[Day 3] 1. Social Engineering Attacks

Definition:

• Social engineering is the art of manipulating people into revealing confidential information.
• Common targets include help desk personnel, technical support executives, and system administrators.

Why It Works:

• It exploits people's unawareness about the value of their information.
• It also takes advantage of their carelessness in protecting sensitive data.

Impact of Social Engineering Attacks on Organizations

1. Economic Loss
2. Loss of Privacy
3. Lawsuits and Arbitrations
4. Dangers of Terrorism

Factors Making Organizations Vulnerable

1. Insufficient Security Training
2. Unregulated Access to Information
3. Lack of Security Policies

Phases of a Social Engineering Attack

1. Research on the Target Company
   • Methods: Dumpster diving, browsing websites, studying employees, or touring the company.
2. Select a Victim
   • Focus on frustrated employees of the target company.
3. Develop a Relationship
   • Build trust with the selected employees.
4. Exploit the Relationship
   • Extract sensitive information, such as:
     • Account and financial details.
     • Information about current technologies used by the company.

Types of Social Engineering

1. Human-Based Social Engineering

   • Involves direct interaction to gather sensitive information.

2. Computer-Based Social Engineering

   • Uses computers or digital devices to carry out the attack.