Premium Essay

Sec440 Social Engineering

In:

Submitted By deviexx
Words 2263
Pages 10
Recommendations for Security Measures
SEC440

Abstract
A social engineering attack is a threat that can be both the most effective attack, as well as the most devastating. This paper will detail some of the strategies of identifying and circumventing a social engineering attempt on an organization. I will give real world examples of social engineering attacks and how the attack was able to succeed in easily infiltrating an organization’s IT systems.

.

Recommendations for Security Measures
Dictionary.com defines Social Engineering as “the application of the findings of social science to the solution of actual social problems.” (Dictionary.com, 2011). However in the Information Security world we use this word in a more specific sense. Christopher Hadnagy wrote a great book on this subject called “Social Engineering: The Art of Human Hacking” He defines on his website that Social Engineering is “the act of manipulating a person to accomplish goals that may or may not be in the ‘target’s’ best interest. This may include obtaining information, gaining access, or getting the target to take certain action.” (Hadnagy, 2011). This is the definition of Social Engineering I will be using throughout this paper, and this is perhaps the most dangerous form of attack available to hackers.
A Social Engineering attack can be initiated from many different vectors. A phone call could be made by an attacker to extract data. email phishing attacks can be composed to look like a legitimate request for sensitive information, or a physical intrusion into the building by someone claiming false credentials. The reality is a skilled Social Engineering attack can fool even the most paranoid “tin foil hat” wearers.
Alarmingly when it comes to Social Engineering, people’s curiosity seems to often kill the cat. The most common and well known issue would be that user that

Similar Documents

Free Essay

Cyber Crime

...purpose of this paper. To make sure how important systems security is to our country. In 2001 and 2002 Gary McKinnon hacked into US military computer networks. He Deleted important files in the operating systems in the US army’s district in Washington. Shutting down 2000 computers for 24 hours. He deleted weapons logs and crashed 300 computers for munition’s delivery to the US NAVY. He also broke into NASA networks to search for evidence of UFO cover-ups. In 2009, Albert Gonzalez helped steal about 36 million credit card numbers from TJX ,which cost the company about 160 million Dollars. Literature Review Social engineering is a practice of obtaining confidential information by manipulating users in social communication. In The Art of Deception: Controlling the Human Element of Security by Kevin Mitnick. The Book talks about social engineering and how it is used to gain information in financial, manufacturing, medical, and legal companies to gain access to their networks. I thought this book was important reading for company’s...

Words: 689 - Pages: 3

Free Essay

Kevin Mitnick - Social Engineering and Computer Hacking Mastermind

...Kevin Mitnick – Social Engineering and Computer Hacking Mastermind Shelby Descoteaux Professor Kabay IS 340 A Nov. 22, 2013 Table of Contents Introduction 3 Kevin Mitnick 3 Hackers and Their Motives 3 The Early Years 4 Adolescence 5 Kevin in Trouble 6 Kevin’s Final Visit from the FBI 7 Hacker or Engineer? 8 Impact on Computer Security 8 Conclusion 9 Works Cited 10 Introduction Most people today are aware of the detrimental risk that hackers pose to their computers. They might know about identity theft, viruses, Trojans and worms however what they fail to recognize is how these things are accomplished and if they have actually fallen victim to one of these horrible attacks. But what about attacks with even greater impacts…like someone hacking into the computer system of a car that controls the brakes? Perhaps penetrating the systems that control nuclear power plants? Although it seems unlikely that either of these extremely scary scenarios would ever happen, it is most definitely possible. One researcher for IBM’s Internet Security Systems told the owners of a nuclear power station that he could hack into their system through the Internet. The power station took this as a joke, responding to Scott Lunsford, the IBM researcher, with a laugh in his face saying that it was “impossible”. In response, Scott took up the power plant on their words and proved them wrong. In less than twenty-four hours, Scott’s team had infiltrated the system and in...

Words: 4016 - Pages: 17

Free Essay

Social Engineering

...“You could spend a fortune purchasing technology and services...and your network infrastructure could still remain vulnerable to old-fashioned manipulation.” Kevin Mitnick [4] Social engineering is one of the ways hackers get an access to sensitive information, such as passwords, access codes, credit card numbers, etc. Instead of breaking into a computer system, the persuasive hackers trick people into giving up the information on their own. [1] According to the Security and Risk website, social engineering attacks are very costly for businesses. For example, once hackers get the needed log in information, they can then spy on an organization’s activity and transactions. Annually, an organization can lose thousands of dollars on such attacks. New employees are the primary victims that become the prey of hackers via phishing emails and social networking sites. [2] The most common method of social engineering attacks is phishing or spam scams. The victim receives an urgent email where he or she asked to follow a link to verify the account number or any other “important” data. Hackers use well known organizations and banks’ logos and these kinds of emails are very convincing. There are different variations to this method, though. Instead of phony emails, a victim can receive a phony call from an “authority” or an IT specialist that tries to get the sensitive information from a victim. Also, there are different variations to it when hackers pretend to be some...

Words: 508 - Pages: 3