How can you identify and mitigate risks from social engineering attacks?

Social engineering attacks trick people into revealing sensitive information. To identify them, be alert for unusual requests, especially those seeking personal or company data. Double-check identities and verify unusual instructions via a known contact method. To mitigate risks, educate yourself and your team about these tactics. Use strong, unique passwords and enable two-factor authentication. Regularly update your software and back up important data. Also, be skeptical of unsolicited contact, even if it appears legitimate. Remember, staying informed and cautious is key!

With Ai in place and with Deepfakes, the attackers may not be in front. Again, key thing about understanding the attackers is, how strong is your defense. Hence, any social engineering feeds off your lack of presence of mind and your needs ( emotional, tangible, etc.). So, to understand your attacker, you need to be careful in terms of what they know about you and how they can manipulate you.

Assessing/Managing/Governing an Organisations cyber risk profile (TxEVxBI+Remediation) on a continual basis, is essential to aligning holistic resources where they will most reduce the risk. In relation to phishing, human nature combined with the return on investment from attacker activity and continuous evolvement of available tools (e.g. Deep Fake, Gen Ai capabilities), is resulting in this remaining a popular method to gain initial access. Successful awareness programs require content that is meaningful to recipients, and provides 'stickiness'. When people can relate to it or find it really interesting, there is a greater chance of remembering/applying it, and in turn embedding it as part of their standard practices.

Identifying the motives and methods of potential attackers is crucial for preventing social engineering attacks. Whether driven by financial gain, espionage, sabotage, or revenge, understanding their techniques like persuasion, deception, intimidation, or impersonation helps anticipate actions and fortify defenses.

It starts with the users, it isn't sufficient to train, its about education. You can train folk in what not to do, how to avoid the threats, but it's instilling the commitment, attitude and motivation in those that may by their actions compromise the systems to use the understanding they have received during training to move to next level and "buy in" to consistently act in a risk averse manner.

The social dynamics has changed drastically over the last couple of years. More is being said online than offline. But people mindsets are still stuck in the years before this boom. A lot of awareness is required to make them conscious of the dangers of the risks in the online world. From leaked informations to ransom attacks people are more gullible today than before. Organizations need to invest in scenario based trainings to improve cyber awareness of their organizations.

Best training techniques include honey potting or mystery phishing attacks to check whether staff members are lured into clicking on suspicious links. Internally and deliberately designed social engineering attacks train the staff quickly and they appreciate the value of ignoring unsolicited links. Further, mystery phishing attacks may include not only e-mails but all other communication points such as whatsapp, telegram, smart devices, hand sets, etc.

La formation du personnel est essentielle pour prévenir les attaques d’ingénierie sociale. Les attaquants utilisent des techniques sophistiquées pour tromper les utilisateurs et obtenir des informations confidentielles. Ils peuvent se faire passer pour des personnes de confiance ou utiliser des tactiques de manipulation pour inciter les utilisateurs à divulguer des informations. Il est important de comprendre les techniques utilisées par les attaquants pour pouvoir les identifier et les contrer. Les employés doivent être conscients des risques et savoir comment identifier les tentatives d’attaque. La formation doit être régulière et adaptée aux besoins de chaque employé.

Awareness is the key. Ensuring your staff are trained to be aware and vigilant. Finding time to understand your team and their perspectives and drive but most of all their alignment to the business to ensure this is minimised .

Train in a different way. If they fail, just let them clear it is like driving without the seatbelt. Or make them invite the department to a coffee (when affect their pocket, they usually learn it in the hard way and pay more attention). Train in a way not only to watch a video, in a way that may win rewards or loose something.

Implementing robust security policies is crucial. Enforce strict access controls and authentication measures. Develop policies for data handling, including sensitive information. Establish clear communication protocols, emphasizing verification procedures for requests involving financial or confidential data. Regularly update policies to address emerging threats and ensure compliance with industry standards.

Craft security protocols that allow your staff access to information, but reinforce the Do Not respond directly to unsolicited emails.

Implement multi-factor authentication across systems and applications to add an extra layer of security, reducing the risk of unauthorized access through manipulation or deception. Regularly update for strong password policies. Foster a culture of skepticism and awareness, encouraging employees to verify the identity of unexpected communication and to report.

Most important to have a two signature approach on any expenses and allow expenses only with appropriate invoicing and have a strict control of expenses outside of the country

Implement security policies by defining clear guidelines, communicating them effectively, enforcing access controls, and conducting regular reviews.

In order to be effectively mitigated, social engineering risks, like all risks, need to be known and, as far as possible, typified and listed in a systematic way. Knowing the risks allows to assign them a value, based on which monitoring activities and related actions can be calibrated and prioritized. In a nutshell, the assessment phase is always crucial: subsequent to the collection of the existing information and propaedeutic to all subsequent activities.

Risk assessment is key in tackling any threats including social engineering. Identify your organization's pain points , vulnerabilities, threats, and potential attack vectors, focusing on high-risk assets which is susceptible to social engineering. Prioritize these asset-threat pairs for mitigation. Training employees is vital. Through regular awareness programs and simulations, they can better detect and respond to attacks. In addition, Develop security policies for managing to enforce the controls. Also, Use technological defenses as well, This integrated strategy, blending organizational, human, and technical measures, is essential in countering social engineering challenges effectively.

