Social Engineering

Question 1

Effective social engineering

Answer 1

• Constantly changing - You never know what’s next

• May involve multiple people
  
  • And multiple organizations
  • There are ties connecting many organizations
• May be in person or electronic
  
  • Phone calls from aggressive “customers”
  • Emailed funeral notifications of a friend or associate

Question 2

Social engineering principles

Answer 2

• Authority
• The social engineer is in charge
• I’m calling from the help desk/office of the
CEO/police

• Intimidation
• There will be bad things if you don’t help
• If you don’t help me, the payroll checks won’t be
processed

• Consensus / Social proof
  
  • Convince based on what’s normally expected
  • Your co-worker Jill did this for me last week
• Scarcity
  
  • The situation will not be this way for long
  • Must make the change before time expires
• Urgency
  
  • Works alongside scarcity - Act quickly, don’t think
• Familiarity / Liking
  
  • Someone you know, we have common friends
• Trust
  
  • Someone who is safe
  • I’m from IT, and I’m here to help