OVERVIEW
In 2015, an accountant looking at the balance sheets of a US tech company noticed, to their dismay, a $39 million hole in their figures. They would have been even more dismayed to know where it had gone – a member of the financial team in an overseas subsidiary had transferred it directly to the thief. All the thief had to do was pretend they were a CEO.
It’s a kind of attack known as a CEO email attack, and just one of a broad range of hostile tactics known as social engineering attacks. These are attacks that exploit the natural weaknesses of human beings – our credulity, our naiveté, our propensity to help strangers, and sometimes, in the case of phishing attacks, just our greed – in order to get around security systems.
To put it in the language of 21st century cyber security: social engineering operates on the idea that, just like any computer system, human beings can be hacked. In fact, a lot of the time they’re much easier to hack than computers. Understanding this fact, and the forms that social engineering can take, is essential to formulating a robust defense strategy. And these strategies are even more important now, as the lines between the physical and digital worlds continue to blur and the assets at risk continue to multiply, thanks to the proliferation of connected technologies.
IN DEPTH
From the serpent in the Garden of Eden, to the fake phishing emails that promise fortunes if only you’d just part with your bank details and social security number, social engineers have been with us for a while. But few epitomize their arcane arts quite like Frank Abagnale, whose exploits between the ages of 15 and 21 were immortalized in the Steven Spielberg film Catch Me If You Can. During those years, Abagnale posed as a doctor, a lawyer and an airline pilot, and has become one of recent history’s most legendary social engineers. He now runs a consultancy, Abagnale and Associates, that aims to educate others – including government agencies such as the FBI, and numerous businesses – on how to catch people like him, as social engineering methods shift.
Abagnale asserts: “Some people used to say that I’m the father of social engineering. That’s because when I was 16 years old, I found out everything I needed to know – I knew who to call and I knew the right questions to ask – but I only had the use of a phone. People are doing the same things today 50 years later, only they’re using the phone, they’re using the mail system, they’re using the internet, email, cloud. There’s all this other stuff, but they’re still just doing social engineering.”
We live in an overwhelmingly digital world, and the projected 50 billion Internet of Things (IoT) devices due to be hooked up to the internet by 2020 means the already broad frontier of digital risk will only continue to grow. “I taught at the FBI for decades. There is no technology today that cannot be defeated by social engineering”, says Abagnale. Making sure the human links that sit between this expanding set of digital nodes remain secure lies at the heart of securing the whole system; one increasing tied up with physical as well as digital assets.
New Risks
In 2010, the Stuxnet worm, a virus believed to have been developed jointly by the US and Israeli military, managed to cause substantial damage to centrifuge generators being used by the Iranian nuclear program. The virus was designed to attack the computer systems that controlled the speed that components operated in industrial machinery. By alternately speeding up and slowly down the centrifuges, it generated vibrations that caused irreparable mechanical damage. It was a new breed of digital weapon: one designed to not only attack digital systems, but physical systems as well.
It was physical in another way. In order to target this system it had to be physically introduced via an infected USB flash drive. And getting that flash drive into a port, or into the hands of someone who could, required human beings to intervene. In this case, anonymous USB devices were left unattended around a facility which were then accidentally inserted by unwitting technicians.
The Stuxnet worm highlights the extreme end of the dangers that lie at the overlap between digital technology, physical assets and human beings, but the risks extend well beyond that. More prosaic, for instance, are email scams that work by tricking the receiver into sharing vital information – remember the notorious “Nigerian Prince” emails, where a fraudster would promise a willing helper untold riches if they forwarded them the money to have them released from jail?
Some of these scammers have elaborate networks that crossed countries and continents, and can be worth over $60 million. Move the concept into the organization now: imagine receiving an email from someone purporting to be your boss, asking in an official and insistent tone for a crucial keyword or a transfer of funds. Could a typical employee be relied on to deny that request? What about a phone call? This was hacker Kevin Mitnick’s strategy. In a way, a Frank Abagnale of the digital age, Mitnick managed to make a range of high profile attacks on key digital assets by just phoning up and asking for passwords.
