One of the most important topics to be covered in any security
awareness program is social engineering.
Social engineering can be defined as the manipulation of people
to perform actions that they should not do.
There are four main types of social engineering that we
need to warn people about, intimidation,
name dropping,
appealing for assistance, and, of course, the
technical type such as phishing attacks.
The thing is that intimidation is where a person tries to threaten,
I'll talk to your boss, I'll report you, and tries to convince someone
to do something so they don't make a fuss.
Name dropping is, oh, I was talking to, and they mentioned maybe a
senior manager, and he said you could do this for me.
Yeah, you bring in a little bit of flattery with it as well. And people think,
oh, well, if he or she approved it. The next is, of course,
appealing‑‑‑ I'm really having a problem with this.
And could you help me get this done? And I need to get
this for the boss right away. And maybe somebody provides
access they shouldn't have had.
And of course, we need to warn people about things like phishing attacks
and how prevalent these are and how dangerous as well.
Some of the symptoms that we can warn people to watch for that
would probably indicate some type of social engineering is
pressure. We need to do this right away.
We can't wait.
Or of course, there's this urgency here that requires someone to do
something without checking or verifying with anybody else.
The idea of flattery where someone turns and says yes,
you're the best one, or I was told you could help with this. Or of
course threats. I'll have your job for this.
These are things that we need to warn people about.
And when it comes to social engineering,
the best thing is to give people an awareness of it so they know how to
recognize it and then of course resist it as well.
So preventing social engineering is a lot about developing a culture.
It's okay to say no.
If you've been told that this is how it's supposed to be done,
even if someone tries to convince you no,
no, no,
I've been told that this is the way we do it, and
I'm not allowed to change that.
It's management that wrote this policy.
I don't have the authority to overrule management. But this means that
management has to support the employee who follows the policy.
It could be that management comes and says,
okay,
we're going to grant an exception. But then they
should turn the employee and say,
but you did the right thing in not just going along
with what this person asked for.
We often hear that, you know, the customer is always right. And in many cases,
actually, the customer is wrong.
So it's good for us to know that we, as employees. have the support of
management at all times when we follow the policies. It is good to have the
policy so people know, and it's not vague or misunderstood how to do
something. And of course, have procedures.
If somebody asked for something, maybe they say, well, name dropping,
this person said you could help me.
Okay, thanks.
I'll go and independently verify that.
Oh, they're not available today.
Well, then I'm sorry I can't do it.
If I can't independently verify that that person said it, it
could well be that the reason I use that person's name is they
know that person is not in that day.
So it's good to have these policies, procedures, and certainly a
culture that the employees know that if they follow the
procedures, they won't get in trouble for that.