ntxissacsc4 - the rise of social engineering -- anatomy of a full scale attack
TRANSCRIPT
TheRiseofSocialEngineering- AnatomyofaFullScaleAttack-
Presenter:DaveNelson,CISSP|PresidentatIntegrity
DaveNelson,CISSP• CertifiedInformationSecurityProfessional(CISSP)
• Over20yearsexperienceasinformationsecurityprofessional
• FellowwiththeInformationSystemsSecurityAssociation
• PresidentEmeritusofISSADesMoinesIowaChapter
Overview
Whatis“SocialEngineering”?
TypesofAttacks&RealWorldExamples
BestDefense
Whatis“SocialEngineering”?WHAT IS
SOCIALENGINEERING?
Social Engineering
• Usingknowledgeofhumanbehaviortoelicitadefinedresponse.
• Putsimply…gettingyoutowillinglydosomethingformewhichislikelynotinyourbestinterest.
Sociology and Psychology
• Studyofhumanbehavior,interactionandsocietalnorms.
• Actionscanbepredictedquiteaccurately.
• Actionscanalsobeinfluencedquiteeasily.
Simple Human Behavior
• TwoTypesofResponses– Natural– Learned
Hackerswillcraftascenarioforyoutoenter,inordertoelicitaresponsewhichtheybelievewillgivethemtheresulttheyarelookingfor.
TypesofAttacks&RealWorldExamples
Why talk about social engineering
Socialengineeringisacomponentoftheattackinnearly1of3successfuldatabreaches,andit’sontherise.
Source:2016VerizonDataBreachInvestigationReport
5CommonAttackMethods
DumpsterDiving
Pretexting
Phishing
PhysicalEntry
Enticement
Dumpster Diving
• Scouringthroughdiscardeditems– Calendars&Dayplanners– Handwrittennotes– Phone&EmailLists– Operationmanualsorprocedures– Systemdiagrams&IPaddresses– Sourcecode
Pretexting
• Fraudulentphonecalls• Usedtoextractinformation• Alsousedtosetupotherattackssuchasfacilityentryorphishing
Phishing
Attemptstogetuserstoprovideinformationorperformanaction
TipsForIdentifyingPhishingAttempts– Askstoupdateaccountinformationviaemail– Noverificationimageorvaryinglayoutdesigns– Providesunfamiliarhyperlinks
Common Bait
• SweetDeals– FreeStuff– LimitedTimeOffers– PackageDelivery
• HelpMe,HelpYou!– TechSupport
• YouGotta’SeeThis!
Spear Phishing Example
GoodMorningMike,
Youmayormaynotknow,butMary(CFO)andIareinAtlantaworkingtocloseadealwithourpartnersXYZCompanyandABCLimitedona$70milliondollarcontractwithOurBigPayday,Inc.Inordertogetthecontractssigned,Ineedyoutowire$85,620toXYZCompanyand$67,980toABCLimited.MarysaysthisshouldcomefromourBankNameHereaccountnumber123456789.TheroutingandaccountnumberforXYZis12345678– 7788994455andforABCis98765432–336699774411.
BecauseOurBigPayday,Inc.isapubliclytradedcompany,thetermsofthisagreementcannotbediscloseduntiltheyfiletheirSECreportsforthequartersoyourabsolutediscretionisexpected.Undernocircumstancesareyoutodiscussthistransactionwithanyoneinthedepartment.AleakcouldresultinSECfinesorprisonforbothofusforinsidertrading.Ifyouhaveanyquestionsaboutthis,pleaserespondtothisemailwithyourdirectlineandI’llcallyouwhenI’moutofthenegotiationmeetings.IappreciateallyoudoforuswhichiswhyI’mtrustingyouwiththiskeyproject.
Keepupthegoodwork!Sandy(CEO)
Physical Presence
• Gainingphysicalaccesscanbeeasierthanvirtualaccess
• Mayprovideadditionalinformation
• Comesatahigherriskbutwithapotentiallygreaterreward
Physical Presence Examples• DeliveryDrivers• EmployeeTailgating• MaintenanceorEmergencyCrews
• Thekeyistoactlikeyoubelong.Ifyoubelieveitsowilleveryoneelse.
Enticement Examples
Afolderwithenticingtitle/labelleftongroundoutsideanemployeeentrancewithaUSBthumbdrivetapedinside.
• USB,CDorDVDsleftinconspicuousspaces.
• Maybeaccompaniedbyfakepaperfiles
• Curiositybeatscaution
Year-EndBonuses
Putting It All Together
• Targetedattackswillalwaysusesomeformofsocialengineering.
• Justlikeinmilitaryoperations,intelmakesorbreaksamission
• Hackersmayneverevenneedtousesophisticatedtechnicalattacksifyouprovidetheinformationwillingly
Stealth Mode
• Limitedsocialengineeringattackscanbehardtodetect.
• Relevantinformationallowsattackerstopinpointtheirattackwhichmakestheirfootprinthardtodiscover.
Don’t Fall for The Long Con
• Socialengineeringisnothingmorethanacon-game.
• Theold“LongCon”hasbeenportedtothedigitalworld.
• Goodconsarehardtospot.
BestDefenses
Best Defenses
• Strongpaperdestructionprocess• Limitingfacilityingress/egresspoints• Challengeunknownpeopleinsecureareas• Implementtechnologytoscreenemailandwebsitesforattacks
Employee Training
• TraditionalCBTmethodsdon’twork• Engagetheemployee,makeapersonalplea• Usegamificationtoenhancelearning• Preparefordifferentlearningstyles(audio,visual,hands-on)
• Awarenessisnottrainingandtrainingisnotawareness
Program Validation
• Socialengineeringtestingengagementsprovideassessmentsofhowwellyourpeople,processandtechnologyarefunctioning.
Summary
• Socialengineeringisheretostayandit’sgrowing• Yourorganizationwillsufferadatabreachduetosocialengineering
• Thestudyofhumanbehaviorhasbeenusedbycriminalsforcenturies,cybercriminalsarenodifferent
• Employeesmustbetrainedtospotsocialengineeringandhowtoreact
Question & Answer
www.integritysrc.com/blog
DaveNelsonCISSP
@IntegrityCEO- @IntegritySRC
515-965-3756