Security7's
Guide to Social Engineering Attacks

Introduction

Security7's goal with this guide is to educate you on the dangers posed by social engineering attacks. We hope that you learn something from this document and that you socialize it amongst your family, friends, coworkers, and employees, or employer.

If you’ve got any questions or feel the need to reach out to us you can use the instant messenger service we offer in the lower left-hand corner of the page, the “Call Us” button in the navigation at the top of the page, or via this link.

Thanks, and happy reading.

What is a Social Engineering Attack?

In regards to information security, social engineering is defined as:

“The psychological manipulation of people into performing actions or divulging confidential information.”

That information can be leaked via e-mail, social media, the telephone, or even physical means. Attackers are often after a variety of things, but they mostly focus on obtaining personal identifiable information (PII) or financial information.

Often obtaining PII gives the attacker access TO financial information. Why? People often use unique identifiers for things like passwords.
Surprisingly, we know.

But why are attackers so successful? Years of practice. Have you ever seen the film Catch Me If You Can? Frank Abagnale, the main character, was an expert at social engineering.

Why do Social Engineering Attacks Work?

Social engineering attacks work because we're imperfect creatures. Attackers know this. They prey on our fundamental human nature to carry out their nefarious schemes.

In many cases, the reason attackers are so successful is because of a thing called "cognitive bias." Cognitive biases are a part of our daily lives. In simple language, we all create our own, unique subjective reality. If you're shocked or offended, we can understand. So you know, a cognitive bias doesn't always mean a bad thing, it's just something we have to watch out for as they can be easily manipulated.

We're not going to go too deep into this, but if you're interested you can read this article from The Strategy Bridge that does a great job explaining and putting the threat into perspective.

Before we move on to the next section, here are a few examples of cognitive bias, to show you how commonplace they are in our daily lives:

The list goes on and on. You can read more about cognitive biases here and more examples of cognitive biases can be found here.

Our pain point is don't focus on why a social engineering attack might work. Focus on what they are, how they work, and what you can do to stop them.

What's the Life Cycle of a Social Engineering Attack?

There are 4 key stages in the life cycle of a social engineering attack. They are as follows:

What Are the Different Types of Social Engineering Attack?

How to Spot and Protect Yourself from a Social Engineering Attack

There are a lot of different ways a social engineering attack can unfold. They don't always follow a similar blue print.

However, there are a few things you can do right off the bat to condition yourself to their attempts and spot an attack before it has a chance to impact you or your business.