Social engineering in the context of information security is the practice of psychologically manipulating a target with the aim of pushing them to disclose sensitive information, or to take actions that endanger an information system (IS), or else that endanger a target’s personal data, based on several human traits such as forgetfulness, greed, impatience or, of course, trust.

But if social engineering is the hacking of humans, what will be the real impact on IS security?

In that case, are there means of protection? Firewalls for humans?

Social engineering or people hacking has always been a prime entry point for cybercriminals since it does not necessarily require advanced technical IT skills but rather knowledge of psychology and even sociology. 

Attacks based on social engineering generally start with a simple email, phone call or SMS. There are also more advanced methods such as “Bad USB” or malicious USB keys. 

Some attacks even take place through direct contact with the victim. Thus, the hacker selects their victims based on a pre-established list of criteria. The attack is carried out by creating a bond of trust, a sharing of gains with the victim or under threat and blackmail to push them to disclose passwords or information on the security solutions used. It also happens, in some cases, that the victim is invited to click on a link or an image that contains a Trojan horse or other malware. 

The reason social engineering attacks have such an impact on information security is that they are part of targeted attacks, which are often silent crises that directly affect data confidentiality without calling into question the visible operation of the IS. These crises are hard to materialize and to handle definitively. 

In this kind of crisis, the Human being is the weak link of the system, which no security device takes into account to prevent attacks. 

Now that we know what is likely to happen, how do we protect ourselves?

From an IS security point of view, there is nothing better than vigilance! Only user training and awareness are the keys to the fight. To be effective, actions must go beyond posters on the company’s walls or sending emails about digital security issues. In order to reach the greatest number of employees and make them aware of this subject, the best approach is to plan training sessions illustrating different attack scenarios, including the intervention of real hackers who can give users an idea of cybercriminals’ state of mind and the way they operate, but above all showing users the good practices to ensure data security in general.

Several online training courses are already available, such as the SecNumacadémie MOOC which was produced by the experts of the Agence nationale de la sécurité des systèmes d’information (ANSSI). It provides an awareness scheme related to cybercrime threats.

In addition, many training organizations, like Numeryx University have oriented their training curriculum around cybersecurity.

With this perspective, every company will have a team of cyber defenders, a whole army of vigilant users capable of detecting cyberattacks: an additional layer to its security policy!