Security Basics: Social Engineering
It has been said the the users are the weakest link in the security chain. This is especially exemplified in Social Engineering. This is a practice wherein a user is lured to give in sensitive information such as password and credit card numbers. This is typically directed at the users and not on a security hole. The success of many of virus and phishing attacks are due largely to social engineering.
Let us take the case of the Love Bug worm. The worm made an international sensation because it was able to infiltrate even the Pentagon. This is not because there were known security holes in the system of the Pentagon, but because of the psychological motivation of “love” which prompted users to execute the worm. Aside from that, social engineering also plays a big part in phishing or attacks directed at getting user information through e-mail, instant messages, or websites that asks for them.
These activities are not exclusive to the Internet. This include chain e-mails, like the case of “Bill Gates giving away his money” if you forward the e-mail and made it look authentic with a signature of a lawyer at the end of the mail; scams such as the “Nigerian Scam“; and even text scams.
According to Sophos, there are measures one need to consider in order to avoid phishing scams:
- Never respond to emails that request personal financial information
- Visit banks’ websites by typing the URL into the address bar
- Keep a regular check on your accounts
- Check the website you are visiting is secure
- Be cautious with emails and personal data
- Keep your computer secure
- Always report suspicious activity
Recommended sites for more information:
http://www.fightidentitytheft.com/
http://www.windowsecurity.com/articles/Avoid-Phishing.html
Next on Security Basics: PHP
Add comment June 4th, 2005
