Humans – The Understated Element in Securing the Internet 09-26-2014, 01:08 AM
#1
Content stolen from: http://blog.level3.com/security/humans-t...-internet/
//A really good article about SE as a infosec threat for organisations
Nowadays, all it takes is a distracted employee, with a lapse in judgment or one wrong click and a business can become compromised. Capitalizing on our tendency towards curiosity, attackers like to exploit our hectic lives to explore for vulnerabilities. Some common tactics include:
Phishing – Sending unsolicited email to a group of employees hoping to get them to click on a malicious URL or download a malicious file
Social Engineering – Manipulating/influencing someone into providing private information or performing some kind of action for the purposes of information gathering, system access or fraud.
Baiting – Leaving malware infested physical media (USB Drive, CD etc.) in a public setting where they are sure to be found, waiting for unsuspecting victims to pick them up and use them.
Businesses, if they are not already, should strongly consider training their employees in security best practices for today’s environment, especially related to combating social engineering. A few best practices to avoid being duped:
Being a Pessimist/Skeptical: Assume random emails or phone calls are a scam until proven otherwise
If it seems too good to be true, chances are it is
Check for common signs of fraud including typos and incorrect grammar
Never give out personally identifiable information or private work details (credentials/passwords) via email or over the phone before verifying the authenticity of the person on the other end
Financial institutions, government entities will never ask for this information via email
Verify with the financial institution or government entity who is requesting this information by calling their direct phone number
Avoid opening unsolicited email, clicking on links or opening attachments in emails from suspicious/unknown senders
Social engineering is one of the simplest yet one of the most effective tactics to gain entry into endpoints and networks, and the best practices for defending against them are just as easy. Take one second to stop and think before giving out information or opening suspicious documents or email. It could be the difference between remaining secure and causing a multi-million dollar breach.
//A really good article about SE as a infosec threat for organisations
Nowadays, all it takes is a distracted employee, with a lapse in judgment or one wrong click and a business can become compromised. Capitalizing on our tendency towards curiosity, attackers like to exploit our hectic lives to explore for vulnerabilities. Some common tactics include:
Phishing – Sending unsolicited email to a group of employees hoping to get them to click on a malicious URL or download a malicious file
Social Engineering – Manipulating/influencing someone into providing private information or performing some kind of action for the purposes of information gathering, system access or fraud.
Baiting – Leaving malware infested physical media (USB Drive, CD etc.) in a public setting where they are sure to be found, waiting for unsuspecting victims to pick them up and use them.
Businesses, if they are not already, should strongly consider training their employees in security best practices for today’s environment, especially related to combating social engineering. A few best practices to avoid being duped:
Being a Pessimist/Skeptical: Assume random emails or phone calls are a scam until proven otherwise
If it seems too good to be true, chances are it is
Check for common signs of fraud including typos and incorrect grammar
Never give out personally identifiable information or private work details (credentials/passwords) via email or over the phone before verifying the authenticity of the person on the other end
Financial institutions, government entities will never ask for this information via email
Verify with the financial institution or government entity who is requesting this information by calling their direct phone number
Avoid opening unsolicited email, clicking on links or opening attachments in emails from suspicious/unknown senders
Social engineering is one of the simplest yet one of the most effective tactics to gain entry into endpoints and networks, and the best practices for defending against them are just as easy. Take one second to stop and think before giving out information or opening suspicious documents or email. It could be the difference between remaining secure and causing a multi-million dollar breach.
Pay respects to the malformed SYN packet.
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
![[Image: R5aCcWV.png]](http://i.imgur.com/R5aCcWV.png)
