What is Social Engineering? Security Stories and Training Tips

SecurityMetrics Podcast | 23

What is Social Engineering? Security Stories and Training Tips

People are naturally kind and helpful. Attackers know that, and in the case of social engineering–they rely on it.

Senior Information Security Architect at Lucid, Nathan Cooper (CISSP, Security+) sits down with Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) to discuss the tactics hackers use to attack businesses and how you can protect your company.

Listen to learn:

• The psychological reasons social engineering works so well and how to address them
• Examples from the field–man traps, watering hole attacks, and tailgating
• Tips to make security training effective while maintaining a positive and respectful environment

‍‍

Resources:

Download our Guide to PCI Compliance! - https://www.securitymetrics.com/lp/pci/pci-guide

Download our Guide to HIPAA Compliance! - https://www.securitymetrics.com/lp/hipaa/hipaa-guide‍

‍

‍[Disclaimer] Before implementing any policies or procedures you hear about on this or any other episodes, make sure to talk to your legal department, IT department, and any other department assisting with your data security and compliance efforts.

What is Social Engineering? Security Stories and Training Tips Transcript

Hello, and welcome back to the Security Metrics podcast. I'm Jen Stone. I'm one of the principal security analysts here at Security Metrics. Today, we're going to talk about social engineering, and I'm super stoked to have a security professional and social engineering enthusiast, Nathan Cooper. Nathan is, has spent his last five and a half years working at Lucid Software, which produces an enterprise visualization platform, leading their technical security team. Prior to that, he worked at Novell for about eight years while finishing up his master's of information systems management degree at Brigham Young University.

And he's a long time Utah native and spends a lot of good time with his his wife, four kids, and two dogs at home. Nathan, thank you so much for showing up and doing this podcast with me.

Absolutely. It's a pleasure to be here, Jen. Thank you for having me.

Do you want to tell people a little bit about yourself beyond the very, the bio that I hope I didn't mess up too badly?

No. No. It was perfect. So it was flattering to hear somebody else describe me in that way.

And there were no four letter expletives, so it was even better. So, yeah. So I got into security quite a while ago. I was actually in elementary school when I realized that I could get onto my friends accounts just by watching them type in their passwords. I had a quick eye and they were slow typers, so it led to some early adventures.

Later That's too ill advised.

There are, yeah.

Probably, yes. Yeah. Probably, yes. And I'm sure that were my son or daughter to do the same thing, I would I would give them a very stern reprimand and then pat myself on me.

Yeah. Even secretly in your heart of hearts, you'd be like, yeah. Yeah. Good job.

No. So my my uncle then like sent me a a lock picking set later on in life and you know, I got into some security classes in college and it was just magic.

You know, security is magic.

Mhmm.

I I had someone say to me the other day, this is hard. It's just really hard. And what I explained to them is it's it's not. It's actually not hard. It's it's unfamiliar.

Mhmm.

Security is it it affects all of us, especially the topic we're talking about today, social engineering. And I'm hoping that we give people enough familiarity with it that they don't feel like it's hard anymore. And and another thing is that it applies to everyone and especially to people's people who are not as familiar or comfortable with technology. If you have those people in your life, you can take these concepts and help them, understand them, share them with them. So hopefully, this will be helpful to various people today.

But Oh, I hope so.

Tell us first of all, what is social engineering?

Okay. So you've got normal engineering which is where you apply expertise to a system to cause it to do some sort of function. Right? Social engineering is doing the exact same thing except with people.

Right? And we have tons of social engineers and have had for you know, as long as people have been around. Usually, we call them like psychologists because they are getting you to do things that you would not otherwise do. Right.

And they're using different techniques. So there's a bunch of different, techniques though that bad guys will use in order to get us to do things that would actually harm ourselves Mhmm. That we would not normally do.

So social engineering can either be for good, like my gym coach gets me to do stuff that I don't I can't do that, and he somehow gets me to do it, and it benefits me. Mhmm. But then there's people who do it for malicious reasons and sometimes those are the hackers, those are the people that we're we're gonna maybe talk a little bit about that today so that people know how to protect themselves from it in the cyber world. Right? Mhmm.

Yeah. And so at a at a very base level, very common in almost all social engineering attacks is this idea of pretexting, which is where you are pretending, making up a history that is not real. About yourself, you're pretending to be someone else. You're putting on a disguise of sorts.

And then you apply that and certain other stimuli, pressures, environmental pressures usually, to cause somebody to react in the way that you want them to do. So kind of like, you know, a burning building scenario where people are going to run for their valuables, show you where those are, or they're going to divulge their credit card information to avoid some negative consequence or obtain some positive result.

