Preventing Cyber Crime & Fraud: Social Engineering

This advice has been collated by East Midlands Special Operations Unit (EMSOU) to raise awareness among businesses and the public.

If you require any further information, assistance or guidance please contact the EMSOU Protect Team EMSOU Protect Team or your local Force protect team.

Hot Topic: Social Engineering: How I might attack your organisation

It’s quite common to hear about cyberattacks causing huge data breaches and resulting in businesses suffering irreparable harm. Such articles encourage us to imagine sophisticated hackers in cyberspace, employing state of the art technologies to infiltrate your computer systems.

For many organisations, the answer always seems to lie with either:

Investing heavily in new technologies to bolster network defences – or
The ostrich effect – stick your head in the sand and hope the problem goes away.

Alternatively, you can let apathy sink in – not much you can do about it, right? Problem is, you’ve already made your biggest mistake – what makes you think I’m going to target your IT systems? That’s the goal, not the attack vector.

If I want to hit you with ransomware, steal patient confidential data or just fool you into handing over some of your over stretched budget, I’m going to target you. You are the weakest link in the chain.

Indeed, if you study credible public reports and expert analysis on cybersecurity incidents, you’ll discover that approximately seven out of ten incidents occur due to human error and behaviour, not complicated technical attacks. As such, cyber security, is fundamentally a human issue, not a technology one. If you want a cheap, effective solution to cybercrime – train your staff.

Mitigation – Protect yourself and your customers

Remember: You are the data owner. GDPR says you must look after it. Failure to give your staff basic cyber security messages suggests negligence or incompetence.

Tell them to:

Vishing:

Keep abreast of the news. As awful as it may seem, knowledge of attack methods and techniques will hone the ability to separate fact from fiction.

Understand that: A legitimate organisation won’t make unsolicited requests for sensitive information. Anyone who does this over the phone is probably trying to scam you.

Call back using official channels: No matter how friendly or stressful the call might seem, ask yourself, ‘How can I contact the company or an official representative through official, well known, channels’? Once you know the correct communication channels, verify the claims being made.

Don’t give into pressure: If someone tries to coerce you into giving them sensitive information, hang up.

Emails:

For high value operations: Always check the ‘From field’ carefully. Look for variations in spelling, amendments and simple transposition errors (e.g. BBC.com not BCB.com). Hovering your mouse over a link will also identify where it actually goes rather than where it claims to go.

Look for a break in protocol: If the email deviates from normal procedure, such as a request for payment – seek confirmation from official channels.

Test Employees: Use an open source phishing tool to train and then test staff’s ability to detect and report phishing emails. You can easily search for one using your favourite search engine.

Guard sensitive data. Encourage all employees to research their name online. A social engineer will use this information to hack you, so:

Remove your data from websites by using the ‘contact us’ part of any web page. Under GDPR, everyone has the right to ‘be forgotten’ and can request the removal of their personal information. All companies must comply with this.

Review your privacy settings: For online social media accounts. Remember, if I can’t find information on you, I’ll scope your friends and family, so advise them to do the same.

Ideally, you need to train staff to recognise what sensitive data is and the impact it will have on the organisation if this information was exposed. Knowing why information is sensitive will encourage others to take better care of it.

Reporting

Please report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online.

Forward suspicious emails to report@phishing.gov.uk.

Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).