How do you protect against social engineering attacks?

Since phishing attempts are so common place these days, many organizations have begun utilizing training both during the onboarding process, as well as on an annual basis to keep their employees informed of common phishing attempts. Some organizations may even send their own phishing emails to put the training to practice, and retraining any employee who may fall for the attempt.

I totally agree that awareness is the key, furthermore, if you dig deeper into awareness, you will find nuances that became quite powerful tricks used by social engineers, like the amygdala kidnapping, a technique that exploits our emotions. The way it works is quite simple, when taken by a deep emotion, our brain freezes the frontal cortex and ignites the fight and flight response. It is an organic defense against imminent threats, like a fire, however, during that state, we come to our most vulnerable state, and our decisions may not be reasonable. This deceiving technique when well employed can result in terrifying results.

1. Employees should be educated and trained on how to use strong authentication. Secure Password Policies 2. Use Caution When Sharing Information 3. Encourage staff to independently check requests for sensitive information or actions that appear strange or urgent. 4. Utilize Email Filtering 5. Software should be updated on a regular basis. 6. Physical Access Security 7. Limit your exposure to information. 8. Put in place access controls. 9. Accounts and systems should be checked on a regular basis. 10 Create Incident Response Plans 11. Remote Work Security 12. Provide Channels for Reporting 13. Security measures should be tested on a regular basis.

I quite agree with this submission, awareness and staff training is very important to keep them abreast of common signs and tricks of these cybercriminals. Routine internal simulation should be scheduled to identify gaps among the team with regular training to close it to safegard them and company's asset.

Question everything; many of these phishing/scammer groups have gotten very creative in forming their attacks, but rarely will they get it perfect. If something looks off, or even feels off, seek confirmation through alternate channels. If this is a phone call about your financial information being compromised, hang up and call your financial institutions directly to confirm it, then take any appropriate action with them directly, not with the suspicious caller. The same applies to emails, text messages, and any other communication medium. Even popups on your computer should be questioned!

I wonder how many have actually fortified their email servers with SPF, DKIM and Dmarc? This will radically cut down on spoof emails that form the basis of phishing attacks.

Source thrusthwortiness is neverending story, with a combination with content management and user security awareness program is essential for inbounding information security.

Verifying the email address is always a great place to start when trying to identify a potential phishing email. While an email may claim it is from a certain company, phishing emails usually won’t be from an email address from that company, and are often from a gmail or other easy to create email account, and often contain many random characters.

While strong and varied passwords are important, they can still be vulnerable. If an attacker is able to trick a user with a phishing attempt, they often utilize a key logger; software that captures keystrokes, so that the attacker can utilize the victim’s password as much as possible. Multi-factor authentication (MFA) methods should also be employed whenever possible.

This measure could be contraproductive, cause increasing password complexity, pushing users to use not supported password managment techniques. MFA could be a great help from my perspective.

You do NOT need to change passwords regularly, or on any set schedule, unless you have reason to believe your password was compromised. Forcing users to change passwords on an arbitrary schedule causes them to do things they shouldn't, like writing them down.

MFA is great. But you have to educate your users on it. We are starting to see "MFA fatigue," where users just approve every request that comes through, without thinking about it. It's become such a part of their daily life (which is great) that they're almost approving requests on auto-pilot (which is not great).

MFA is very key security feature for both personal and company's safety in today's cyber space. Zero trust for all applications is recommended to keep safe at all times.

MFA now a days is a required basic security line to protect your digital identity. These days due to AI coming into play, account security is becoming a question mark. MFA atleast provides a second layer to password protection thereby saving you from bruteforce, dictionary attacks.

The caution against using public or shared devices and networks is well-founded, and the measures outlined are essential for cybersecurity. However, the practicality of completely avoiding such devices and networks, especially for frequent travelers or remote workers, can be challenging. In one instance, a colleague was forced to use an airport Wi-Fi and took all the necessary precautions, including a VPN, but still felt uneasy. This experience underscores the importance of not only following the mentioned practices but also having robust endpoint security solutions and awareness training to navigate these unavoidable situations with confidence.

One surprising action that most network / sec ops fail to do: Update their abuse emails in Network WHOIS contacts. If one of your devices are compromised, and the hackers use it to attack other ISPs/Networks, then those being attacked can alert you back as well, using your abuse email contacts. I have seen quite a number of ISPs/Network owners that fail this step.

I’ve made it a habit to not click through an email even if I suspect it’s legitimate, as often as I can, and will go to the site where the email would have to get information from (overdrawn notice would prompt me to go to my bank’s site). This alleviates any panic and lack of thought being generated by the email while giving reassurance that notification systems are working appropriately.

Social engineering attacks usually rely on someone deviating from "best practices" or standard procedure, because they are lazy or sympathetic. I certainly won't suggest that people should not be sympathetic, but processes and procedures are in place for a reason. Extensive training, not only in the processes themselves, but the potential consequences for themselves and the business of deviating (especially in the case of security protocols) can help folks understand the "why."

Don't use the same password for multiple accounts. If one password is cracked by someone, the balance account is safe. Specially financial account.

Cultivate a Security-Conscious Culture •Clear Reporting Channels: Establish a clear and confidential channel for employees to report suspicious activities without fear of repercussions. •Reward Vigilance: Incentivize employees for identifying and reporting potential social engineering attempts, fostering a culture of proactive security. Vet Third-Party Relationships •Supplier Risk Management: Evaluate the cybersecurity practices of third-party vendors and suppliers, ensuring they adhere to stringent security standards before granting them access to your organization's systems. Lastly, Periodically review and assess security policies, procedures, and controls to ensure they remain effective in the face of evolving threats.