Okay. Alright. So so it's a a pressure to make, somebody do something that you want them to do or to give you access to something that you wanna have.

Mhmm.

So let's talk about a lot of times when people think social engineering, they're like, this is very, it happens in in in the digital world, but there's a lot of physical techniques that that social engineers can use. Tailgating, for example.

Mhmm.

What can you tell me about tailgating?

So tailgating is about as simple as it goes. And as anybody who ever, like, tried to sneak into a movie can tell you, you know, it can sometimes work out, sometimes not. Really depends on the people that you're working with. It is very simply following somebody who, into a place where you could not otherwise go. So maybe you're pretending like you're a relative of this individual who's going in the door, or you're just standing so close to them that people think you're somehow associated.

It works particularly well if you're tailgating somebody who really wants to avoid confrontation because they're not going to turn around and tell you, hey, you know, six feet back please, Unless, of course, they think you have COVID.

Yeah. Twenty twenty changed over that for us. But but no. Like, people will actually hold the door for other people even when everybody is supposed to badge in.

Mhmm.

And I've I've seen this, personally because people hold the door for me all the time and we have badge readers. Like, so how do we prevent that? Like, what what stops that? Because like you said, there's ways that the individual can maybe go, hey, back off. You cannot come in on under my badge. But we're not really geared for that.

You know, it's totally about training people what is and is not normal. Now, social engineering is super cool because it relies on like three main things.

There's helpfulness, trust, and greed. And, you know, people in a workplace like this are gonna be very helpful. They're, you know, everybody's friendly and they want to help out their coworkers and so they're gonna do things like hold open the door.

But sometimes that works to the detriment of the company or even to the individuals. Like at our company, we we tell people that, hey, if you let somebody in against company policy, then whatever they're doing is, you know, on your head be it. Right. Kind of thing. Don't do it. And so you need to train people what the norm is.

Don't let them establish a norm naturally because they're wonderful and I'm so glad that we're this way. Their kindness is going to produce suboptimal results in this case.

Right. And and I think training is depending on the risk of the training not working.

If it's a high risk situation like data centers, they will have additional protections in place Yeah. To to prevent tailgating even if the people are trained. Well, they don't wanna have to just rely on that. Right?

Mhmm.

So man traps is one of them. And, I know about the man traps personally because usually it's like it it sounds like a really scary term but it's not. It's just where you have to go into one set of doors, that doors has to close, something has to happen, some type of, authorization has to happen before the next set of doors can open. Right?

Mhmm.

Well, I was the the worst man trap I ever experienced was in Singapore. I had to go check out a data center. And in order to go from the front lobby area into the more protected area, you had to go through a man trap, but it was not like a man trap I have ever experienced before. It was like this clear column that you had to step into, and it had the outside would turn. So when it was turned in a certain way, it lined up so that there was entry from one direction and you'd go in and the person on the outside would turn this column and then if they turn it all the way around, then you could exit it into the the secure area. Well, but you had there was no way.

If they decided they just wanted to turn it halfway and walk away, you would be stuck in this tiny little column. Worst, most claustrophobic man trap ever hated it.

And I don't This is awful.

And I don't think everybody needs that either.

Like, that level of of absolute protection against tailgating probably is overkill in a lot of situations.

Oh, yeah. Definitely. That would not fly, that would not fly at my company because it is not worth the risk. Like, all these security controls we're going to talk about, they have a cost.

Right? Sometimes it's actual physical money. Sometimes it is morale. Right. And that can happen. And you know, as wonderful as a man trap may be at preventing things, it's never going to be foolproof.

Like I had a presenter who was telling us about, I think it was a government institution that he was evaluating from a physical pen test perspective.

And he said that they had this really fancy pen test, or this band trap, up in the front of the building.

And he walked into it, and they were showing him around. He it was very, very impressive, but he noticed that there was a lot of large furniture, you know, around the building. And obviously, that furniture didn't come in through the mantrap.

So clearly there was another big, like a loading dock or something.

Uh-huh. Exactly that actually. He went to the loading dock, put on a FedEx hat, and then walked into the building, was able to go through everywhere that he wanted to, and then handed them a report at the front and said here, here's your grade.

It must have been really disheartening for people who if they have to have a man trap, if it has to be that secure and it's so easily breached, then, that's always disheartening for the people who are undergoing that sort of of a test.

I think a a less enforcement type of mantrap would be like turnstiles. Mhmm. Right?

Yeah. So anything that can just cause people to go in through kind of a unified direction and allow you a moment to pause and make sure that people aren't going in two at a time, that kind of thing. Badge readers are good for most companies. Again, they're not perfect.

