لطفا منتظر باشید ...
Social Engineering
In the world of information technology, social engineering exists in different forms but can be best described as the practice of tricking people into revealing passwords. As a security administrator, it is your duty to be familiar with this threat and to educate your network users because social engineering can impact everyone in the organization.
Techniques
A number of techniques can be used in a social engineering attack. Three classic social engineering tricks are reverse social engineering, e-mails and phone calls, and authority abuse. This section outlines some of the most frequently used techniques.During a reverse social engineering attack, the user is persuaded to ask the attacker for help. For instance, after gaining simple access to the user's system, the attacker breaks an application in the workstation, resulting in the user requiring and asking for help. The attacker then modifies the error messages to contain the attacker's contact information. The user contacts the attacker asking for assistance. This gives the attacker an easy way to obtain the required information.Sending e-mails or phone calls is a much more direct approach, but it is less likely to be successful. An attacker calls a target individual asking the target to provide a username and password for completing a task quickly. This is by far the easiest type of social engineering attack to launch, but many individuals today are careful enough not to provide that information.Here is a sample scenario. By pretending to be part of the technical support organization or just an important user, the attacker can pressure the target. For example, an attacker posing as a senior manager or system administrator could request usernames and passwords from subordinates to meet important deadlines or to resolve a problem quickly.An alternative form of social engineering is as simple as guessing someone's password. Children's names, birthdays, and phone numbers are likely candidates to be guessed as passwords.
Countermeasures
As with all security threats, ways can be found to reduce the success of a social engineering attack. However, for social engineering attacks, the human factor can be easily influenced by an external event. A solid security policy defines expectations for users as well as for support personnel. Chapter 5, "Security Policies," discusses security policies in more detail. Training and awareness of the workforce is the simplest solution to prevent these attacks.In conclusion, your role as a security administrator requires you to understand the implications of social engineering threats and how these threats can be manifested. Only through such understanding can you take appropriate actions and ensure that protection of the organization is guaranteed on an ongoing basis.
