Social Engineering

Learning outcomes:

• Recognize common social engineering attacks such as phishing, smishing, vishing, pretexting, and tailgating, and explain how attackers use publicly available information to make them more convincing
• Analyze a suspicious email or message and identify the warning signs that it is malicious
• Explain how to plan and run a phishing awareness campaign, including measuring results and following up with staff
• Describe how to report and respond to a suspected social engineering attempt within an organization

Would you like to download my PowerPoint to follow along?

• Why Attackers Target People
• It's easier to trick someone than to break encryption
• Most breaches start with a human element
• Phishing keeps growing every year, see the APWG Phishing Activity Trends Reports
• Everyone is a target: employees, students, family members
• The Psychology Behind It
• Urgency ("act now or your account is closed")
• Authority ("this is IT" or "this is your CEO")
• Fear, curiosity, helpfulness, trust
• Common Attack Types
• Phishing, spear phishing, whaling
• Smishing (text) and vishing (phone)
• Pretexting and impersonation
• The Social Engineering Framework breaks down these attacks and the psychology behind them
• Physical Social Engineering
• Tailgating and piggybacking
• Fake delivery people, contractors and "new employees"
• Dropped USB drives
• How Attackers Do Their Homework
• LinkedIn, company websites, social media
• Job postings reveal the software and systems in use
• Personal posts give away answers to security questions
• Spotting a Malicious Message
• Check the sender's address, not just the display name
• Hover over links before clicking
• Unexpected attachments, odd tone, pressure to act fast
• The FTC's guide to recognizing and avoiding phishing scams
• Example: walk through a real phishing email
• AI and Modern Social Engineering
• Phishing emails with no spelling mistakes
• Voice cloning and deepfake video calls
• Why "it sounded just like them" is no longer proof
• Personal Protection
• Lock down social media privacy settings
• Verify requests through a different channel (call back on a known number)
• Family code words for emergency calls
• Use MFA everywhere
• CISA's tips for avoiding social engineering and phishing attacks
• Running a Phishing Awareness Campaign at Work
• Get leadership buy-in and set clear goals
• NIST SP 800-50 covers how to build a security awareness and training program
• Send simulated phishing emails
• Measure click rates and report rates over time
• Train people instead of shaming them
• CISA's phishing guidance for organizations
• Reporting and Responding
• Make reporting easy (a report-phish button, a clear contact)
• What to do if you clicked: report quickly, don't hide it
• How security teams triage and respond to reports
• Scams can be reported to the FBI's Internet Crime Complaint Center (IC3), which also publishes yearly reports on losses

Suggested Activities and Discussion Topics:

• Discussion: share a scam attempt you or someone you know received. What warning signs were there?
• Activity: take the Google Phishing Quiz. Which ones fooled you, and why?
• Activity: look at your own social media from an attacker's point of view. What could someone use to build a convincing pretext against you?
• Activity: review the example emails and text messages. For each one, decide if it is a scam or legitimate and list the warning signs before you open the red flags.
• Discussion: should companies discipline employees who repeatedly fail phishing tests? What is more effective, consequences or more training?

Would you like to see some more classes? Click here