IoT: The Convergence Of The Physical And Cyber Worlds
“Humans are the weakest link in any security program”, reminds Dennis Distler, Director, Cyber Resilience, Stroz Freidberg, an Aon company. In fact, it’s us, rather than computer systems’ weaknesses or failures that lie at the heart of around 90 percent of cyber breaches. Social engineering attacks can come in various forms and the risk from them will never be fully mitigated. But while full mitigation is impossible, you can limit your exposure – that strategy begins at the individual level. Humans are the targets, so the first line of defense has to be from humans. “You certainly remind people that you have to be smarter, whether you’re a consumer or CEO. You have to think a little smarter, be proactive, not reactive”, says Abagnale.
Stephanie Snyder, National Sales Leader, Cyber Insurance, Aon, notes that while social engineering has a focus on financial loss, the focus of cyber risk is shifting to tangible loss with the potential for property damage or bodily injury arising out of IoT devices. “Historically, cyber risk has been associated with breaches of private information, such as credit cards, health care and personally identifiable information (PII)”, explains Snyder. More and more, however, the IoT – the web of connected devices and individuals – will pose an increased risk to physical property as breaches in network security begin to impact the physical world. Having a better understanding of vulnerabilities and entry-points – both at the individual as well as device level – will be critical for organizations in 2017 and beyond.
Organizational Mitigation
While security awareness training and, to a lesser extent, technology can prevent successful attacks – whether IoT related, human error or stemming from actual social engineering – the risk from them will never be fully mitigated. Organizations can take a number of steps to protect themselves. Distler of Stroz Friedberg, highlights a number of key steps a company can take to minimize their exposure to social engineering risk:
Identify what and where your organization’s crown jewels are. A better understanding of your most valuable and vulnerable assets is an essential first step in their protection.
Create a threat model to understand the types of attacks your organization will face and the likelihood of them being exploited. From email phishing to physical breaches, the threat model can help teams prioritize and prepare how to best respond.
Create organization-specific security awareness training addressing what types of attacks individual employees could expect, how to detect them, and what the protocols for managing and reporting them are. Consider instituting a rewards program for reporting suspected attacks in order to further incentivize vigilance.
Provide longer and more detailed training for high-valued or vulnerable targets, such as members of the C-suite and their executive support staff, or members of IT, finance, HR or any other employee with access to particularly sensitive information. This could vary from account managers to mechanical engineers working on major operational projects. These enhanced training procedures could include red-teaming exercises, which test the ability of selected staff to respond to these breaches in real time.
Create well-defined procedures for handling sensitive information, and provide routine training on these procedures for employees who handle sensitive information.
Conduct routine tests (recommended quarterly at a minimum) for the most likely social engineering attacks.
Preparing For Tomorrow’s Breaches
The term “cyber threat” is becoming more and more complex. No longer is it a threat posed to digital assets by viruses and malware or a financial threat posed to individuals and financial institutions. Now, cyber risk encompasses a broad range of risks with the potential to harm assets, from property to brand and reputation.
And at the center of all of these interactions are people. Almost every breach begins with a human being. By understanding how such threats can manifest, and how to deal with them when they do, risks can be mitigated ahead of time. Bringing together various functional groups within an organization will be crucial as teams prepare for the more multifaceted risks of our increasingly connected future.
TALKING POINTS
“A lot of the vulnerabilities, as you will have seen, are because people do not follow good cyber practice. They open attachments from sources they’re not familiar with, they’re not sufficiently careful in the way they manage their passwords. They don’t, for example, use two-factor authentication with cloud-based applications, and so forth.” – Malcolm Turnbull, Prime Minister Of Australia
“We have seen a growing awareness from firms of the need to look at their cyber security from a people perspective and not just an IT perspective. However, there is a long way to go for firms to act on this effectively.” – Mario Bekes, Managing Director, Insight Intelligence
Read this article and more here.
Source: The One Brief
