How can you avoid the influence tactics of social engineers?

One of the worst advice you can give to people, and we still do so, is to say: "Think before your click." Why? 1. It assumes people are unintelligent and don't think. It can create a sense of defensiveness or people won't take it seriously. 2. When people feel stressed, overwhelm or pressure, the brain's primary job is to survive, not to think. Scammers know this and evoke emotions of fear, anxiety, urgency and stress. 3. The opposite is also true, positive emotions lower our defense mechanism so we automatically think less and feel more. Think about the phishing emails where they play on the Fear of Missing Out or promising a Job. Assume people think before they click, but help them develop emotional awareness instead.

Recognizing phishing emails is crucial for safeguarding your data. According to the 2023 Verizon Data Breach Investigations Report, phishing remains one of the top threats. Always scrutinize the sender's address, language, and urgency of emails. For instance, unexpected requests for sensitive information should raise red flags. Verify through a different channel if in doubt. How do you educate your team on recognizing and handling phishing attempts?

This is one of the biggest dilemmas society faces. Numerous psychology studies show that group think and act prevails. How many times do you see people act out of the ordinary or different than the rest? Only in spaces where their rebellion side is celebrated. In most cases, people are thought to fit in. The other challenge is emotional embarrassment. What if they are wrong for resisting pressure? What if they are judged for being the only one that is questioning authority, which is critical for preventing CEO frauds? These are root-cause questions that need to be addressed and understood in order to equip people with emotional resilience skills.

Social engineers masterfully exploit social pressure to manipulate victims. Recognizing these tactics is essential. For instance, tactics like flattery, intimidation, or social proof can cloud your judgment. As highlighted by the FBI, awareness and confidence in saying "no" are your best defenses. Always trust your instincts and question unsolicited offers or demands. Have you ever encountered such manipulation tactics, and how did you handle it?

Impersonation is a common tactic in social engineering, making verification vital. Always confirm identities and authority by asking for proof and double-checking credentials. Spoofing can be deceptive; ensure email addresses, phone numbers, and websites are genuine. As per Cybersecurity and Infrastructure Security Agency (CISA), contacting organizations directly using trusted channels is crucial. Have you ever had to verify someone's identity to prevent a potential scam?

This is also easier said than done. Because verifying and identifying requires to be in a reflective state of mind, where we feel neutral to moderate positive emotions and our focus levels are on point. But often we are in reactive mode because of life, responsibilities, mood, workload and other activities that create stress in our minds and bodies. Understanding people's mood and how they impact cyber risk is key to finding a sustainable solution to reduce falling prey to social engineering attacks.

Protecting your personal and professional information is crucial in the fight against social engineering. Cybercriminals often exploit information to manipulate or harm individuals. According to the Identity Theft Resource Center, safeguarding sensitive data through strong passwords, encryption, and cautious sharing practices can significantly reduce risks. Additionally, shredding documents with personal information before disposal adds an extra layer of security. Have you implemented specific strategies to protect your information from potential social engineers?

My colleagues often contact me when a phish is spotted in someone's mailbox. In addition to talking about authority, urgency and social proof (my 3 favourite principles of social engineering), I invite the recipient of the phish to think about what technique might work on them. They were too smart to blindly obey authority or too cool-headed to URGENTLY open an excel file, but what would get them? We are all different and have our idiosyncrasies. My hope is that this exercise would make people more attentive. A thing I might start adding to my mini lecture that the number one defence against social engineering is good sleep.

Education is key to countering evolving social engineering tactics. Staying informed about the latest threats and participating in security awareness training can empower you and those around you. The Cybersecurity & Infrastructure Security Agency (CISA) emphasizes the importance of continuous learning in recognizing and mitigating risks. Sharing knowledge with colleagues and loved ones fosters a culture of security awareness, making everyone less vulnerable. What resources do you recommend for staying updated on cybersecurity best practices?

Don't let the rush dictate your decisions! It's a common trick for social engineers to push you into hasty choices by creating a false sense of urgency. Instead, take a step back, breathe, and give yourself the time to think things through. Especially when money or sensitive information is involved, a little extra caution goes a long way in keeping you safe.

In addition to protecting personal information and education, fostering a security-first culture is vital. Encourage open discussions about cybersecurity concerns within your organization to promote vigilance. Sharing real-life stories of social engineering attempts can help illustrate risks and motivate proactive behavior. As the FBI reports, awareness and communication are key in preventing incidents. What initiatives or practices has your organization implemented to promote a security-conscious environment?