Glossary term
Social Engineering
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Social engineering is the manipulation of people, through deception, pressure or trust, into handing over information, access or money that they would not otherwise give to an attacker.
Explanation
Instead of breaking technical defences, the attacker persuades a person to open the door. Common forms are phishing emails, vishing (phone calls), smishing (text messages), pretexting (a made-up story, such as posing as IT support), baiting (leaving an infected USB stick), tailgating into a building, and impersonating an executive to request an urgent payment. Attackers research targets through social media and company websites to make the story convincing, and use urgency, authority, fear or helpfulness to rush the victim. Deepfake voice and video now make impersonation more convincing. Defences combine awareness training and simulated phishing with process controls that do not rely on spotting the trick, such as call-back verification for payment changes and multi-factor authentication. People are often easier to approach than systems, so attackers try the human route first when the technical one is well defended.
Example
A finance clerk receives a call from someone claiming to be the chief financial officer's assistant, who says an urgent confidential payment must go out today and asks that normal approvals be skipped. The clerk recalls her training, hangs up and phones the executive on a known number. The request proves false and is reported to security.
Not to be confused with
- Phishing
- Phishing is one form of social engineering, delivered by deceptive messages; the wider term also covers calls, in-person tricks and impersonation.