The Effect of Social Engineering on Cybersecurity

Sounds like a deep, complex issue, but it’s really pretty simple. Cyber criminals do not spend their time throwing around esoteric behavioral principles in discussions about how best to ply their crooked trade. They just know a sucker when they see one. The defense against that is both simple and complex: just don’t be a sucker.

What is social engineering in simple terms?

There are two definitions of social engineering – only one of which is part of this discussion. The first is not. Oxford Languages first definition is: “1. The use of centralized planning in an attempt to manage social change and regulate the future development and behavior of a society.”

The concern here is Cybersecurity. We are not going to get into social discussions about things like what pronouns we should use in referring to people.

What is up for discussion here is the second definition, which directly impacts network security. It is also from Oxford Languages: “2. (In the context of information security) The use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes.” For example: "People with an online account should watch for phishing attacks and other forms of social engineering".

In essence, this definition describes an aspect of social engineering which can serve as a ‘sucker-making’ tool. It is the art of duping someone into doing something stupid – or not worrying about very real threats.

This type of social engineering is trickery based on human nature. It is designed to get you to do things that you should have thought about first – things which may or may NOT be in your best interests – or in the best interests of your company.

How does this affect the security measures put in place by your IT support? Simple: it thwarts them. There is no cyber-defense – no firewall or AV (Anti-Virus) that will keep an unthinking or untrained employee from being fooled into letting malware into your system.

Damage can be kept to a minimum by a good Managed IT Services provider. Here at ITFirm.com, we have certainly had clients who unwittingly clicked a malicious link, but our system contains the malware within that single workstation to prevent access to the larger network. This makes it a matter of an hour or two to remove the malware, wipe the workstation clean, and then reinstall the data from secure backups.

Many phishing scams simply appeal to a universal human weakness: Greed. “You’re a WINNER! Click on the link below to collect your winnings!” All those infamous scams from strangers who have tens of millions of dollars in accounts that are frozen – but with your five thousand dollars, they can free up the cash and repay you with a million dollars. Sadly, people really do fall for this garbage.

They often use a more sophisticated approach by finding key personnel in a business they plan to attack, poring over their social media, and coming up with a phishing ploy that makes the target think they know them. Crooks learn enough about you to exploit your human weaknesses, which are often benign. From Facebook, they can learn if you’re married, have children, or pets as well as their names – all vulnerable areas that can be exploited in phishing emails.

A while back, we saw a phishing email that was a particularly cruel and malicious in an attempt to get a married man to click on an attachment containing malware.

The email appeared to come from a legitimate law firm, stating that they had been retained by the man’s wife to initiate divorce proceedings. It informed him that the divorce papers were attached, but they were not divorce papers and his wife was not leaving him: It was Ransomware.

Suppose you get an email that appears to be from your child’s school, saying “There’s been an accident and we couldn’t reach you by phone - your child has been taken to the hospital below” – and there’s a link. This socially engineers you into an emergency state where you may not stop to think before you click. Do nothing until you call the school (NOT using any phone number from the suspect email).

At ITFirm.com, our clients usually know to stop, think, and forward the email to our IT HelpDesk. However, even with our urging for ongoing Security Awareness Training, human nature dictates that people get careless when they are busy or, as in the examples above, stressed. Any reputable member of the Charlotte IT Support Community knows that if an end-user makes a thoughtless click, all the firewalls and Anti-Virus (AV) in the world cannot prevent that workstation from becoming infected.