What is Social Engineering?

Social engineering is the human side of testing for corporate vulnerabilities and comprises the techniques used by real attackers to fool an organisation’s staff into revealing sensitive information or performing actions that create security holes for the attacker to slip through.

Many companies will spend thousands of dollars on Intrusion Detection Systems (IDS), firewalls and other protection devices to monitor the network. However, all it takes is one phishing attack to potentially devastate an organisation.

Attackers will typically rely on the following six key principles of influence based on human cognitive biases:

• Reciprocity — People are likely to return a favour done by another.
• Commitment — When people commit to an idea, they are more likely to honor that commitment.
• Social Proof — People will do things that they see other people are doing.
• Authority — People will tend to obey commands given by authority figures.
• Liking — People are easily persuaded by people whom they like or feel that they have a rapport with.
• Scarcity — Perceived scarcity creates additional demand; such as when an offer is available for a limited time only.