Computer Security And Social Engineering

Social engineering has caused many problems for different organizations. Because of social engineering many businesses have to take extra steps to protect themselves and their information from being hacked. According to Bidgoli, Social Engineering is a type of attack that takes over the power of human aspects in order to trick the public into declaring confidential information(MIS 7, 2017). This hacking technique has obtained the attention of numerous organizations, businesses, and governments worldwide.

new advances in the electronic technologies during the past decades have administered a new wealth of criminal activity. Software like Computer viruses, malware, software privacy, spam and etc. Technologically savvy artist replicate websites, so when a person's online activities occurs in a virtual world it can be compromised.Many times Cyber intrusions rely on human interaction and it often involves tricking people into breaking security procedures.

Dhamija, R., Tygar, J. D., & Hearst, M. (2006, April). Why phishing works. InProceedings of the SIGCHI conference on Human Factors in computing systems (pp. 581-590). ACM.

It is recommended that we conduct a test that would simulate that breach. The test results should be anonymous as the goal of the test is to improve the company's security posture in a way that improves the entire company's security. After the test is complete, the results should be used to assist in designing training for employees on understanding and dealing with potential social engineering attacks. After developing the training, new policies and procedures should be disseminated, then the training can include understanding and reviewing the new policies and procedures. After the training is completed another test should be done to measure engagement and effectiveness of the social engineering training. This information should be used to improve training. The goal of the training would be to empower employees with situational awareness skills that would assist them in identifying potential social engineering attempts and how to respond

Over the last few years the amount of security breaches that have been reported have had one factor that has been prevalent in majority of the attacks. That factor is the employee’s and how they are manipulated into giving the intruder/hacker exactly what they needed without realizing it. The use of social engineering in data breaches and fraud has been steadily increasing over the years. Confidentiality, integrity, and availability the three components of the CIA triad in network security can all be compromised by the risk of social engineering.

Social engineering techniques, such as posing as a legitimate employee, or business to request certain data.

Social Engineering has become a career for modern day cyber criminals. Thieves are waiting to prey on the vulnerable, and naïve. The situations, as devastating as they are to the victims, are very real. In some cases, unfortunately, the cybercrimes are life-altering and irreparable. This paper will highlight four real-life cases where social engineering techniques were used to obtain personal and corporate information.

Identity theft is one of the growing crimes in the United States due to the fact people do not know how to properly protect themselves against it. Criminals use different methods to acquire the information necessary to steal someone’s identity. Some of the techniques used to commit identity theft are; stealing wallets, acquiring bank information or pilfering through trash to find documents containing PII (FBI, n.d.). Nowadays criminals are able to steal people’s identity using different procedures over the internet without having to compromise their identity. Some of the methods are social engineering, phishing, sending spam messages and malware (OLI, 2013). Criminals use these methods because with the use of technology, identity theft could be accomplished anonymously and without much effort. Also because people lower their guard about securing their personally identifiable information when using the internet, especially when using social networks, they become easy targets to

Many wonder what is a social engineer and want to know what is that they do and why do they do it. Social engineer is the art of manipulating people so that they give the social engineer important information. A social engineer could be considered people who know you personally or someone who do not know you at all. If it’s a person you have not met, they would manipulate you to make it seems as they are trusted individual. Social engineering sometimes look for the flaws within a company or an individual and use that for their gain. In my PowerPoint I stated that social engineer are basically the “scientific” term for a hacker. They “phish” the brain to retrieve what is needed and moved to the next vulnerable person or company.

Cookies are also used as a technique of social engineering and it involves installing software in an individual’s PC remotely. The victim is then tricked by messages that constantly pop up in his computer’s window and which inform him he has won a particular prize (Mann, 2012). In order to trick the user, he is directed click a particular link to claim his prize. If he accepts and does so, his emails and passwords are stolen and used to his access his/her personal and confidential

The worse attack on the United States computer network took place in 2008. The Deputy of Secretary of Defense, William J. Lynn III, described the event as a “network administrator’s worst fear: a rouge program operating silently, poised to deliver operational plans into the hands of an unknown adversary” (Lynn, 2010). The common thought that comes to mind when we think of an attack on a network infrastructure is that the attack is a complex attack coordinated by some “black hat ” hacker/cracker that had to decipher lines of code and encrypted algorithm to penetrate the United States network infrastructure. However, the most common attack and the most devastating attack to infect the United States network was a simple social engineering attack.

Social engineering is a term many people are not familiar with and the first thing they think of is social networking sites. This is not the case, social engineering is simply using human nature against someone to get information or to have them do something they normally would not do. For example, if someone new asked someone to give out company secrets, they would not, but someone making them feel bad for by putting themselves in a situation they are familiar with they have a better chance of getting that information. Social engineering can be broken up into three main attacks and those are phishing attacks, telephone attacks, and in-person attacks.

The act of tricking individuals into divulging their sensitive information and using it for malicious purposes is not new. Social engineering attacks have occurred on the internet throughout its existence. Before widespread use of the internet, criminals used the telephone to pose as a trusted agent to acquire information. The term “phishing” has origins in the mid-1990s, when it was used to describe the acquisition of internet service provider (ISP) account information. However, today the term has evolved to encompass a variety of attacks that target personal information.

The Art of Deception is an in depth look at the vulnerability that the common man has to the social engineer. Mitnick’s perspective comes from a social angle instead of a technological one, seeing as he is known as the greatest hacker all over media and most of his methods weren’t technologically inclined but socially. A quick look into Mitnick’s background, he was an only child who had a knack for understanding the Nitti Gritty of technology. As a child, he managed to ‘hack’ the bus system in Los Angeles and travel for free, exploited telephone networks as a teen and in college, infiltrated their network and was later hired because it was either that or expulsion. These are just a few of his many hacking exhibitions. He has served jail time because he realised what he did was wrong and is now helping companies avoid similar exploitations through his security company, public talks and through his books.

With the beginning of internet, various online attacks have been increased and among them, the most popular attack is phishing. Phishing is an online security attack where the hacker targets in achieving sensitive information like passwords, credit card information etc. from the users by making them to believe what they see is what it is. It is the combination of social engineering and technical methods to convince the user to reveal their personal data. The paper discusses about the Phishing social engineering attack theoretically and their issues in the life of human Beings. At the same time this paper also provides different techniques to detect these attacks so that they can be easily dealt with in case one of them occurs. The paper gives a thorough survey of various Phishing attacks along with their preventive measures.