Social Engineering

Abstract

This chapter will present a detailed view of social engineering and why it is important for users to beware of hackers using this technique. What social engineering is, what techniques can be employed by social engineers and what kinds of information can be gathered by these techniques will form the core of the chapter. We will also present case studies of notorious social engineers such as Kevin Mitnick. Different modes of social engineering attacks will be described. Such attacks could occur in person, via the telephone, or via the Internet. An in depth presentation of the consequences of a successful social engineering attack will be presented. A series of steps users can take in order to avoid becoming a victim of the social engineer are explored, along with examples. We will also present strategies for training employees and users so that there is minimal risk of a successful social engineering attack. Finally, we caution against ignoring the training and awareness program for front-line employees such as secretaries. Since social engineers often try to bypass front-line employees, there is a critical need to train frontliners to recognize and repel such attacks.