Social Engineering Defense

Why Social Engineering Works

Social engineering isn't about hacking computers. It's about hacking people.

Attackers exploit predictable human behaviours that have been hardwired into us over thousands of years:

The Six Principles of Influence

Psychologist Robert Cialdini identified six triggers that make us comply with requests:

1. Authority We obey people in positions of power.

Attack: "This is IT support. I need your password to fix a critical issue."

Why it works: We're trained from childhood to respect authority figures.

2. Urgency/Scarcity We act fast when time is limited.

Attack: "Your account will be suspended in 24 hours unless you verify now."

Why it works: Urgency bypasses rational thinking. We act first, think later.

3. Social Proof We do what others are doing.

Attack: "Everyone in the finance team has already completed this verification."

Why it works: If others did it, it must be legitimate.

4. Liking We say yes to people we like.

Attack: Building rapport before making the request. "How's your day going? Busy week? By the way, I need..."

Why it works: We're more likely to help people who seem friendly.

5. Reciprocity We feel obligated to return favours.

Attack: "I helped you last week with that report. Could you just do me a small favour and..."

Why it works: Deep-seated social norm to reciprocate.

6. Commitment/Consistency We want to be consistent with our past actions.

Attack: Starting with small requests, then escalating.

Why it works: Once we've said yes to something small, we're more likely to say yes to something bigger.

Real Example: Twitter Hack (2020)

Attackers called Twitter employees pretending to be IT support.

The approach:

1. Built rapport (liking)
2. Claimed to be from IT (authority)
3. Said there was an urgent security issue (urgency)
4. Requested VPN credentials

The result:

• High-profile accounts compromised (Obama, Musk, Apple)
• $120,000+ stolen in Bitcoin scam
• Massive reputational damage to Twitter

What the attackers understood:

• Employees want to be helpful
• IT requests seem legitimate
• Urgency prevents careful verification

Recognising Manipulation Attempts

Red Flag Phrases

Authority plays:

• "This is the CEO's office..."
• "I'm calling on behalf of the Director..."
• "IT Security requires you to..."
• "This is an audit requirement..."

Urgency plays:

• "This needs to happen in the next hour"
• "If you don't act now, there will be consequences"
• "I'm about to go into a meeting and need this immediately"
• "The deadline has passed, we need to fix this NOW"

Liking plays:

• Excessive friendliness from strangers
• Finding things in common ("Oh, you went to Manchester? Me too!")
• Compliments before requests

Social proof plays:

• "Everyone else has already done this"
• "Your colleagues John and Sarah confirmed their details"
• "This is standard procedure that all employees follow"

The Pause Response

When you feel pressured:

1. Stop — Don't respond immediately
2. Breathe — Let the urgency pass
3. Think — "Does this make sense?"
4. Verify — Through a separate channel

You are never required to make immediate security decisions over the phone.

What Is Pretexting?

Pretexting is when attackers create a fabricated scenario (a pretext) to manipulate you into providing information or access.

Unlike basic phishing, pretexting involves:

• Researched, believable stories
• Multiple interactions over time
• Detailed knowledge about your organisation
• Impersonation of trusted individuals

Common Pretext Scenarios

The IT Support Scam

The call: "Hi, this is James from IT Support. We've detected unusual activity on your account and need to verify your identity to prevent it being locked."

What they want:

• Your password
• MFA codes
• Remote access to your computer

Why it works:

• IT legitimately does call about security issues
• Fear of being locked out
• Urgency prevents verification

The New Vendor Setup

The email: "Hi, I'm from [Supplier Name]'s accounts department. We've changed our banking details. Please update your records for future payments."

What they want:

• Redirect payments to their account

Why it works:

• Vendors do legitimately change bank details
• Finance teams want to maintain good supplier relationships
• Email appears to come from known contact

The CEO Fraud

The email: "I'm in a meeting and can't talk. Need you to urgently process a wire transfer for a confidential acquisition. Don't mention to anyone."

What they want:

• Large, urgent wire transfer to attacker-controlled account

Why it works:

• CEO's authority
• Secrecy prevents verification
• Urgency prevents careful thought

Real Example: Ubiquiti Networks (2015)

Attackers impersonated employees and an outside entity to defraud the company.

The pretext:

• Posed as suppliers and executives
• Requested large wire transfers
• Used spoofed emails and fake documentation

The result:

• $46.7 million transferred to attacker accounts
• Only $8.1 million recovered
• Stock price dropped 12%

What made it work:

• Thorough research on company structure
• Knowledge of payment processes
• Believable, urgent scenarios

Defending Against Pretexting

Verification Protocols

For phone calls:

1. "Thank you for calling. Can I take your name and department?"
2. "Let me call you back on the official number."
3. Look up the official number yourself — don't use one they provide.

For email requests:

1. Check the actual email domain (not just display name)
2. Call the person using a number you already have
3. For financial changes, always verify via phone with known contacts

For in-person requests:

1. "Can I see your ID badge?"
2. "Let me check with reception/security."
3. "I'll need to verify this with my manager."

