swap scam, also known as port-out scam is a type of account take over attack that normally targets a weakness in two factor authentication in which the second factor or step is a SMS or call placed to a mobile telephone. Read less