Module09 Social Engineering

Thursday, February 29, 2024 0 Comments

 Module 9: Social Engineering

social engineering concepts and techniques, including how to identify

theft attempts, audit human-level vulnerabilities, and suggest social engineering

countermeasures. Hands-On Lab Exercises: Over 4 hands-on ex ercises

with real-life simulated targets to build skills on how to:

> Perform social engineering using Various Techniques

> Spoof a MAC address of a Linux machine

> Detect a phishing attack

> Audit an Learn organization’s security for phishing attacks

Key topics covered:

> Social Engineering

> Types of Social Engineering

> Phishing

> Phishing Tools

> Insider Threats/Insider Attacks

> Identity Theft

Section 01: Social Engineering Concepts

Social Engineering:

In the context of information security, social engineering is the psychological manipulation of people into performing actions or divulging confidential information. This differs from social engineering within the social sciences, which does not concern the divulging of confidential information.

Different behaviors that categorize social engineering are the following

    Authority

    Intimidation

    Consensus

    Scarcity

    Urgency

    Familiary

    Trust

Section 02: Social Engineering Concepts

Human Based Social Engineering

Impersonation / Impersonator:

An impersonator is someone who imitates or copies the behavior or actions of another.

Eavesdropping:

Eavesdropping is the act of secretly or stealthily listening to the private conversation or communications of others without their consent in order to gather information.

Shoulder surfing:

In computer security, shoulder surfing is a type of social engineering technique used to obtain information such as personal identification numbers (PINs), passwords and other confidential data by looking over the victim's shoulder. Unauthorized users watch the keystrokes inputted on a device or listen to sensitive information being spoken, which is also known as eavesdropping.

Dumpster diving:

Dumpster diving (also totting, skipping, skip diving or skip salvage) is salvaging from large commercial, residential, industrial and construction containers for unused items discarded by their owners but deemed useful to the picker.

Piggybacking:

In security, piggybacking, similar to tailgating, refers to when a person tags along with another person who is authorized to gain entry into a restricted area, or pass a certain checkpoint.

Elicitation:

An elicitation technique is any of a number of data collection techniques used in anthropology, cognitive science, counseling, education, knowledge engineering, linguistics, management, philosophy, psychology, or other fields to gather knowledge or information from people.

Pretexting:

Pretexting is a type of social engineering attack that involves a situation, or pretext, created by an attacker in order to lure a victim into a vulnerable situation and to trick them into giving private information, specifically information that the victim would typically not give outside the context of the pretext.

Wardriving:

Wardriving is the act of searching for Wi-Fi wireless networks, usually from a moving vehicle, using a laptop or smartphone. Software for wardriving is freely available on the internet.

Computer Based Social Engineering

Phishing:

Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious software on the victim's infrastructure like ransomware.

Spam:

Email spam, also referred to as junk email, spam mail, or simply spam, is unsolicited messages sent in bulk by email (spamming).

Section 03: Insider Threats

Insider Threats:

Insider threat An insider threat is a malicious threat to an organization that comes from people within the organization, such as employees, former employees, contractors or business associates, who have inside information concerning the organization's security practices, data and computer systems. The threat may involve fraud, the theft of confidential or commercially valuable information, the theft of intellectual property, or the sabotage of computer systems.

1. Malicious insiders: People who take advantage of their access to inflict harm on an organization.

2. Negligent insiders: People who make errors and disregard policies, which place their organizations at risk.

3. Infiltrators: People who are external actors that obtain legitimate access credentials without authorization.

Section 04: Identity Theft

Social security number (SSN):

In the United States, a Social Security number (SSN) is a nine-digit number issued to U.S. citizens, permanent residents, and temporary (working) residents under section 205(c)(2) of the Social Security Act, codified as 42 U.S.C. § 405(c)(2).

Identity theft:

Identity theft occurs when someone uses another person's personal identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes. The term identity theft was coined in 1964.

Identity theft - child identity theft:

Child identity theft occurs when a minor's identity is used by another person for the impostor's personal gain.

Identity theft - criminal identity theft:

When a criminal fraudulently identifies themselves to police as another individual at the point of arrest, it is sometimes referred to as "Criminal Identity Theft."

Identity theft - financial identity theft:

The most common type of identity theft is related to finance. Financial identity theft includes obtaining credit, loans, goods, and services while claiming to be someone else.

Identity theft - synthetic identity theft:

A variation of identity theft that has recently become more common is synthetic identity theft, in which identities are completely or partially fabricated

Section 05: Social Engineering Countermeasures

Countermeasures

    Security awareness training.

    Be skeptical.

    Have an incident response plan.

    Perform background checks.

    Apply concept of least privileges.

In particular, against phishing

    Security awareness training.

    Perform phishing campaigns internal to company.

    Check URL links by hovering over them.

    Check for grammar mistakes.

Data loss prevention (DLP):

Data loss prevention (DLP) software detects potential data breaches/data ex-filtration transmissions and prevents them by monitoring, detecting and blocking sensitive data while in use (endpoint actions), in motion (network traffic), and at rest (data storage).

Intrusion detection system (IDS):

An intrusion detection system (IDS; also intrusion prevention system or IPS) is a device or software application that monitors a network or systems for malicious activity or policy violations.

Splunk:

Splunk is the data platform that powers enterprise observability, unified security and limitless custom applications in hybrid environments.

Security information and event management (SIEM):

Security information and event management (SIEM) is a field within the field of computer security, where software products and services combine security information management (SIM) and security event management (SEM). They provide real-time analysis of security alerts generated by applications and network hardware. Vendors sell SIEM as software, as appliances, or as managed services; these products are also used to log security data and generate reports for compliance purposes.

Separation of duties:

Separation of duties (SoD), also known as segregation of duties is the concept of having more than one person required to complete a task. It is an administrative control used by organisations to prevent fraud, sabotage, theft, misuse of information, and other security compromises.

Least privilege:

In information security, computer science, and other fields, the principle of least privilege (PoLP), also known as the principle of minimal privilege (PoMP) or the principle of least authority (PoLA), requires that in a particular abstraction layer of a computing environment, every module (such as a process, a user, or a program, depending on the subject) must be able to access only the information and resources that are necessary for its legitimate purpose.

Background check:

A background check is a process a person or company uses to verify that an individual is who they claim to be, and this provides an opportunity to check and confirm the validity of someone's criminal record, education, employment history, and other activities from their past.

Defense-in-depth:

Defense in depth is a concept used in information security in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system. Its intent is to provide redundancy in the event a security control fails or a vulnerability is exploited that can cover aspects of personnel, procedural, technical and physical security for the duration of the system's life cycle.

Zero trust:

The zero trust security model, also known as zero trust architecture (ZTA), zero trust network architecture or zero trust network access (ZTNA), and sometimes known as perimeterless security, describes an approach to the design and implementation of IT systems.