They're not gonna keep out a determined attacker, but then again most of us are not being faced by determined attackers. A lot of this stuff. It's kind of like fences. They're there to keep good neighbors.

Right? Same thing with a lot of badge readers.

That said, if you are keeping valuables in an accessible location, so you've got like laptops or something, you should be using something else other than just a badge reader probably.

Right.

To keep people from just walking in because it's really easy to get past a badge system. Yeah. Especially if there's people involved.

Right. Because you can tailgate. You can walk around turnstiles. Mhmm.

There are a lot of ways you can get past things, but that's why we talk about defense in-depth.

Yep.

But then again also to your point, if it's not a high risk situation, the morale for really locking down access probably is is a trade off that needs to be considered.

Yeah. Absolutely.

But again, there's a there's a bunch of different things that we can talk about in terms of social engineering. Like there's waterhole attacks.

Mhmm.

So there there's physical waterhole attacks where you know that people congregate and that's outside of the secure zone and you can leave things for them there. Or combine it with tailgating. Go out and find people who have congregated outside of a building and then just walk inside as though you're part of the group. Somebody will probably be holding the door for you.

So when you talk about for this waterhole attack Mhmm.

So basically, it's like out in the wild, the lions wait at the waterhole Mhmm. Because that's where the prey is going to come and then they're gonna get a meal. Right? Yep. So in in terms of a waterhole attack that's the the physical time that thing that you were talking about leaving something there, what kind of a thing would be left in a waterhole attack?

All sorts of things could be there. The most common though would probably be USB devices because this is something that they can then plug into their computer and heavens knows, we are a curious people. I think security experts probably know that better than anyone. And if I have a USB device, I'm gonna use a throwaway machine.

But I'm probably gonna find a way to plug it in somewhere.

But not everybody's gonna be very careful with that. And if that device can then act like a human interface device, like a mouse or a keyboard, and then, you know, execute some commands really quickly or contain, you know, malware laden files on it, that kind of thing. Somebody's probably gonna stumble upon it. Maybe it says, like, confidential on it.

That's Well, now you're gonna get it.

Sometimes not a deterrent.

Yeah. Confidential. That sounds like something I want to see.

I want to see. So this was, like, made very famous in the public eye through the Stuxnet attack, which was against an Iranian nuclear facility.

And they had some engineer who found some USB device around his house and then took it into the facility and plugged it in. It was an air gap situation, so there was no network connectivity in and out.

But somebody carried in a USB drive.

Well, there so a lot of the the organizations that I work with don't allow reading off of a USB drive for that reason. Mhmm. But then it also makes it harder to share pictures of your, like, vacation with everyone.

So, depending on if people need USB for a job related reason, you might lock that down.

Mhmm.

Again, if you lock down too much, it can hit the morale of people. But I think USBs are something that we don't necessarily all need to have in our laptops. And and and the potential to introduce, malware is it can be pretty high.

Yeah. And especially not all the time. Like, we don't we don't need USB all the time. If you're switching laptops, maybe you need to back up things. But again, it might be better to have a cloud solution to do that kind of thing.

Right. So You know, there's also the, the digital type of of a waterhole attack where, let's say an attacker knows that a certain type of person is tends to go to a certain type of website. They're gonna do their best to get to that website, put malicious software on there so that they can then infect usually government, entities to to to breach their their, systems.

And I was reading up on on Waterhole attacks, after you mentioned the Stuxnet one because I love that story. I've heard it on I think Darknet Diaries does a really good verse of it.

The the, types of waterhole attacks are often, state driven. And I mean, it always sounds so, oh, now you're trying to scare everybody.

State entity.

State state entities going after people.

And yet that's one of the ways that they do, is they know that the targets that they have will tend to frequent certain sites. If they can put some malicious code on that site and then have what we call a drive by download, I don't know if all of our listeners knew that, but you can actually, in some situations, just by going to the page, a download happens.

Mhmm.

And so, again, there are technological. There's the training of just don't go to places where that are probably hosting malicious software.

Mhmm.

But also you don't know for sure where that is. Right?

And you may be an engineer who needs to visit a diverse set of websites in order to solve a problem.

Right.

Like the the training and as you said before, the defense in-depth is really key.

Yeah. So there's different things that you can have, like the inability to run an executable might be one, but maybe you need the ability to run an executable. So maybe being told that an executable is being run. So there's lots of different ways technically to address waterhole attacks. And a lot of it depends on the risk level of the organization, what it is they're protecting, the person who's doing the work, where do they need to go, what is their actual risk, what is their actual need.

Mhmm.

