1. Social Engineering J Nivethan

2. Social Engineering The process of deceiving people into giving away access or confidential information Onlinne Phone Offline Any other means

3. Significance The weakest link in the security chain is the human element Attackers always try to exploit the weakest link in the security chain, as that gives them better results with less efforts

4. Why Social Engineering? Security of the systems have been improved in a great deal over the time It’s not easy to “bruteforce” the password of a bank account anymore But, it’s still not that difficult to deceive a gullible user and get his password from him!

5. Popular Social Engineering Attacks Phishing - The most popular Baiting Impersonation Online scams Tailgating Shoulder surfing Dumpster diving

6. Phishing Acquire information, pretending to be legitimate Ex: Fake login page

7. Baiting Like the real world Trojan Horse! Ex: Leave a flash drive with malware

8. Impersonation Ask for details impersonating (over email or phone) Calling help desk impersonating a customer Emailing employee impersonating boss/co- worker

9. Online Scams Ex: Enter your details, we will ship you free iPad

10. Tailgating Use an authorized person to gain access (Often when the person is careless or not aware)

11. Shoulder Surfing Using direct observation techniques to obtain information Ex: Look from behind Place a camera

12. Dumpster Diving Search the trashed things to gain any information Storage devices Written data on papers

13. Prevention / Mitigation Educating users o Training users on Phishing, Baiting, Impersonation, Online scams, Tailgating, Shoulder surfing, dumpster diving, tailgating Establishing policies o Proper data disposal policy (dumpster diving) Implement mechanisms o Like NYC subway mitigates tailgating o Session management

14. Educating users in an organization Perform all types social engineering attacks on employees (testing), and grade each of them according to their social engineering immunity Make the employee go through the training again if he/she gets low grade Reward the employees with better score

15. Recent Google Doc Phishing Hackers simply created a folder inside of a Google Drive account, marked it as public, uploaded a file there, and used the preview feature in Google Drive to get a URL that they could include in the email. Once a user enters his or her credentials and clicks “Sign in,” the information is sent to a compromised server And the user is redirected to a real Google Docs document, unaware that phishing happened.

16. Questions?