The Effects Of Social Engineering And Pharming, And How To Combat It

 

Post 6 - Social engineering attacks can have severe financial impacts on companies and individuals alike. According to the IBM Cost of a Data Breach 2022 report, social engineering attacks average over $4 million in costs, with some instances resulting in losses as high as $100 million due to fraudulent invoices. Citizens are also affected, often experiencing financial theft and identity theft.  Below I communicated the most interesting types of security incidents.

Social engineering is a tactic used to manipulate, influence, or deceive victims to gain control over computer systems or to steal personal and financial information. It relies on psychological manipulation to trick users into making security mistakes or divulging sensitive information. Social engineering encompasses various schemes aimed at stealing information, including phishing, baiting, tailgating, scareware, dumpster diving, and quid pro quo. These tactics can vary in complexity and may involve multiple steps to achieve their goals. As stated in Certmaster Learn Tech+, TestOut Corp (2024) “Social engineering takes many forms, but always with the same aim: to get you to reveal personal or sensitive information about yourself or your organization.” Such tactics can compromise your finances and identity in the digital world.

From an employee perspective, falling victim to any type of social engineering can lead to impersonation, resulting in the unauthorized access to patient, customer, or company information, which can then be used for blackmail or coercion. Addressing these practices is challenging and tracking them can be quite difficult.

Preventative measures against social engineering include regularly destroying sensitive documents such as bank statements, student loan information, and other account details using cross-shredders or secure receptacles at work that are incinerated. Additionally, it is important to be cautious of tempting offers; if an offer seems too good to be true, it likely is. Using search engines to verify the legitimacy of offers can help identify traps.

One type of social engineering attack to focus on is pharming. As defined by Kaspersky.com, pharming is a cyberattack where criminals redirect internet users from a legitimate website to a fake one, aiming to capture personally identifiable information (PII) and login credentials or install malware. Pharming commonly targets financial sector websites, including banks, online payment platforms, and e-commerce sites, with identity theft as the goal.

Pharming differs from phishing in that it does not rely on enticing users to click on links. Instead, users can be redirected to fake sites even when navigating to correct ones, making pharming more insidious. This method, termed "phishing without a lure," can affect numerous computers without conscious action from victims. Hacked information can be exploited on the dark web or for identity theft.

Pharming involves two stages: first, hackers install malicious code on a computer or server, and second, the code redirects users to fake websites to collect personal information. This redirection occurs automatically, posing significant risks, especially for Internet Service Providers (ISPs), as the malicious code can spread rapidly across connected devices.

To protect against pharming, users should choose reputable ISPs that filter out suspicious redirects and enable two-factor authentication where possible. This additional security layer makes accounts harder to hack, even if login details are compromised through pharming.

Protecting personal and company information requires collaboration between individuals and organizations. Effective prevention combines intelligent skepticism from users and robust technological measures from employers to combat social engineering tactics.