And that there's not really a one size fit all for that.

No. Not at all. Which is why it's it's many times dangerous from a security perspective to just go with a all in one package of security and say like, here it is. This is the golden rule of security and this will make you safe. Because half the time it's gonna be either too little security, like it's too permissive, too open, or it's gonna be so secure that it completely stifles your company and you won't have anything valuable to even sell. Right.

So Being able to do business is important.

Yeah.

It's that constant, push pull between security and and IT that we hear about a lot. Can we make this function? Yes. Is security gonna make us not make us function?

And then you get some of those really important discussions on what does security look like based on those needs. So, alright.

Another kind of social engineering that probably everyone has heard about because this is generally what training focuses on for organizations is phishing.

Mhmm.

Tell us about phishing.

So phishing is phenomenal. Phishing and it's got a bunch of other, you know, similar things like phishing. Phishing is where you send an email posing as someone else. So it's where you take technology like email and you add pretexting to it in order to get somebody to do something that they shouldn't. So you're gonna see this everywhere. You open up your spam folder and you're gonna have more phishing emails than you can shake a stick at.

Right.

They're gonna be telling you, hey, we're gonna play off of your greed, and I'm a sergeant in Afghanistan trying to exfiltrate this, you know, hoard of gold, and I need somebody on the outside who can help me. Or a more common like, corporate y type attack is gonna be, hey, I'm the CEO and I need you to really quickly go get some gift cards for me because I want to buy some gift cards for a customer.

So, the Nigerian prince.

Uh-huh.

That's that that greed based phishing scam.

Yep.

I mean, they seem so obvious. Yes. It's like who is going to fall for that obvious of a phishing scam?

So it's a really good question and something that a lot of people bring up and they say that, you know, there's no way that I can get I'm gonna get caught by phishing because these are so obvious. Well there's multiple classifications of phishing, and they have different targets, different target audiences Because let's say that you start to go down the path because it's a fairly clever email, but then you get to the punch line, as it were, where you're supposed to enter in your credentials or something. Or you've been in communication back with this this adversary and they ask you to send a wire order, like some money order, and then you stop. You're like, nope. Never mind. I don't think that this is legitimate. I'm gonna have to do some additional due diligence.

Right.

Every person that does that is money out of the pocket of the adversary because they had to spend time with you.

Oh, okay.

Right? They they were emailing you. They were talking maybe on the phone. And for every person who doesn't follow all the way through to the end, that's money lost in their minds.

Okay.

Whether they're coming out of a malicious call center or they're just as an individual entity, they're trying to maximize their profit. So if it is super obvious upfront and somebody still falls for it, the chances are good they've got them baited to the end.

Okay.

So they're they're purposely making these things dumb and obvious so that they can weed out and really get who their target market is, which are people who really don't understand fishing Mhmm.

And and really don't understand technology, don't understand maybe you're a little credulous, don't know how to protect themselves. Yep. Right. So aside from training, what can we do about those types of situations?

Either let's say in an organization.

Mhmm.

Let's say we're in an organization. We have, a certain we know that a certain set of people are going to call fall for these things no matter what training we do. Do we do we change training? Do we increase training?

Do we do additional layers of protection on the what do you what do you wanna So at the risk of sounding like a broken record, it's security in-depth.

That's almost always the answer. You know, for those of you playing along at home, if your security professor asks, it's probably security in-depth or probably.

So those two things will get you through college. The Yeah.

You really need to have a whole security program set up to cover all of these different components. Training is going to be an absolutely imperative one. I want to talk a little bit more about that later. But you also need to know that there are additional technologies and things that you can implement in order to really help out your organization.

But first, you really need to know what what the attack surface is and what's the potential.

One of the things that that I I just wanted to kinda pause and put a subset of information here is that a lot of the people who are going to fall for things are people for whom technology is not native. So we're talking about our parents, our grandparents, people in our lives who are not as comfortable with where information should come from to be legitimate.

So one of the ones that because it's the beginning of the year, we're talking about, IRS, right, tax scams. Uh-huh. And so, I I hear a lot of people reach out to me and say, is this legitimate? They'll get a phone call saying, your taxes were not paid last year and you are going to go to jail or you're gonna be fined this amount of money. So people are terrified because they think this is real and then they get asked give me your social security number, give me your birth date, give me all of these things. And then, they'll even layer on top of it something like now just to prove to you that I am legitimate, I'm going to send you a four digit code and you give them the four digit code back. Right?

Anytime something that is phishing or in this case, vishing because it's Over the phone.

On the phone.

If they reach out to you and tell you there's a problem, run away from that. That is not legitimate.

