SECURE IT - September 2023

A monthly Information Security publication for the WPI community.

This month focuses on SOCIAL ENGINEERING, the use of deception to get people to provide sensitive data or access to restricted areas.

Put simply, hackers recognize that it is easier to hack a human than it is to hack a machine.

In this issue: 

• Psychology of Social Engineering
• Social Engineering Attack Strategies & Prevention
• Learning with Laughter
• Lunch & Learn
• Meet Jeff!
• Featured Videos
• Book Recommendation
• Statistics and Higher Ed
• Diversity in Cybersecurity
• WPI Hub Resources
  
• Coming Next Month...

Psychology of Social Engineering 

Attackers do not need cutting edge technology or action movie stunts to access confidential information or restricted areas. They count on the human factor! Psychological principles that they exploit:

• Reciprocity - People doing favors for each other.
• Commitment and Consistency - Sticking with what's already been chosen.
  
• Social Proof – Doing things that others are doing.
  
• Authority - Obeying people who are perceived to have power or seniority over you.
  
• Liking- People are more easily persuaded by someone who is friendly.
  
• Scarcity - People are drawn to things that are perceived to be exclusive or only for a limited time.
  

More detailed explanations of social engineering are at:

Social Engineering Attack Strategies & Prevention

How Do They Attack?

• Pretexting - pretending to be someone else
• Baiting & Quid Pro Quo - promising to give something valuable, often in exchange for requested info or action from the victim
• Blackmail - threatening to reveal something if the demands are not met
  

False Assumptions About Cyber Criminals

The attackers rely on these common misbeliefs:

• Criminals won’t hold conversations with you.
• Major platforms, such as Microsoft and Google, are always secure.
  
• Replying to existing emails is safe.
  

Examples of Social Engineering:  

PHISHING email tries to trick someone into revealing sensitive information or making a payment. Smishing uses similar tactics in short message service (SMS) texting.  Vishing is a vocal attempt to extract information via the phone.  Spear phishing targets specific individuals using any of these methods.

PHYSICAL TACTICS are also employed, such as Credential Harvesting which gathers valid credentials to gain unauthorized access. Hoaxes trick the user into performing undesired actions, such as deleting important files to remove a virus. Invoice Scams spoof the invoice details of a genuine supplier, but change the bank account number. Tailgating attackers follow someone, who is unaware of their presence, into a restricted area.

WEBSITES lure victims through Pharming, which redirects a familiar website link to a similar, but fake, website to obtain sensitive information such as login credentials. Watering Hole Attacks use malware installed on website(s) regularly visited by an organization's members to infect their computers.

Can you spot the spoofed website in this WPI Hub article?

How to Combat Social Engineering: Take 5 & MFA

Modern scammers prey upon your anxiety and depend upon your instant reaction. You can outsmart them by taking five minutes to diffuse your reaction, take yourself out of “fight or flight” mode, and look at the message logically.

Does this method and individual match the usual way you would receive this type of request, perhaps job duties, course assignments, schedule changes, account updates?

Have you asked anyone else about this? Contact a co-worker or the supposed sender via a different channel - so if you received email, try chat, phone, or speaking in person.

Does an email appear to be from WPI, but [EXT] starts the Subject line? That indicates it originated outside of WPI.

Have you checked with WPI IT? 

Are you using MFA (Multi-Factor Authentication) through the Microsoft Authenticator App with number matching? It's the most secure method at this time, and prevents social engineering tricks through email codes and text messages. Taking the time to enter a number prevents "MFA Fatigue" where hackers rely on wearing you down with numerous requests until you finally just click "Allow" to clear the screen.

Learning with Laughter