Social Engineering: Can Organizations Win the Battle?

What is social engineering?

• Email phising
• Dumpster diving
• Social media
• Phone calls – support calls, call centers
• Deliveries

It is up to us to defend this information.  There is no universal answer to these problems.  This is something that has been going on for quite some time.  Recent media coverage may be helping by shedding light on the importance of protecting our information.

• Change culture
• Provide education

Need to find a way to communicate to end users that security is everyone’s job. 

• Clear expectations
• Focus on making information security personal to people.  How to stay safe online, at home, personal banking.  Will make them more willing to participate at work if information translates.

The IT team is the biggest resistors to the training. They are the target group to take extra time with because their actions can cause the whole company damage.

Social Media – Facebook, LinkedIn

• Block them school of thought – they can use personal device and go around you.
• Bring them into your environment – you can take away encryption. You can have a chance to fight back if there was an issue. I come from the school of bringing them into the fold.

BYOD – Bring your own device.

• There are multiple strategies but we all need to provide eyes and ears to these environments.  Phishing tests are good but you have to think about the human that is behind the computer.

It is important to figure out your tech strategies.  Do you err on the side that the user is going to fail?  One way to win is to make sure our protection practices are based on the fact that the hackers are in and we can see what they are doing.