Okay? Nobody's gonna call you and say you're going to jail. Oh, by the way, give me your social security number. Alright? That's not real.

So anytime somebody reaches out to you and says, you need to give me private information and you didn't initiate that call, say, I'm going to actually go to your website or call a phone number. You initiate it. Not from anything they give you, but you go do your own research. I'm like, okay, IRS, they seem pretty mad at me.

I'm gonna hang up on this person or I'm gonna ignore this email and I'm gonna go directly to the source and find out from the IRS's site exactly what my status is. And then you can know because you did your own research, not based on anything somebody was trying to scam you out of. This is what I want everybody to go tell their parents and grandparents right now how to avoid this IRS scam because it's bad and it's scary, and they don't need to have to deal with that. So anyway, that's that's one way to deal with a phishing scam is to just hang up and then go to the source, but that takes training.

It does. And that training can be applied positively or negatively. Like, I like to think of there's Baskin Robbins has thirty one flavors. Right? Right. Security training and security programs have thirty one flavors as well. And some of them are really bad and will destroy your company.

Yeah. You I would like to hear more about that. Like what what would you consider good social engineering training or good fishing since we're talking about fishing. What would you think would be good fishing training as opposed to bad fishing training? K. Because the outcome is we want people to change their behaviors because of the training. Right?

Yes.

We want them to not respond to the phishing campaign. So how how do we get that outcome?

So as I said, there's there's good and bad ways. You you asked for both. So let me go with the bad ones first.

I've recently heard several anecdotes about different phishing trainings that various companies had kicked out that I thought were probably, to put it nicely, suboptimal.

In one case, they put out a a an email to all of the employees, not the customers. For the security team, all of the employees are my customer. Right.

Okay.

They put out an email to all of the employees saying, hey, you're fired. You've been fired. Click here to find out information on your severance package.

Well, that's terrifying. Like, right? Yeah. Emotionally charged, you know what? Makes things real successful? When you're in an emotionally charged state because you're not thinking straight. Right?

Mhmm.

And there is there's an argument to be to be made here that well attackers can do that, right? Yes and that is true. Like that is a very good point and attackers will do that. They will put you in an emotionally charged state as you already said the IRS calls you. Yeah. Right? You're already in an emotionally charged state.

But you do not want to put yourself on the bad guy list for your employees.

And making your work environment a toxic place Mhmm.

Is going to do that, you know, a hundred percent of the time. And it's also gonna put you in opposition to, you know, like your business purposes as well. Like if you cause people to flee the company, you're going to have a hard time maintaining a job as well.

What did you train them to do? Leave.

Yes.

Yes. It's very much or or perhaps even worse is if you train them to hide mistakes that they make because you made fun of them or something.

Right.

Like I've been in conversations where, you know, a security professional has just publicly mocked somebody for doing something incorrectly. Mhmm. You know, we're all people. We do funny things. It's just kind of part of our genes.

But if you humiliate someone, the next time, they're probably just gonna hide it. You want to be on the good team. You wanna be the good guys. You wanna be the heroes for your employees and or for your friends if they're asking you the same thing. Sure.

Sure. Don't I mean, if you put someone on blast because they made a mistake, I have a very good friend who reached out to me and said I almost fell for a phishing scam. And she laid it all out for me, the details of how real it felt and and how emotionally charged it was. Man, I can't remember the details right now or I'd share them.

But, and I thought about making a blog post out of that. And then I thought, no. If I do, I need to obscure who this was and and the situation because otherwise, they're not gonna come to me when they're unsure next time. Right?

They're not they're gonna make decisions and and and not not reach out to the professionals if the professionals are just gonna make fun of them.

Yeah. And I mean, that's that's just good advice generally for life. Right? You wanna make friends and influence people, don't be a jerk.

Yeah. Absolutely.

There's your there's your next shirt.

I you know, I like it. It took me a lot of years to figure that one out and sometimes I still mess up. But for the most part, I find that that you can teach people and and influence them if if they believe that you if you were not just if they believe, but if you're truly their friend. If you truly have their best interest in mind, you're not gonna be doing these gotcha type phishing campaigns.

Yes. I mean, we all it happens sometimes without realizing that we're we're testing people unfairly or something. But, for hopefully not in every situation. So so what's a positive way that we can train people?

So give them something that's fairly realistic, real life.

Let them, you know, sink or swim based on that, and then teach them afterwards.

Give them positive reinforcement for making good choices. Good examples of this would be sending out a phishing email that's similar to emails that come to your corporation already. So in my case it would be, Hey, you know, I'm the CEO. As I said earlier, I need your help purchasing these gift cards.

