Social engineering: What you need to know

Organizations that operate in one of the 16 sectors designated as part of critical infrastructure by the US Cybersecurity and Infrastructure Security Agency (CISA) should be especially concerned. That designation means that the organization faces a specific set of requirements, which include disciplined cybersecurity practices. It also implies that organizations in those sectors may be particularly attractive targets, particularly for ideologically motivated attackers.

Which individuals should be concerned?

Everyone employed by an organization in any capacity, internally or externally, as well as anyone doing business with an organization, should be concerned about social engineering. That is especially (but not only) true of individuals with access to an organization’s systems. Anyone whose personal and work information is exposed online, whether it be on social media, data broker sites, breach repositories, corporate or personal websites, or elsewhere, is vulnerable since the fuel for a social engineering campaign against them is already available to an attacker. 

Senior executives, board members, and key clients, customers, and investors of an organization should be especially concerned. Those individuals, (known as “whales” to attackers), are often impersonated by cyber criminals to obtain sensitive information from targets based on the senior person’s position and authority. Also, because attackers often focus on wealthy individuals and their assets and those of their families, senior leaders can be attractive targets apart from their role in an organization.

Ultimately, no one is immune to social engineering. Even the most wary employees, even professional social engineers and security specialists, have been successfully tricked by a clever scam crafted from their own data. While cybercriminals may not be “smarter” than their targets, they are engaged in cybercrime full-time. That makes them as expert and sophisticated in their chosen field as legitimate professionals are in theirs.

Why do current solutions fail to stop attacks? 

Traditional “moat-and-fortress” defenses don’t work against social engineering because the technique is designed to overcome those defenses. Hardened infrastructure is easily bypassed if an attacker can successfully trick an employee into granting access. Moreover, social engineers use data on the targeted person—and often on a party trusted by that person—to craft approaches that will appeal to, and convince that specific person, and this data lies outside the control of conventional cybersecurity.

The organization and its cyber security staff are not really in a position to address “the weakest link” in the defense against social engineering attacks—the individual. Attackers target and approach individuals when they are either on or off the job or on their company-issued or personal devices. And they do this based on information on that individual that’s “out there” in cyberspace.

Cyber security professionals have very little control over either the individual or the publicly available or easily accessible information on the individual, particularly compared with the control they have over the internal IT environment. Indeed, that is exactly why social engineering is utilized and why it is so effective.

Most organizations rely on training employees to recognize attempted social engineering attacks. They also work to create awareness about these attacks in general, as well as awareness of specific new attacks. For example, the cyber security staff will flag suspicious emails that are going around and warn employees not to click on links or open attachments. These efforts can extend to customers, suppliers, and other parties, but often do not.

While training and awareness are a part of a good defense against these attacks, they are only part of that defense—and, historically, not wholly successful. In-person and video training may be informative, but often fails to engage people intensely and personally enough. Training also has a decay factor, particularly if done only during onboarding with occasional updates or refreshers. And pointing out suspect emails or scams generally occurs after those emails have done damage. Further, while cyber security professionals work hard to keep everyone informed and aware, they are notoriously busy making system improvements, implementing special projects, and responding to incidents and breaches.

How should you evaluate potential solutions?

Any potential solution for improving the organization’s defense against socially engineered attacks should address the root cause—the information that attackers use to select their targets and design their approaches. That’s because personal information enables socially engineered attacks.

The solution should also engage individuals who could be targeted and keep them engaged in an ongoing, easy-to-use manner. That would address the major shortcoming of training, which should remain in the mix, but not be the major defense against these attacks.

A tech-based solution to this human-behavior problem would be ideal. The technology solution should address the root cause, not rely on attempts to “screen” emails or texts, and readily integrate with existing IT systems.

The solution should also respect the individual’s privacy and autonomy. An organization in a free society cannot “control” an employee’s or other party’s available information or online and social media behavior. Yet it can definitely provide support for practices that lower the individual’s exposure as a target of organizational and personal attacks.

The solution should also be easy for the cyber security staff to understand, implement, maintain, and communicate throughout the organization. As noted, cyber security staff have their hands full as it is, and no solution that fails the ease-of-integration, ease-of-use test will be practical and sustainable.

In sum, the solution should address the root cause, be engaging and tech-based, respect individual privacy, and be easy for security staff to deploy and maintain.

Of course, the solution should also be effective in reducing or eliminating social engineering attacks on the organization and its stakeholders.

How Picnic works and why it’s different

The first technology platform capable of addressing the social engineering problem holistically and at its source was created recently by a team of specialists with backgrounds in human intelligence, mathematics, and engineering, whose company name is Picnic. The name Picnic is derived from an old IT security acronym that stands for ‘problem in chair, not in computer.’ Since social engineering targets people in order to bypass technical controls, the company based its name on this saying but has reframed it with a positive spin as ‘Protection in the Chair, Not in the Computer.’

Picnic’s platform works by emulating the way an attacker conducts reconnaissance on the publicly available data of companies and their people, exposing and flagging the information that an attacker would likely use in a social engineering attack, and providing users with the capability to either remove or neutralize that information. If any employees in an organization have exposed credentials on dark web for instance, or have a digital footprint that is attractive to social engineers, or are otherwise high-value targets for social engineers, Picnic’s technology automatically recognizes this and includes built-in tools to remediate and reduce a company’s social engineering risk at scale.

SANS FIRST LOOK WHITEPAPER ON PICNIC

Jeff Lomas of SANS discusses the importance of knowing your attack surface from the outside in and how Picnic can help organizations tackle the largest problem in cybersecurity—social engineering.

DOWNLOAD WHITEPAPER

To protect individual privacy, the platform consists of two applications that work together. One of these is called ‘Command Center’ and is used by enterprise security teams, while the other is an employee-facing personal dashboard called CheckUp. The way the platform is set up allows security teams to know where their company’s social engineering risk resides and to take remedial actions without viewing any sensitive non-public personal information of employees. 

It is the employees themselves who actually see and manage their own exposure through their own personal dashboard. In contrast to traditional awareness training, employees using CheckUp can see the very real and specific risks that their exposed information poses to them personally, and by extension their company. They are also provided with active learning on cyber hygiene best practices and the technological means to reduce their social engineering risk by controlling their digital footprint. 

What makes this application particularly engaging for employees is that it gives them visibility and control over their digital footprint that was not possible before and protection against social engineering that extends across the work/home boundary. Employees can even broaden their protection to their households with family invites. Moreover, since online data exposure changes constantly, the CheckUp application continuously monitors users’ footprints for any changes and alerts them of new risks. Importantly, Picnic’s platform also passes the ease of use criterion necessary for a viable solution to the social engineering problem, as this customer story illustrates.

Ultimately Picnic’s solution works to combat social engineering by treating the public data of an organization and its people just like a social engineer does—as a human attack surface with vulnerabilities to exploit. In providing companies with the capabilities to see and eliminate their public data vulnerabilities proactively, Picnic delivers a verifiable reduction in an organization’s human attack surface and with it a dramatically reduced social engineering risk.