Mobile-Menu

Cyber Security Social engineering and how to protect yourself against it

Source: Press release by: Kloepfel Consulting, Bitkom | Translated by AI 4 min Reading Time

Related Vendors

FAULHABER Drive Systems
Wuxi InfiMotion Technology Co., Ltd.

Every second company attempts to prepare cyber attacks through social engineering, according to a recent survey by the digital association Bitkom. What methods of attack are behind this and what can companies do about it?

The term social engineering covers numerous methods used by cyber criminals to gain information for a cyber attack.(Image: freely licensed / Pixabay)
The term social engineering covers numerous methods used by cyber criminals to gain information for a cyber attack.
(Image: freely licensed / Pixabay)

A caller from the IT department who needs the password for a PC update, an email from the boardroom with a link to a website or a desperate text message from a colleague who can't access her computer—cyber criminals who are collecting information for an attack could be behind it all. Social engineering is the name of the method by which employees are manipulated into disclosing confidential data.

Almost every second company affected

Almost every second German company (45%) has experienced such incidents within a year. 30 percent report occasional attempts, 15 percent even report frequent ones. These are the results of a survey of 1,003 companies with 10 or more employees commissioned by the digital association Bitkom. "On the one hand, cyber criminals use social engineering to gain access to IT systems. On the other hand, it may initially only be a matter of collecting important information, such as the names of direct superiors or the software used. Such information can also help to prepare another social engineering attack or carry out a cyberattack," says Felix Kuhlenkamp, IT security expert at Digital Association Bitkom.

If you know the attack techniques, you can better protect yourself against them. The Kloepfel Group, which specializes in procurement and supply chains, has compiled an ABC of social engineering techniques and how to recognize them

  • Baiting—the attacker lures the victim with an enticing offer, often in the form of a free download or a USB stick infected with malware. Example: A dangerous USB stick is placed in a parking lot in the hope that someone will find it and curiously insert it into their PC. So beware of unknown USB sticks or unusually attractive offers without a clear source.

  • Impersonation—The attacker pretends to be someone else, often a trusted person such as a colleague or supervisor, to gain access to information or secure areas. Example: A stranger poses as a new employee and asks for access to the building.

  • Phishing—Phishing is an attempt to steal personal data such as passwords using fake emails or websites. Example: An email that looks like it comes from a bank asks the recipient to enter their account details. Phishing emails can be recognized by unusual sender addresses, spelling mistakes or unexpected requests for personal information.

  • Pretexting—With pretexting, the attacker feigns a false identity in order to gain access to confidential information. Example: Someone calls and pretends to be an IT employee to ask for your password. Pretexting can be recognized by the fact that the caller asks unusual questions or requests information that is not normally asked over the phone.

  • Quid Pro Quo—With this method, the attacker offers something in return for information or access rights. Example: A caller offers "free technical support" in order to get you to disclose access data. Quid pro quo attacks can be recognized when someone demands personal or security-related information in exchange for an alleged service.

  • Spear phishing—A targeted form of phishing in which the attacker specifically targets one person and uses a personalized message to gain the victim's trust. Example: An email that looks like it comes from the boss asks the employee to click on an attachment or link or to pass on confidential information.

  • Tailgating—Tailgating is when someone tries to enter a secure area without their own access card or authorization.

  • Vishing—Vishing (voice phishing) is a technique in which fraudsters attempt to obtain sensitive information such as passwords or bank details by telephone. Example: A fraudster pretends to be a bank employee and asks for your account information. This also includes so-called grandchild scammers who try to get money with shock calls. If you receive unexpected calls in which the caller asks for confidential information or exerts strong pressure, it is better to hang up.

  • Watering hole—In this technique, the attacker compromises a frequently visited website in order to spread malware or steal data. Example: A frequently visited industry website is infected so that its visitors unknowingly download malware. Watering hole attacks can be detected by virus warnings or unusual behavior of familiar websites.

    Subscribe to the newsletter now

    Don't Miss out on Our Best Content

    By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

    Unfold for details of your consent

Countermeasures against social engineering

Bitkom gives four tips on how companies can better protect themselves against social engineering:

  • Conduct regular training: Companies should conduct regular training sessions to sensitize employees to the dangers of social engineering. They can learn how to recognize and report suspicious messages or requests.

  • Clearly define and secure processes: Companies should define guidelines as to which information may be passed on by which means - for example by telephone or email—and which may never be passed on, such as passwords. In addition, double security mechanisms, such as the checking and confirmation of transfers or sensitive decisions by at least two or more people in different areas of the company, should be implemented. This greatly minimizes the risks of manipulation by individuals or unauthorized access.

  • Use multi-factor authentication: Multi-factor authentication, which requires a code on the smartphone or a keycard in addition to the password, for example, makes it more difficult to use information obtained through social engineering. Attackers can therefore not penetrate IT systems as easily.

  • Use modern IT security software: In principle, companies should use security software such as spam filters or anti-phishing software to at least filter out simple attacks. In addition, special software-based systems can be used to detect unusual activities in your own network that indicate social engineering attacks. Artificial intelligence and anomaly detection often detect suspicious behavior and trigger an alarm in good time.

Related content