Why don't you write me back on this address, or why don't you text me back on this number? And we can discuss the details. If they write back, if they text back, you know, that first step is a semi fail. Right?

Hopefully that scam is well known enough that you don't fall for it. Like my CEO doesn't do that. He's not he's not reaching out for people to do that, especially not some random salesperson or engineer.

Right.

So give them something realistic and if they do fail, right, don't don't slap your forehead in front of them. Don't don't don't call them out. Don't don't put them on the wall of sheep. Like there's a place for that.

Yeah. That's Defcon. At Defcon, there is that where if you your name gets put up if you, like you leave your wifi on on your phone and somebody pops that device and and, you know, figures out who you are, your name goes up there.

So the but it's a game. Like we all know that that's a game. Doing that to people in a work situation is just extremely uncomfortable and not very educational.

Yeah. Yeah. In fact, early on early on in my career, and I speak as though I'm so ancient in my career, it feels that way sometimes.

I agree we'll do that to you.

It's true.

I've got more gray hairs here than, than I know.

I'm twenty eight.

So I believe it.

I believe. Anyway, I did a phishing campaign that was, you know, completely approved by everyone, but the manager that I was impersonating as part of the phishing campaign did not know. And I talked to him afterwards, and I said, Hey, by the way, this is how this ran down, and I was using your image. I was using your email and your name.

And he told me, he's like, wow. I feel violated. Like, we had a great relationship there. Oh, interesting. But he he brought up the fact that even in this highly controlled situation, he wasn't sure how to process that.

Mhmm.

And so you have to be careful and not abuse people because, again, these are humans. They're not they're not gerbils that you're trying to train. Right. And they will take offense and they've got free will.

So, again, looking back at this defense in-depth concept, it it reminds me of, I have a friend who is an accountant in a bank. Mhmm. And he told me at the beginning of twenty twenty when I don't know if you knew this, but a bunch of lockdowns happened.

People went to work from home.

Oh, is that what happened?

That's what happened. And so he he was one of the people, and a lot of the people in banking industry were working from home, which is a different situation from being in the office.

Uh-huh.

And it leaves a person whenever you have a different set of technologies, a different set of processes, that's a situation where you can be left open to error, and phishing attempts can be more successful. Right? Because if you're in an office and you get an email that says, hey, this is the CEO of the bank or whatever the bank president, and I need you to wire this amount to this group over here.

If you're in the bank, you can be like, hey, Joe. Did you want us to send this money to the I just got this email from you just checking. Right? You can do that.

Mhmm. But you're, you know, at home working and it's all virtual, and it it almost becomes more detached and less real. And so just responding to these things. Or again, could have used an emotionally charged situation.

He said that at the beginning of the year, their, number of phishing attacks against individuals of the company, skyrocketed. It was well over double what they were used to.

Mhmm.

And so, one of the things that, you can put in place in a high risk situation like a bank or or other places where you have some some protected money or information or all of these things.

Mhmm.

Having these processes in place that say one single person cannot react to an order and go take care of it. You can't you can't count the person asking for it and the person executing it as two different people in a high risk situation. You need a third set of eyes or you need a third third way of contacting. So you get an email from the the CEO and then the the next step is you call them at a number you have, not a number from the email that they sent.

So there's a verification step. Right? So having these processes that are well established and in place can help kind of protect people from themselves instead of just getting that mind that mindset of, oh, I have work to do. I'm just gonna get this work done.

Mhmm.

And all of a sudden you've wired sixty million dollars to Venezuela.

Right? So, processes and and checkpoints, I think, are are one way to do it. What are some other ways that that can help protect people like a defense in-depth to some of these phishing campaigns?

So there's also technical, there's technical means that you can apply.

One great thing that everybody should be doing, and again it it can be complicated so we're not gonna cover it too much, but you need to have some of the security settings on your domain like DKIM, SPF, and DMARC. Oh, you just scarecrow. All sorts of things.

So these are these are three technologies that have been put in place so that you can validate where an email is coming from and whether or not it's authorized and the email provider, like your Gmail's or your Outlook's or you know, whatever you've got, They will read that information and say, oh, this email passes the sniff test. Therefore, I'm gonna let it go through. This email does not. Like it says that it's coming from, you know, good guy dot com, but you know the IP address that it came from doesn't match any of those in our list. We're going to throw it into spam or we're gonna flag it as potentially dangerous.

Right.

So those technologies you can throw in place and it will reduce a lot of the very low level phishing that you would get on your domain.

Right.

Right. So for example, we we don't really get emails coming from, you know, our CEO at at lucidchart dot com.

Mhmm.

