Simple English for Security Specialists. Information Security of Automated Systems-4

5c SOCIAL ENGINEERING

VOCABULARY

1 Read and learn the words and phrases.

191

READING

2 Read and translate the information about social engineering.

Social Engineering

As social engineering attacks continue to grow in sophistication and frequency, companies should look to employee education as a first line of defence. Learn how to recognize and avoid social engineering attacks.

Social engineering is a non-technical strategy cyber attackers use that relies heavily on human interaction and often involves tricking people into breaking standard security practices. The success of social engineering techniques depends on attackers’ ability to manipulate victims into performing certain actions or providing confidential information. Today, social engineering is recognized as one of the greatest security threats facing organizations. Social engineering differs from traditional hacking in the sense that social engineering attacks can be non-technical and don’t necessarily involve the compromise or exploitation of software or systems. When successful, many social engineering attacks enable attackers to gain legitimate, authorized access to confidential information.

Social engineers are a modern day form of fraudsters or con artists. They may attempt to access computer networks or data stores by gaining the confidence of authorized users or stealing those users’ credentials in order to masquerade as trusted insiders. It is common for social engineers to rely on the natural helpfulness of people or to attempt to exploit their perceived personality weaknesses. For example, they may call with a feigned urgent problem that requires immediate network access. Social engineers have been known to appeal to vanity, authority, greed, or other information gleaned from eavesdropping or online sleuthing, often via social media.

Cyber criminals use social engineering tactics in order to convince people to open email attachments infected with malware, persuade unsuspecting individuals to divulge sensitive information, or even scare people into installing and running malware.

Your organization should take steps toward educating employees on the common types of social engineering attacks, including baiting, phishing, pretexting, quid pro quo, spear phishing, and tailgating. While there are technological solutions that help mitigate social engineering (such as email filters, firewalls, and network or data monitoring tools), having an employee base that is able to recognize and avoid common social engineering tactics is ultimately the best defence against these schemes.

Social engineering is a serious and ongoing threat for many organizations and individual consumers who fall victim to these cons. Education is the first step in preventing your organization from falling victim to savvy attackers employing increasingly sophisticated social engineering methods to gain access to sensitive data.

192

3 Match the paragraphs and the headings.

AA Definition of Social Engineering

BConclusion

CCyber criminals

DIntroduction

EThe Why and How of Social Engineering

FTypes of Social Engineering Attacks

4 Match the names of the social techniques and their definitions.

from someone in exchange for something desirable or some type of compensation. For instance, an attacker requests login credentials in exchange for a free gift. Remember, if it sounds too good to be true, it probably is.

Attackers conduct attacks when they leave a malwareinfected device, such as a USB flash drive or CD, in a place where someone likely will find it. The success of a attack hinges on the notion that the person who finds the device will load it into their computer and unknowingly install the malware. Once installed, the malware allows the attacker to advance into the victim’s system.

It occurs when an attacker fabricates false circumstances to compel a victim into providing access to sensitive data or protected systems. Examples of attacks include a scammer pretending to need financial data in order to confirm the identity of the recipient or masquerading as a trusted entity such as a member of the company’s IT department in order to trick the victim into divulging login credentials or granting computer access.

It is a physical social engineering technique that

occurs when unauthorized individuals follow authorized individuals into an otherwise secure location. The goal of it is to obtain valuable property or confidential information. It could occur when someone asks you to hold the door open because they forgot their access card or asks to borrow your phone or laptop to complete a simple task and instead installs malware or steals data.

193

It is a highly targeted type of phishing attack that focuses on a specific individual or organization. Attacks use personal information that is specific to the recipient in order gain trust and appear more legitimate. Often times this information is taken from victims’ social media accounts or other online activity. By personalizing their phishing tactics, spear phishers have higher success rates for tricking victims into granting access or divulging

sensitive information such as financial data or trade secrets.

It occurs when an attacker makes fraudulent communications with a victim that are disguised as legitimate, often claiming or seeming to be from a trusted source. In an attack the recipient is tricked into

installing malware on their device or sharing personal, financial, or business information. Email is the most popular mode of communication for attacks, but it may also utilize chat applications, social media, phone calls, or spoofed websites designed to look legitimate. Some of the worst attacks make charity pleas after natural disasters or

tragedies strike, exploiting people’s goodwill and urging them to donate to a cause by inputting personal or payment information.

