Which threats are categorized as social engineering

These social engineering schemes know that if you dangle something people want, many people will take the bait. These schemes are often found on Peer-to-Peer sites offering a download of something like a hot new movie, or music. But the schemes are also found on social networking sites, malicious websites you find through search results, and so on.

Or, the scheme may show up as an amazingly great deal on classified sites, auction sites, etc.. To allay your suspicion, you can see the seller has a good rating all planned and crafted ahead of time. People who take the bait may be infected with malicious software that can generate any number of new exploits against themselves and their contacts, may lose their money without receiving their purchased item, and, if they were foolish enough to pay with a check, may find their bank account empty.

They pick companies that millions of people use such as a software company or bank. For free! Some social engineering, is all about creating distrust, or starting conflicts; these are often carried out by people you know and who are angry with you, but it is also done by nasty people just trying to wreak havoc, people who want to first create distrust in your mind about others so they can then step in as a hero and gain your trust, or by extortionists who want to manipulate information and then threaten you with disclosure.

This form of social engineering often begins by gaining access to an email account or another communication account on an IM client, social network, chat, forum, etc. They accomplish this either by hacking, social engineering, or simply guessing really weak passwords. The malicious person may then alter sensitive or private communications including images and audio using basic editing techniques and forwards these to other people to create drama, distrust, embarrassment, etc.

Alternatively, they may use the altered material to extort money either from the person they hacked or from the supposed recipient. There are literally thousands of variations to social engineering attacks. And you may experience multiple forms of exploits in a single attack.

While phishing attacks are rampant, short-lived, and need only a few users to take the bait for a successful campaign, there are methods for protecting yourself.

Most don't require much more than simply paying attention to the details in front of you. Keep the following in mind to avoid being phished yourself. Slow down. Spammers want you to act first and think later. Once a social engineer has tricked their victim into providing this information, they can use it to further their attacks. One of the best ways to keep yourself safe from a social engineering attack is to be able to identify them.

Let's explore the six common types of social engineering attacks:. Phishing is a social engineering technique in which an attacker sends fraudulent emails, claiming to be from a reputable and trusted source.

For example, a social engineer might send an email that appears to come from a customer success manager at your bank. They could claim to have important information about your account but require you to reply with your full name, birth date, social security number and account number first so that they can verify your identity.

Ultimately, the person emailing is not a bank employee; it's a person trying to steal private data. Phishing, in general, casts a wide net and tries to target as many individuals as possible. However, there are a few types of phishing that hone in on particular targets.

Spear phishing is a type of targeted email phishing. In a spear phishing attack, the social engineer will have done their research and set their sites on a particular user. By scouring through the target's public social media profiles and using Google to find information about them, the attacker can create a compelling, targeted attack.

Imagine that an individual regularly posts on social media that she is a member of a particular gym. In that case, the attacker could create a spear phishing email that appears to come from her local gym. The victim is more likely to fall for the scam since she recognized her gym as the supposed sender. Whaling is another targeted phishing scam. However, in whaling, rather than targeting an average user, social engineers focus on targeting higher-value targets like CEOs and CFOs.

Whaling gets its name due to the targeting of the so-called "big fish" within a company. Piggybacking attacks Piggybacking, also called tailgating, is when an unauthorized person physically follows an authorized person into a restricted corporate area or system.

Pretexting attacks Pretexting, the human equivalent of phishing, is when a hacker creates a false sense of trust between themselves and the end user by impersonating a co-worker or a figure of authority well known to an end user in order to gain access to login information.

Best practices to protect yourself from a social engineering attack Social engineering attacks are both sneaky and prevalent. Legitimate organizations will never send a message asking for personal information.

Adjust your spam filters. Every email program has spam filters, make sure yours is set to high to block out potential threats.

Secure your computing devices and accessories. This means protecting your digital space with anti-virus software, firewalls, and email filters. It also means securing flash drives, external hard drives, and other pieces of equipment that could be compromised.

Ensure you have a reliable backup and recovery solution By default, all company desktops, laptops, and mobile devices should automatically lock when left idle for longer than five minutes or less. Get Our Weekly Updates Subscribe. Learn More. Read More. Suggested Next Reads. Upon form submittal the information is sent to the attacker. Given that identical, or near-identical, messages are sent to all users in phishing campaigns, detecting and blocking them are much easier for mail servers having access to threat sharing platforms.

This is a more targeted version of the phishing scam whereby an attacker chooses specific individuals or enterprises. They then tailor their messages based on characteristics, job positions, and contacts belonging to their victims to make their attack less conspicuous. Spear phishing requires much more effort on behalf of the perpetrator and may take weeks and months to pull off. The message prompts recipients to change their password and provides them with a link that redirects them to a malicious page where the attacker now captures their credentials.

Register Now. Social engineers manipulate human feelings, such as curiosity or fear, to carry out schemes and draw victims into their traps. Therefore, be wary whenever you feel alarmed by an email, attracted to an offer displayed on a website, or when you come across stray digital media lying about.

Being alert can help you protect yourself against most social engineering attacks taking place in the digital realm. Moreover, the following tips can help improve your vigilance in relation to social engineering hacks. Social Engineering What is social engineering Social engineering is the term used for a broad range of malicious activities accomplished through human interactions.

Social Engineering Attack Lifecycle. See how Imperva Web Application Firewall can help you with social engineering attacks.