Instead, they're coming from, you know, my my spammy spammy place dot com, and it'll be like, you know, CEO at spammy place.

Right.

And then, you know, your email provider gets it and says, hey, this this doesn't look quite right.

We don't let through stuff from spammy place, so not gonna let that one go.

Yeah. Not gonna let it through or I'm gonna flag it as dangerous. On top of that, you can you can add in a custom gateway, which is kinda like a bodyguard or, a bouncer, maybe a better image.

A bouncer for your email service, and as emails come in it's a secondary check to say I've been seeing a lot of emails that look like you and I know that those were bad so I'm not gonna let you in sorry yeah or I'm gonna put you in a quarantine maybe a man trap Right.

Transparent tube, and have somebody else come in and observe and see if you're legitimate.

Right.

So So, another one that I, I like a lot is, well, there's ways that you can prevent clicking on links within emails. There are definitely technical Mhmm.

Solutions for that. And if that's an option, that's a a really good thing to do or specific types of, attachments. Some attachments are more prone to security issues than others.

And so depending on on who you are in an organization, you might not need to get certain types of of, attachments.

And then there's also some of these password managers Mhmm.

Where if you go to put in your password, they recognize whether that's the legitimate site or whether it's one that to your eye looks like it, but actually there's an I there instead of a l. No. And they look really, really similar but they're not the same. Right? So so something like a password manager can help control whether you're actually entering credentials into the correct place or not.

Mhmm. And I I hundred percent espouse that. I think that password managers are necessary for not just corporate type settings, but honestly, I mean, everybody in my opinion Yeah. Should be intelligently using password managers.

You know, I knew I was in love when I gave my master password manager password to my now husband.

Uh-huh. That's a lot of that's a lot of trust.

That's a lot of trust. Now I recommend this to to people who especially people who have, parents and grandparents who are uncomfortable with technology.

Get them a password manager. Set it up for them. Make sure that you help manage it with them. That way they're easily able to log into things and you can help them as as one of the, kind of admins on that password manager account. You can help them to log into things securely and into the right places where they don't have to write the the passwords down. They can actually have it taken care of for them. And they're not that expensive.

Yeah. And so much of what we've talked about has revolved around the idea of making it really easy to do the right thing. You talked about establishing, you know, processes and providing training, that kind of thing because you want to make it you want to make that golden path just be absolutely guardrailed so that it's difficult to jump off the side.

Absolutely.

Yep.

So we've covered a lot of really great things about phishing. You mentioned vishing and we sort of said that's voice phishing.

Mhmm.

So phishing typically comes through email. Vishing usually comes through some kind of a phone line.

Smishing, I hate that word so much, is a text that you get, like an SMX that that comes through, with fishing. My favorite is I've got some guy named Sanchez who has been sending me not very much information. He's going for the curiosity factor. Like, it'll be like, hey. This is Sanchez, and then all of these little emojis and a link. I'm like, not gonna do it.

So, so there are curiosity ones. There are oh, another one that I've been getting recently is we have unclaimed money for you. Click here to find out. Again, it's that greed thing that you were talking about.

Let's see what else. Oh, you have been exposed to COVID.

Click here to learn more. That's just rude.

Yeah. It it really bugs me when when an adversary will take advantage of, you know, somewhat devastating events.

Like, as there are people who will comb obituaries Yeah.

To find victims. Mhmm. And like that kind of thing, that that's one of the other things that really drove me into security is I wanted to stop the people who would do this Mhmm. To other people.

Yeah. No. I agree.

It's and it's hard to to recognize all of them right away, but I think there are some some basic principles and we touched them on them a little bit earlier. Mhmm. If something makes you go, oh, I could get money or oh, no. I'm in trouble.

Mhmm.

Or I am so angry right now. If you get some kind of unsolicited email or text or phone call that makes you feel a thing, you're gonna make really bad decisions. Right? So the the first thing that you should do is go set that aside so you don't feel the thing and then you can rationally deal with it in a minute. Right?

Yeah. So set set it aside and then look at the authority, Like, try and establish the authority. You mentioned before, like, the IRS calls you and says that you have back taxes. You're gonna go to jail.

Right? Very, very common. And it happens over email. It happens over over voice. It happens over SMS.

You need to, again, set it aside, and then go to the IRS website, not whatever, you know, link that they tried to give you in that. So go to the actual authoritative source and get your information from there. Call a phone number from there. You can get to customer support.

Also, a good thing to note, if it's the IRS and you call back and they answer immediately, it's probably not the IRS because my understanding is you'll probably be on on hold for For a very long time.

An hour or an hour and a half.