194

GRAMMAR

Verb + verb with -ing

We use the -ing forms of verbs after some common verbs:

We also use the -ing forms after go for sports and activities:

Let’s go skiing next weekend.

We also use the -ing forms of verbs after verbs + a preposition:

We are thinking of moving to San Francisco.

9 Complete the sentences with the -ing form of a verb from the box.

Example: I have a lot of books. I enjoy reading.

1We go ________ in the Swiss Alps every year.

2You should avoid ________ too much time on playing computer games.

3What do you think of ________ a computer on eBay?

4When will you finish ________ the book? You must return it to the library on Friday.

5That phone never stops ________!

6Jill will finish ________ in Australia in 2021.

7William suggested ________ the meeting on the hacking issues on Wednesday.

8I don’t mind ________ you with the article for the journal.

9Sheila often goes ________ with her university friends in winter.

10Stanley enjoys ________ programmes for iPhones and iPads.

11You must avoid ________ any unnecessary information.

12Stop ________, please. You are in class.

13Do you mind ________ up early for university?

14I’m thinking of ________ the new version of Windows.

15I want to travel because I enjoy ________ people and seeing new places.

16I always suggest ________ your parents for their opinion.

17I can’t stop ________ of the problem.

18We are thinking of ________ a new experiment in the near future.

195

11 Put the verb in the right form, to … or -ing.

Example: I enjoy working (work) on my new computer.

1When the lecturer finishes _________ (speak), you can ask him questions.

2I think I’ll stop _________ (work) when I’m 65.

3Why did you decide _________ (take) part in the contest?

4We can’t afford _________ (wait) any longer or we’ll miss the plane.

5Gillian is preparing _________ (leave) for Berlin on Thursday.

6Do you enjoy _________ (visit) other countries?

7I don’t mind _________ (use) the Internet for research.

8The company is planning _________ (start) the production of these new industrial robots in autumn.

9I’d prefer _________ (keep) the information secret. It is rather sensitive.

10We hope _________ (protect) our network with the new security software.

11I’ll help you _________ (choose) the best antispyware programme.

12Would you like _________ (hack) into somebody’s home computer?

12 Complete these sentences. Write about yourself. Use to … or -ing.

1I love ____________________________________

2I enjoy ____________________________________

3I don’t like ____________________________________

4Tomorrow I’d like ____________________________________

5When I’m on holiday, I like ____________________________________

6I don’t mind ________________ but __________________________________

7I wouldn’t like ____________________________________

8I hope ____________________________________

9I remember ____________________________________

10I often (sometimes) forget ____________________________________

13 Translate the sentences into English. Use to … or -ing.

1В следующий раз не забудьте сделать домашнюю работу.

2Мне нужно закончить доклад на этой неделе.

3Попросите разрешения воспользоваться калькулятором.

4Мой друг надеется учиться за границей (abroad) в следующем году.

5Я никогда не отказываюсь помочь кому-то, если (if) у меня есть время.

6Джеймс обычно избегает разговоров о своей работе.

7Некоторые люди никогда не могут позволить себе купить собственный дом.

8Не забудь выключить телевизор и компьютер.

9Старайтесь использовать надёжные пароли для различных сайтов.

10Мы хотим предложить Вам воспользоваться нашей новой программой.

197

MORE WORDS AND PHRASES TO KNOW

rely on – зависеть от

exploitation – эксплуатация, использование attempt – попытка

confidence – уверенность, доверие helpfulness – польза

weakness – слабость; недостаток urgent – срочный

immediate – немедленный, безотлагательный

insider – инсайдер; человек, имеющий конфиденциальную информацию convince – убеждать, уговаривать

ultimately – в конце концов ongoing – продолжающийся

198

5d PHREAKING

VOCABULARY

1 Read and learn the words and phrases.

2 Complete the ‘stairs’ with words and phrases from exercise 1.

3 Complete the table. Pay attention to the part of speech.

4 Complete the sentences with the words from the right column.