Posts Tagged ‘social engineering’

Another Security Warning

August 27th, 2010 by Millie Smith

This time, from the ISF (Information Security Forum), a leading independent authority on information security, who have just released their predictions for IT security in 2011.

it security

There is a shift predicted to highly organised cyber crime and targeted attacks.
It is important that we keep data safe now and plan for the future.

Chief executive Prof. Howard A. Schmidt at the ISF, states: “Even in today’s financial climate and increased threat environment, we are better placed than ever before to meet these challenges – as long as we have the resolve to strengthen and invest in security rather than reduce it.

There is still time to put security measures in place, and they needn’t cost a fortune. Common sense, combined with first line of defence physical security and second line basic encryption will go a long way in helping to keep information safe and reduce data loss.

Think about the disgruntled employee
Criminals will be approaching employees that have been affected by the recession for sensitive company data.

Don’t be a victim of Social Engineering
Think back to the Second World War and the nostalgic posters, ‘Loose Lips Might Sink Ships’ and ‘The Walls Have Ears’, and keep information to yourself.

Here are the predicted top ten risks:

  1. Criminal attacks
  2. Weaknesses in infrastructure
  3. Tougher statutory environment
  4. Pressures on off shoring / outsourcing
  5. Eroding network boundaries
  6. Mobile malware
  7. Vulnerabilities of Web 2.0
  8. Incidents of espionage
  9. Insecure user-driven development
  10. Changing cultures.

Jason Creasey, head of research at the ISF, has stated that the recession is accelerating the changes and advancements in IT threats: “…. fuelled by increasing staff turnover and dissatisfaction; along with the increased involvement of organised criminal groups that see online crime as a lucrative and low risk alternative to other nefarious activities.

Security Awareness is a Vital Defence

August 17th, 2010 by Millie Smith

Social Engineering – the inadvertent disclosure of confidential information by your employees, is every organisation’s weakest security link.

chain

Technology solutions, security policies, and operational procedures cannot work in isolation. People play a key role in an organisation’s security policy success.

Phishing, Pharming and SPAM are recognised examples of social engineering, both carried out for the purpose of profit, but there are more. These profiteers are always one-step ahead; creating and deploying new attacks that we are not yet aware of.

Regularly updated security software will deal with the majority of Phishing and Pharming threats and block the deluge of dodgy SPAM, but there are always those that slip through the net. Only users can decide if they are going to respond or not, and if they do, inadvertently hand over sensitive data.

Social Threats:
Social Engineers are practiced at manipulating employees into compromising corporate security, undermining human judgement so the victim is willing to concede network security, or even let them into an office building, without verifying their identity. They gather information by listening to conversations in public places (cafes, public transport etc), watching people enter passwords and PINs into laptops and at cash points, and even searching through the rubbish.

Awareness:

  • If employees don’t know about it, they can’t help!
  • Create a strong security culture within the organisation
  • Make employees aware of the threats and reinforce that security is everyone’s responsibility, not just that of the IT team
  • Point out to employees that they are the last line of defence against hackers who have turned to social engineering because they cannot breach the security systems any other way
  • Have regular training sessions/updates about the latest security threats.