An enterprise can pay hundreds of thousands of dollars or more for the latest security software and imagine itself protected from targeted attacks that come in via the network. But if the threat is a real-live person who walks in the front door of an office or server farm, what good can the network edge software do?
Clever criminals are seeing bigger payoffs in showing up on-site to physically plug into a network rather than crafting phishing emails with links that lead to compromised websites. (Not to say that spam and other online social engineering campaigns have gone away; see the Cisco 2014 Midyear Security Report for more.) Simply being able to plug into an Ethernet connection or unplug an IP phone and use that cable to access network information can have serious consequences. Social engineering is the act of hacking people. Therefore, people—your employees—become the weakest link in your digital and physical security posture.
Criminals use similar tactics for social engineering an in-person visit as they do with emails and compromised websites. The point is to build trust (albeit misplaced) with someone who can grant access to company premises.
By researching a targeted employee on LinkedIn—for instance, discovering everything from the tasks they perform on the job to where they went to college and which sports teams they like—the criminal can present himself or herself as someone the target might know or have reason to trust. Thanks to the popularity of social networking, especially among professionals, there is a wealth of information and photos easily available to anyone who needs to get a literal foot in the door.
Armed with background information gleaned from online searches, a criminal can pretend to be a journalist and request an interview or claim to be a potential partner or customer and ask for an in-person visit. The criminal might also wear a fake badge to provide the illusion of authority.
Criminals have also figured out that they do not need to launch such scams at the front door of the organization they are targeting. Instead, they will target a weaker link: that is, a less secure business partner or supplier that has access or connectivity to their real target, which is the network. This is an especially effective technique to use when the security of a target is high, but the security of a trusted business partner of your target is not. Hackers will always try to find the easiest route in.
A mitigation approach for social engineering-based security breaches that involve gaining physical network access is to make sure network access ports enforce authentication and authorization before granting network access.
In addition, organizations can build “dynamic security domains” per user, per device, per user and device, or any other configuration needed. These dynamic security domains can use technology such as 802.1x, port access-control lists (ACLs), VPN, and host posture assessment.
For more security trends from the first half of 2014, download the Cisco 2014 Midyear Security Report.
Interesting article. Much like ‘hacking’ gets a negative connotation, social engineering typically is categorized as an unsavory activity. I think just as the we have ethical hacking there a form of social engineering that is beneficial. Relating in the communication process is the fundamental catalyst to efficient outcomes. Those very in tune with how to get the most out of situations including how to relate make any situation less awkward and moving toward a desired outcome. People control comes in numerous forms. Social engineering is the most personal. One that can be used against us in powerful ways worth being more aware of. Thanks for sharing your views!