User education essential against social engineering attacks
The five-year analysis of data from Google’s Safe Browsing service shows that the threat landscape of today has evolved considerably from that of just five years ago, according to Grant Taylor, UK VP of Cryptzone.
“What has happened in the intervening period is that the Internet has become a lot more social – and, with it, has come a communications revolution with both business and consumer users of the Web interacting with each other as never before. This has significantly raised the threat profile of almost every user as a consequence,” he said.
“In parallel with this, security vendors have developed more sophisticated technologies to stop cybercriminals – and just plain mischievous – attacks, making the task of executing technical exploits by hackers a lot more difficult,” Taylor added.
As a result of these trends, social engineering has become more prevalent. Social networking attack-driven threats have gone through the roof in direct response to the surge in the take-up of social networking sites and services, especially within the last two years.
The problem with the trend of rising levels of social engineering is that it primarily exploits human weaknesses, so is almost impossible to prevent using technical controls. In the IT security industry we obsess about data protection, but the reality is that many employees remain completely unaware of the value of the information they work with from day to day.
As a result they become complacent about protecting it. User education backed up by well communicated policies and procedures – is the best way to help people understand the security implications of their actions.
“Only by raising user awareness to the potential threats and keeping people permanently on their toes to identify when they are being manipulated to reveal confidential information – or provide a piece of the security puzzle for data thieves to steal valuable corporate assets – can we hope to counter this social phenomenon,” he said.