Even for companies that have robust IT security solutions in place, protecting networks and data is growing increasingly complex as security gaps emerge where they are least expected. With the emphasis on technology to protect data assets from threats from the outside, internal threats – such as a company’s employees – are often overlooked.
“Employees, their social media profiles and the devices they use to access a company’s network and resources provide a plethora of gateways into the infrastructure for cyber criminals. Organisations should take care to not focus purely on traditional defences. Attackers will quickly change their strategy from trying to bypass a strong perimeter defence to attacking the human element,” says Charl Ueckermann, CEO at AVeS Cyber Security.
AVeS recently conducted a vulnerability assessment as well as internal and external penetration tests for a large mining company. The company has 5500 users on its system, with 1281 of them using company-associated LinkedIn profiles. This equates to 23% of employees on LinkedIn. The company’s IT security status appeared to be excellent, with a few vulnerabilities detected, until AVeS Cyber Security suggested a simulated social engineering attack.
Open information on social media
With just a week of researching employees’ LinkedIn profiles and gathering information about them using publicly available resources on the Internet, AVeS Cyber Security’s team was able to identify employees that would be suitable targets for the social engineering project. Social engineering is the process of deceiving people into giving away access to protected systems and confidential information. Attackers use a variety of means to con their targets into giving away sensitive data or personal details, with phishing emails and social media monitoring being amongst the most commonly used. It is a formidable threat to even the most secure networks.
“We were able to get their contact details, designations and other relevant business information. This allowed us to contact them under the guise of being from internal IT support and request that they conduct an update on their computer. This way, we were easily able to convince a number of employees to install unauthorised and dubious software on their systems. None of them questioned the legitimacy of the request to install software from an Internet site that did not form part of the organisation’s approved IT landscape.
“This gave us full access to the computers, including private and sensitive data, without the user knowing that their system had been compromised. We were also able to crack into a machine that was part of a local admin group, and through this account, we were able to get access to almost all of the computers in the company’s network.”
In a real-life attack scenario, this is a breach of data – where information that is sensitive, protected, valuable or confidential is copied, transferred, viewed or taken by a person who is not authorised to do so. Data breaches can include financial data where your credit card details, personal information, trade secrets, customer information, and intellectual property is used by someone else. The loss of sensitive or confidential data can result in financial losses, penalties and reputational damage. Data breaches that results in identity theft or a violation of government or industry compliance regulations can cause a business to face fines or other civil or criminal prosecutions.
“The defence against social engineering should have multiple layers of protection so that if an attacker is able to penetrate one level, such as an individual user’s computer, they would be stopped at the next level. Remember that a social engineering predator will keep searching for a weak spot until they find one. That is why it is so important for the network to have several layers of protection to fight back, and at the very least be able to recognise when it is under attack.”
The importance of education
He stresses that employee education should be part of every organisation’s IT security strategy given that social engineering is not a technology shortfall but rather a human one. When people are properly educated about the dangers of giving away personal details, clicking on unsafe links, responding to strange requests for information, downloading unsafe applications or posting too much information on social media, they are less inclined to do so.
“Importantly, employees must understand the risks of social engineering. Good training and procedures can help reduce the risk of accidental data loss. They also need to understand the value of data to the business. A loss of critical data or intellectual property can have severe consequences,” says Ueckermann.
Ueckermann concludes with some advice for companies and their employees to take heed of:
• Don’t publish confidential company information on social media.
• Don’t take pictures of your desk and post it online. A picture tells a thousand words (i.e. an attacker can see what type of computer you are using and where you are based with geo-tagging, even if no confidential company information is visible in the picture).
• Do not accept social media requests from people that you do not know. Your social media contacts/connections have access to your connections. This means that they can view your detailed profile and career history, among other information.
• Never action requests to conduct updates on your system, even if the caller or emailer seems legit. If they claim to be from IT support, tell them you will call them back on their extension.
• Never install or update programmes from public facing websites, even if someone posing as IT support asks you to do so. Only download updates from your computer when prompted by the specific application’s update centre (i.e. Adobe, Microsoft, etc.).
• Never switch off vulnerability scanning on your computer. These scans, which run through endpoint security software, are crucial.
• Do weekly vulnerability scans on your computer at work and home.
• Never click on links in emails if you don’t trust the sender or the link’s destination. These could be phishing emails that put your device and information at risk. Scroll over the link to see if it is the correct URL.
• Do not save your passwords in an unencrypted format. Use a password manager to create and save passwords on your behalf – then you can easily change your passwords every three months.
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version