SocialEngineeringAttacksandDefenses.pptVIP

Social Engineering: The Human Element of Computer Security Presented by Caleb Leak and Smiti Bhatt A Quote from Kevin Mitnick “You could spend a fortune purchasing technology and services from every exhibitor, speaker and sponsor at the RSA Conference, and your network infrastructure could still remain vulnerable to old-fashioned manipulation.” Types of “hackers” according to Kevin Mitnick Crackers (or vandals) Script kiddies Phone phreaks Social engineers A Classic (and real) Example Stanley Mark Rifkin defrauded the Security Pacific National bank in LA in 1978 Managed to steal $10,200,000 in a single social engineering attack Types of Attacks Phishing Impersonation on help desk calls Physical access (such as tailgating) Shoulder surfing Dumpster diving Stealing important documents Fake software Trojans Phishing Use of deceptive mass mailing Can target specific entities (“spear phishing”) Prevention: Honeypot email addresses Education Awareness of network and website changes Impersonation on help desk calls Calling the help desk pretending to be someone else Usually an employee or someone with authority Prevention: Assign pins for calling the help desk Don’t do anything on someone’s order Stick to the scope of the help desk Physical access Tailgating Ultimately obtains unauthorize building access Prevention Require badges Employee training Security officers No exceptions! Shoulder surfing Someone can watch the keys you press when entering your password Probably less common Prevention: Be aware of who’s around when entering your password Dumpster diving Looking through the trash for sensitive information Doesn’t have to be dumpsters: any trashcan will do Prevention: Easy secure document destruction Lock dumpsters Erase magnetic media Stealing important documents Can take documents off someone’s desk Prevention: Lock your office If you don’t have an office: lock your files securely Don’t leave important information in the open Fake Software Fake login screens The