Very long time. Also, if it's the IRS calling and saying we're gonna put you in jail, it's not the IRS.

They want you out working so you can pay off those back taxes.

Right.

Right? There are a lot of steps between, hey you didn't pay and oh you're going to jail.

Lots of steps.

And one of the other steps that you had actually touched on earlier that I wanna make mention again is we've got we all have people that we know and can trust who have a little bit of security experience. Like, there's enough of us out in in the world, in the industry that you can afford to go ask them.

Right.

And, you know, sometimes it might be a little bit uncomfortable. Maybe you're gonna be embarrassed, but that's gonna be way better than you falling for one of these attacks and becoming extremely uncomfortable and extremely embarrassed.

Right. And and try to be patient with us if the first response we have is to laugh because I mean, look, kind of socially awkward. Right?

Mhmm.

It's the security industry.

It's kind of we don't always have the best responses.

Just keep that in mind. So we've we've come up with some several, like security PSAs so far. Are there any that you can think of that that we've missed that we wanted to tell people, hey, keep this, keep this in mind?

As far as things that, I would want you to keep in mind would be, especially if you're in a security position for, like, a company or for other people, keep in mind that you are trying to help them not just for the corporate ends. Like, a good company wants to promote its employees, help them become better, help them to become more safe.

Mhmm.

So don't just focus on the, Hey, you need to update your Windows machines, or, You need to run these patches right now, and make sure you do that ASAP.

But also allow security PSAs to go for things like your iOS devices, your personal devices. They might be vulnerable as well.

Yeah. Also, heads up.

It is tax season, so make sure that you keep an eye out for, you know, x y and z attacks Right.

Personally because they'll come for you.

Yeah. Because you don't want your employees stressed out Yeah. Because they got attacked and suddenly they're dealing with, you know, having their identity stolen or or money or, you know, whatever it is.

Do you know what? Some of the people who listen to this show are also kind of new to security. They are security professionals.

Mhmm.

But, I know for myself when I first started into security, what I noticed was that if you ask help and you're a security professional, there's a lot of pressure on you to, like, not ask for help. Right?

Because it it feels like everybody's going to judge you Uh-huh.

Or, make fun of you, you know, like that whole the the fear of I guess, there's so much to know as a security professional that the whole, imposter syndrome thing hits us hard anyway.

Mhmm.

And then we have to go, I don't understand this one thing. What can we do though to to kind of broaden that conversation and get the help we need, not just as as new security professionals, but as any security professional trying to understand more?

Well, one of the big things that you wanna do is understand that everybody else is in the same boat. Even if they've been in security for fifty years and, you know, they're very much the top dog in terms of knowledge, They don't know everything.

Right.

And you're not gonna know everything. I certainly don't know everything. Yeah.

Even any even in a fairly concentrated subject like social engineering, you need to ask for help, and don't be shy because everybody's been there. Nobody started at fifty years of experience. Right. Right? And, you know, most of us, I think, in the community are very happy to pay it forward because we've all received help.

Right.

And if you are willing to tell somebody at your office or your friends and say, hold on. I don't actually know the answer to that right now, but I think I can find somebody who will and I'll get back to you. What you've done is you've essentially opened the door for them even wider to come and ask for help later on.

Right.

Because you've you've shown a good example. You've said it's safe Mhmm.

To say I don't know and ask for help.

Yeah. Well, before we wrap it up today, is there anything we missed on the I'm there is a lot that we have missed on social engineering. We can't bring it all into a single conversation. But was there anything else you wanted to touch on before we closed?

Just this. Again, don't don't be embarrassed if if you feel like you can't handle the whole security program all at once. Nobody can. It's it's the eating an elephant principle.

You need to start someplace and start to work out to make the program better. You're trying to do this defense in-depth, and you never you don't build all the walls in a castle at the same time. You don't you start with the core and then you build outwards a piece at a time And it's not gonna be perfect and that's okay. Just try to do what you think is the most important first.

Right. So taking that risk based approach we were talking about earlier, if if you've done a risk assessment, you know what your priority what's the highest risk? See if you can put priority there. Or as you mentioned earlier as well, what is that low hanging fruit? So maybe highest risk, low hanging fruit, you've got the beginning of the security program.

Yep.

Right. Well, Well, thank you so much for joining me today.

Mhmm. Thank you.

Everyone, thank you all for listening. I hope that you have learned, a little more something about social engineering.

Again, this is the Security Metrics podcast, and we'll see you next time. Thanks for watching. To watch more episodes of Security Metrics podcast, click on the box on the left. If you prefer to listen to this podcast, it's available on all your favorite podcast platforms. See you on the slopes.

‍

‍