Cyber Security Awareness Committee Brocks Cyber Security Awareness

Cyber Security Awareness Committee Brock’s Cyber Security Awareness Committee Presents: Social Engineering

Cyber Security Awareness Committee Cyber Security Awareness – Social Engineering/Phishing • Of all the potential threats to our cyber-security, which category of threat are YOU most likely to face in the next week? • How can ordinary users defend themselves? • This workshop will focus on “social engineering”, defining jargon like “spear phishing”, “pretexting”, “vishing”, “water holing”, “tailgating” and other terms in plain English. • You will leave with the skills needed to recognize, manage, and report these threats in your home and work environment.

Cyber Security Awareness Committee Insert title here Social Engineering What is It?

Cyber Security Awareness Committee Social Engineering Social engineering is a discipline in social science that refers to efforts to influence particular attitudes and social behaviors. . . Wikipedia

Cyber Security Awareness Committee Social Engineering Any act that influences a person to take an action that may or may not be in their best interest. www. social-engineer. org

Cyber Security Awareness Committee Advertising

Cyber Security Awareness Committee Advertising Any act that influences a person to take an action that may or may not be in their best interest.

Cyber Security Awareness Committee Family Influence

Cyber Security Awareness Committee Family Influence Any act that influences a person to take an action that may or may not be in their best interest.

Cyber Security Awareness Committee Elementary School

Cyber Security Awareness Committee Elementary School Any act that influences a person to take an action that may or may not be in their best interest.

Cyber Security Awareness Committee Religious Thought

Cyber Security Awareness Committee Religious Thought Any act that influences a person to take an action that may or may not be in their best interest.

Cyber Security Awareness Committee Political Discourse

Cyber Security Awareness Committee Political Discourse Any act that influences a person to take an action that may or may not be in their best interest.

Cyber Security Awareness Committee Peer Pressure

Cyber Security Awareness Committee Peer Pressure Any act that influences a person to take an action that may or may not be in their best interest.

Cyber Security Awareness Committee Social Engineering: Security Context noun The use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes. Google

Cyber Security Awareness Committee Social Engineering: Defined on CITS’ Web Site Social Engineering is any act that influences a person to take an action that may or may not be in their best interests. It's the art of gaining access to buildings, systems or information by exploiting human psychology, rather than breaking in, or using technical hacking techniques. It's the art of manipulating people so they give up confidential information or allow access to restricted areas.

Cyber Security Awareness Committee Insert title here Social Engineering: Security Context Various Forms

Cyber Security Awareness Committee Insert title here Social Engineering Pretexting

Cyber Security Awareness Committee Pretexting Using a fictitious scenario (ie the pretext) the criminal establishes trust—perhaps through impersonation—which is leveraged to create a false motive for an unsuspecting individual to divulge information or do something he or she normally would not do.

Cyber Security Awareness Committee Pretexting Sometimes it doesn’t even have to be a lie! What if you told people that you were from the Jimmy Kimmel Show and you were checking if people were using secure enough passwords…

Cyber Security Awareness Committee Pretexting

Cyber Security Awareness Committee Insert title here Social Engineering Vishing

Cyber Security Awareness Committee Pretexting: Special Case Vishing: Making phone calls or leaving voice messages purporting to be from reputable companies in order to induce individuals to reveal personal information or do something they would not normally do.

Cyber Security Awareness Committee Pretexting

Cyber Security Awareness Committee Another Kind of Vishing • Some criminals prompt targets to phone a number they claim is from a trusted institution to verify their personal information. • The mark calls in and provides their private information to an Interactive Voice Response system.

Cyber Security Awareness Committee Pretexting: Duping the Help Desk

Cyber Security Awareness Committee Social Engineering: But the bad guys can turn the tables on your help desk experience too.

Cyber Security Awareness Committee Insert title here Social Engineering Quid Pro Quo

Cyber Security Awareness Committee Social Engineering: Quid Pro Quo – Something for Something • The attacker calls extensions at a company claiming to follow up on a technical problem. • Eventually finds someone with an issue. • In the course of providing tech support, the end user provides system access or types in a malicious command.

Cyber Security Awareness Committee Insert title here Social Engineering Water Holing

Cyber Security Awareness Committee Social Engineering: Water Holing • The attacker finds a weakness in a legitimate website known for attracting a target group. • Using the compromised site, visitor systems are infected with malware because people trust the site owners.

Cyber Security Awareness Committee Water Holing

Cyber Security Awareness Committee Insert title here Social Engineering Tailgating

Cyber Security Awareness Committee Social Engineering: Tailgating • The attacker seeks access to a restricted area. • Simply walks in behind a person with legitimate access.

Cyber Security Awareness Committee Social Engineering: Tailgating

Cyber Security Awareness Committee Insert title here Social Engineering Baiting

Cyber Security Awareness Committee Social Engineering: Baiting • Attackers leave malware-infected DVDs or USB flash drives in locations people will find them, giving them names that pique people’s curiosity. • An employee looking out of curiosity or to determine how to return it puts it in his or her system and gets infected.

Cyber Security Awareness Committee Don’t Plug In ‘Found’ USBs

Cyber Security Awareness Committee Insert title here Social Engineering Phishing

Cyber Security Awareness Committee What is Phishing? • Phishing is the attempt to obtain sensitive information such as usernames, passwords, and credit card details…by disguising as a trustworthy entity in an electronic communication…. Phishing is typically carried out by email spoofing…and it often directs users to enter personal information at a fake website, the look and feel of which are identical to the legitimate one. Wikipedia

Cyber Security Awareness Committee The Cost of Phishing to an Edmonton U

Cyber Security Awareness Committee Phishing

Cyber Security Awareness Committee Social Engineering: And there’s much, much more…. • Like virus hoaxes, • Smishing (SMS phishing) • Like tricking users to copy and paste malicious code into their browser’s web development console, ….

Cyber Security Awareness Committee What can we do about it? A discussion. DEFENSE

Cyber Security Awareness Committee

Cyber Security Awareness Committee Don’t Underestimate the Power of Common Sense

Cyber Security Awareness Committee Defense • Scrutinize what information in the workplace is sensitive and evaluate exposure to breakdowns in security—including social engineering. • Establish security protocols, policies, and procedures for handling sensitive information.

Cyber Security Awareness Committee Defense • Train employees in the security protocols relevant to their position • Periodically test the systems to make sure they work.

Cyber Security Awareness Committee Defense • Periodically Review your • Make sure that private defensive posture to documents are make sure that your adequately handled by systems, procedures, shredding or secure protocols and training disposal. are up-to-date.

Cyber Security Awareness Committee