The Risk assessment should be based on real identified behaviours of the people instead of the wild imagination of folks :-) Best way is to use AI driven tools to understand the different risk profiles of the employees

Social engineering is very different and unique in a way that it not only involves the traditional methods to gain control through illegitimate means, but also involve human factor like sentiments, trust etc. Secondly, the likelihood and impact of these risks is difficult to assess because of the ever evolving nature of the social engineering methods, and their probable impacts. Hence to conduct assessment of Social Engineering risks, the assessor must be well versed with ever evolving technologies and their uses in illegitimate ways. This will help the assessor take preemptive approach by identifying the likelihood and resulting impacts, in alignment with underlying knowledge based assumptions.

In addition to conducting risk assessments, a disaster recovery test will also go a long way in mitigating and also planning such risk. This will give a strategic drive towards preventing it.

When sh*t hits the fan, you don't want to be sitting downwind. Having a backup plan in case of cyberattack or ransomware is key. Otherwise, your business may be rendered inoperable for days, weeks, or months -- while you're forced to pony up an incredible sum to pay the ransom or purchase new equipment. It's definitely worth investing in a cyber insurance policy to help mitigate that risk.

let me remind you of the Case Study: "Sony Pictures Cyberattack" Sony Pictures faced a severe cyberattack in 2014, leading to data leaks and service disruptions. A well-prepared contingency plan could have minimized the fallout by ensuring a swift and coordinated response. This incident highlights the necessity of having robust incident response strategies. In my experience, Active involvement in creating and testing incident response plans provided firsthand insights into the importance of preparedness. Conducting simulated drills enhanced our team's readiness to handle unforeseen security incidents.

Organizations should begin by defining roles, responsibilities, and communication channels during an incident. Next, establish protocols for isolating affected systems, informing stakeholders, and coordinating with law enforcement if necessary. It is crucial to create comprehensive contingency plans to respond swiftly in the event of a social engineering attack.

Building resilience against social engineering includes developing robust contingency plans. A well-defined playbook detailing staff roles, incident containment steps, operational restoration tools, and communication channels is paramount. Regular testing and updates ensure the plan’s effectiveness and relevance, empowering your organization to respond and recover swiftly in the face of a breach. In the dynamic landscape of cybersecurity, preparedness is a key asset.

Contingency planning aids in having a Business and Operational continuity minimizing system downtime. Contingency planning also allows to work around issues , Process and systems that may be affected. A backup data system is just an example of contingency planning where the core data system is affected, Having multiple Vendors for a core process is another example. This is based on a proper review of risk mitigation and contingency planning.

One thing many neglect when leaning from incidents is to look at what happens before the incident. To often the focus is on the incident and not the details that could have indicated it was about to occur. These are the "tells" from the customer that many institutions either don't know they exist or how to interpret. Besides the actual incident what did the customer do different? Excessive log ins, calls to VRU or agent, inquires on limits etc. We need to evaluate their behaviors, after all this is a manipulation of behavior at its root cause. To get a customer to do something they would not normally do. So look for standard behaviors, not just transaction patterns. If you rely on transactions, you got beat and have learned nothing.

Do not only learn from the incidents, but build herd immunity. Where one falls the other can spot and report. We will never be strong as individuals, but we will always be strong as communities.

Social engineering attacks often learns to negative 'moments of truth' (ask Optus or Medibank). Now, what you do in those moments is crucial. And, what you do after is ever more critical, because it governs what you will do the next, and there will be a next time.

In my consultancy projects to improve internal controls and review risks, we still find several processes that are controlled by people and that could be computerized. Systems considered worldwide, complete solutions for the core of companies, still require segregation of activities between people to guarantee their efficiency.

Logging learnings and sharing widely is key. There must be public dissemination of incident types in the firm so everyone can learn.

Social engineering is targeted towards humans, which generally is a weaker link when layered with emotions within in the risk mitigation gamut. Fortifying the human element is key in enhancing the overall risk management mechanism against social engineering. 1. Culture plays a key role. Organisation values, beliefs and approch to social engineering and mitigation set the tone for the entire organisation. 2. Tone at the top on creating awareness around social engineering attack and the organisation response determines its preparedness. 3. Engagement with employees to create awareness, prepare them for attacks and response enhances the success of risk mitigation 4. Knowledge on emerging modes, methods of attack and being prepared is key

Create a universal SOP for mitigating risk from social engineering attacks and share it with all employee members with access to sensitive data or platforms requiring passwords and other credentials. Ensure that your risk and intelligence team updates that SOP as needed so that everyone knows the best cyber hygiene practices.

C’est ce que Proofpoint a nommé les VAP (Very Attackef Person) en créant ce terme. Et n’empêche que quelque soit le terme qu’on lui donne, c’est un très bon KRI a remonté en présentation ComEx.

Additional point to consider is to create culture of understanding social engineering attacks from top to bottom. It could be done via regular discussion among Directors/higher management and be a sharing session in employees meeting. Having frequent talks and communications will elevate awareness and understanding of employees and management on this topic.

Identifier les collaborateurs à risque, c’est à dire ceux qui sont susceptibles d’être ciblés par une attaque. Créer des cercles de confiance en fonction des missions des collaborateurs et des droits à privilèges dont ils disposent. Dans votre politique de droits d’accès considérez qu’un privilège n’est pas seulement un droit étendu sur un système, tels que les comptes administrateur, mais la possibilité d’initier ou valider des opérations financières, entre autre. Cette catégorie de collaborateurs dont la mission pourrait bénéficier à un attaquant peut faire l’objet d’un contr?le spécifique afin de se prémunir contre de tels attaques.