Enterprise Networking Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Social engineering attacks take advantage of human weakness by using fraudulent means to manipulate someone into giving confidential information, clicking malicious links, and performing unauthorized actions.
While cybersecurity investments may help protect enterprise networks against technical weaknesses and prevent bad actors from gaining unauthorized access to critical systems, these efforts can be undermined by an attack leveraging social engineering techniques.
Verizon’s 2022 Data Breach Investigations Report (DBIR) revealed that about 74% of breaches involved the human element, which includes social engineering attacks, errors, or misuse. And in IBM’s cost of data breach report, the company reported that data breaches with social engineering as the initial attack vector cost an average of $4.10 million.
Since social engineering attacks are so common and costly, employees and organizations must know how to protect themselves against them. Here are seven tips to keep your company’s networks and data safe from social engineering.
Table of Contents
1. Educate yourself and your employees
Social engineers trick you into believing their deception. The more you’re familiar with various social engineering techniques, the less likely you will be to fall victim to them.
Bad actors engage in various tactics to conceal their true reason for contacting you; being well informed can help you avoid falling victim to them. Educating yourself and your employees regularly on common threats is vital as hackers constantly evolve their strategies. Conduct frequent awareness trainings — and if your company has a standard operating procedure, follow it to the letter.
2. Be skeptical of unsolicited communication
Be suspicious of all emails, phone calls, messages, or other forms of communication from people you don’t know. You can’t be too careful when it comes to preventing cyberattacks. When someone requests personal or confidential information, verify the request’s legitimacy through alternate channels before sharing sensitive data.
Social engineers can pose as IT support staff or executive team members and ask you for personal information, so even when the request appears to come from a legitimate sender, only accept their request after independently verifying it and double-checking the credentials.
Look out for what you may have missed in the email address; the letter “i” may be written as “l,” “o” may be written as “0”, and “m” may be written as “rn.” You can also take additional steps to contact someone else in the same department or company to confirm if the email or phone call originated from the said staff.
3. Use a good spam filter
Spam filtering services flag suspicious emails and send them to your spam folder. Email service providers such as Office365 and Gmail scan all your emails for spam by default; when they detect spam messages, they send them to your spam folder, while legitimate emails are delivered to your inbox.
You can also use third-party spam filtering tools to detect malicious emails, including links and attachments. These tools usually include various features, such as encryption, quarantine, allow/blocklist, fraud detection, email recovery, and email routing.
4. Enable multi-factor authentication (MFA)
Most account-based services now allow two-factor authentication (2FA) or MFA. Activate these wherever possible, as they add an extra layer of security by requiring more than just a password to access your accounts. This could involve a fingerprint scan, a unique code from an authentication app, or a physical token.
Additionally, create strong, complex passwords for your online accounts and ensure each account has a unique password. Consider using a password manager to help you generate and manage passwords securely.
5. Be mindful of sharing information on social media
Social engineers track your digital footprints to gather information about you, hence the need to limit the personal information you share on social media platforms. Information like your address, phone number, date of birth, and other personal details should be kept private to prevent malicious actors from using it against you.
6. Keep software updated
Cybercriminals exploit security vulnerabilities in computer systems to launch social engineering attacks. Outdated software is a vulnerability source for bad actors. Software updates usually include security patches for previous version vulnerabilities, hence the need to regularly update your devices and install patches as soon as they become available.
7. Monitor critical systems and identify which assets may attract criminals
By regularly monitoring critical systems, you can identify vulnerabilities, detect unauthorized access attempts, and protect your critical assets. Here’s a step-by-step process to help you monitor critical systems and identify assets that may attract criminals:
- Determine which systems and assets are essential for your organization’s operations.
- Implement system monitoring tools.
- Establish baseline behavior.
- Implement real-time alerts.
- Conduct log analysis and security audits.
- Monitor user access and privileges.
- Conduct periodic penetration tests to simulate real-world attacks and identify vulnerabilities in your critical systems.
5 social engineering prevention tips
Preventing social engineering attacks requires awareness, vigilance, and proactive measures. Adhering to basic preventative measures can enhance your defenses against the schemes used by social engineers.
- Think before you click a link from an unknown source. Be wary of email attachments and links. Never click a link from an unverified source.
- Research who is providing a link. Always independently verify the communication source. If someone claims to be IT support and requests personal information, contact their company to verify their credentials, and if it’s from your company, double-check with the person or a team member just to be sure.
- Don’t download random files. Be wary of downloadable content, especially from unknown sources. Social engineers sometimes use files to spread malware, harvest credentials, and gain access to systems and data.
- Be cautious if you notice unnecessary urgency. Don’t give in to unfamiliar requests. If someone attempts to pressure you into releasing sensitive information quickly without a valid reason, take the time to verify their identity and the reason for the urgency.
- Use web filtering. Block inappropriate and malicious websites from your network and use monitoring solutions to detect suspicious behavior.
3 common examples of socially engineered attacks
There are many different ways social engineers can trick you into giving away your personal information. Some of the most common include pretexting, baiting, and of course, phishing.
Pretexting
Malicious actors try to convince their victims with a fabricated story or pretext to give up valuable information they otherwise wouldn’t. People usually fall victim to this tactic because the social engineer casts themselves as someone with authority to request the information they ask the victim for. Some common scams carried out using pretexing include:
- Business email compromise (BEC) scams
- Account update scams
- Romance scams
- IRS/government scams
- Cryptocurrency scams
- Grandparent scams
Baiting
When an offer seems too good to be true, it usually is. In this case, the attacker baits their victims with desirable or appealing offers, such as free gifts. They may ask the victim to complete certain challenges to get their prize or click on a link to download malicious software disguised as legitimate. Once the bait is taken, the scam artists gain unauthorized access to the victim’s system or extract sensitive information.
Phishing
Phishing is the most common socially engineered attack by far — but that doesn’t mean it’s the easiest to spot. In fact, its widespread use is a testament to its effectiveness.
In a phishing attack, a scam artist impersonates a legitimate entity like a bank, online service, or other organization, and tricks the recipient into revealing sensitive information like passwords, credit card numbers, or login credentials through fraudulent solicitation in email, text, or phone call.
There are various types of phishing scam. Some of the most common include:
- Email phishing: The attacker sends an email that appears to be from a legitimate entity.
- Spear phishing: A targeted attempt to steal confidential information after conducting extensive research about the victim.
- Smishing: Smishing, or SMS phishing, involves sending fraudulent text messages to deceive recipients into downloading malware, sharing sensitive information, or sending money to cybercriminals.
- Vishing: Vishing (voice or VoIP phishing) is when attackers use voice communication, typically phone calls, to deceive victims into disclosing sensitive information to an unauthorized person.
Bottom line: Preventing social engineering attacks
Social engineers are constantly evolving their tricks to get victims to disclose personal information. The best defense, other than the standard network security protocols you should always have in place, is simply knowing what to look for.
By following the steps outlined in this guide, you can prevent socially engineered attacks and proactively save your company millions of dollars.
For further protection against social engineering, here are eight tips to prevent phishing attacks at your company. Having a strong network detection and response solution can help detect illicit activity as it happens.