The Callback Verification

Scenario: Someone calls claiming to be your bank.

Wrong response: Answering their security questions immediately.

Right response: "I'll call you back on the number on my bank statement."

Wait 5 minutes — Attackers can keep phone lines open. A brief wait ensures a fresh connection.

Information Gathering (What They Know About You)

Before contacting you, attackers research:

From LinkedIn:

• Your job title and responsibilities
• Your colleagues' names
• Projects you've worked on
• Your career history

From company website:

• Organisation structure
• Key personnel
• Office locations
• Clients and partners

From social media:

• Personal interests
• Where you live
• Family members
• Recent activities

From data breaches:

• Your email addresses
• Previous passwords
• Security questions

Protect Your Information

✓ Limit LinkedIn visibility — Do strangers need to see your full profile?

✓ Review social media privacy — Public posts are intelligence for attackers

✓ Be cautious about work details online — Your projects and clients are valuable intel

✓ Use unique security questions — Your mother's maiden name is probably on Ancestry.com

Beyond Digital: In-Person Attacks

Social engineering isn't limited to phones and emails. Some of the most effective attacks happen in person.

Tailgating (Piggybacking)

What it is: Following someone through a secure door without using credentials.

How it looks:

• "Oh, can you hold the door? My hands are full."
• Walking closely behind someone as they badge in
• Carrying boxes or equipment to appear legitimate

Why it works:

• We're polite and helpful by nature
• Confrontation is uncomfortable
• Busy lobbies make it hard to notice

The Delivery Person

What it is: Impersonating delivery personnel to gain access.

How it looks:

• High-vis jacket and clipboard
• Carrying boxes or packages
• "I have a delivery for [Name in your company]"

Why it works:

• Delivery people come and go regularly
• Uniform creates authority and trust
• We assume security has cleared them

The Contractor/Technician

What it is: Pretending to be IT support, maintenance, or a vendor.

How it looks:

• "I'm here to check the air conditioning"
• "IT sent me to fix the network issue"
• "I'm from the copier company — here for the service visit"

Why it works:

• Contractors do legitimately visit
• Technical roles create authority
• We don't want to delay "important" work

Real Example: Physical Penetration Test

A security consultant was hired to test a company's physical security.

What he did:

1. Wore a suit and carried a laptop bag
2. Waited near the entrance during morning rush
3. Made a phone call while walking in behind employees
4. Badged through with the crowd, never challenged

Once inside:

• Connected to an open network port
• Plugged in a malicious USB device
• Accessed sensitive documents on a shared printer
• Left through the front door

Time inside building: 45 minutes Times challenged: Zero

How to Respond to Physical Social Engineering

Someone Asks You to Hold the Door

What to say: "Sorry, I can't let people in without a badge. Reception is just around the corner — they'll get you signed in."

What to do:

• Don't feel bad — this is what security expects
• Point them to the correct entrance
• If they're legitimate, they'll understand

An Unknown Contractor Appears

What to say: "Do you have a visitor pass? Let me get someone from facilities to meet you."

What to do:

• Don't assume someone else verified them
• Call facilities or the relevant department
• Escort them or wait for proper handoff

Someone You Don't Recognise Is in a Secure Area

What to say: "Hi, can I help you? Do you have a visitor badge?"

What to do:

• Challenge politely but firmly
• If they can't explain or produce ID, alert security
• Don't assume they belong there just because they act confident

Shoulder Surfing & Visual Security

What Attackers Can See

• Your computer screen in public places
• Your PIN at the cash machine
• Passwords you type in coffee shops
• Sensitive documents on your desk
• Access codes you punch into keypads

Protecting Visual Information

✓ Use privacy screens — Especially on trains and planes

✓ Position your screen — Away from windows and walkways

✓ Shield PIN entry — Cover the keypad with your hand

✓ Lock your screen — Every time you step away, even briefly

✓ Clear your desk — Don't leave sensitive papers visible

Building a Security-Aware Culture

It's Not Rude to Be Secure

Many people don't challenge suspicious behaviour because:

• They don't want to seem unfriendly
• They assume someone else will handle it
• They're afraid of being wrong

The reality:

• Security is everyone's responsibility
• Real visitors expect to be verified
• Better to challenge and be wrong than not challenge and be breached

What Good Companies Do

✓ Clear visitor policies — All visitors signed in and escorted

✓ Visible badge requirements — No badge = not allowed

✓ Encourage challenges — Reward security awareness

✓ Regular training — Keep social engineering top of mind

✓ Penetration testing — Test physical security regularly

The Bottom Line

1. Challenge the unfamiliar — Politely ask who they are
2. Verify through proper channels — Don't take their word for it
3. Report suspicious behaviour — Even if you're not sure
4. Follow procedures — They exist for a reason
5. Don't be the weak link — Attackers look for the path of least resistance