Social Engineering

& its impact on Information

security

By
Srinivas

Social Engineering
Hacking a person, instead of computer
Art of manipulating people
Bugs in human hardware
Greater impact
Compromise on Information security

Social Engineering techniques

Persuasion
Impersonation
Conformity

Pre-texting
Phishing
Dumpster Diving
Shoulder surfing

Social Engineering - Email

Spear phishing
Web url or as a downloadable

attachment(some time self extracting)

Requesting for help
Asking for donations(fundraising)
Sweepstakes.

Social Engineering - Phone

Helpdesk
Agents are prone to the risk
Typical IVRS

Social Engineering - Online

Reverse Social Engineering (RSE)
Social networking
Recommendations on the social networks
Tendency to attract more
Online free/paid survey participation

Social Engineering - Awareness

Avoid clicking on embedded links
Do not provide personal or official

information on unfamiliar websites

Avoid maintaining the official R& R in
social networking profiles
Avoid sharing official email address
Avoid mentioning (limited) availability in
auto reply emails
Keep the spam filters high

Social Engineering Control measures

Through information security policies
Training the Helpdesk employees
Organize awareness training
Warning signs & physical access control
Logical access control
Employee awareness and constant vigilance
Incident response procedures
Corporate facilities
Legal department

Social Engineering

Q & A?

Thank You !!!!!