Social Engineering Training

What the training consists of

1. 

   1. Manipulating humans

   2:10

   Attackers often find it easier to trick a person than to break into a system, and the first lesson explains why. People who are busy or in a hurry react quickly to messages that play on their emotions.

2. 

   2. Different types of social engineering attacks

   2:08

   The second lesson shows the forms these attacks take: mass emails, messages tailored to one person with details found online (spear phishing), USB sticks left as bait, posters with QR codes that lead to harmful websites, and strangers following staff through secure doors (tailgating).

3. 

   3. How to respond to a social engineering attack

   1:50

   Stop, think and verify is the one simple method the last lesson gives for any suspicious request. It covers checking a sender’s address, contacting the person through a channel known to be genuine, sending a visitor without a badge to reception, and reporting what cannot be verified.

Why it matters

Social engineering is one of the most common ways attackers get past an organisation’s security measures, because people often take risks, such as clicking links from unknown senders, even when they know the dangers. It can lead to malware infections and ransomware attacks that are costly for the organisation.

What your colleagues learn

• Attackers will use any emotion that works. A warning that an account will close, a message that seems to come from the boss, a prize or an alert about unusual activity all push people to act before they check.
• Tailored attacks are much harder to spot. An attacker who knows someone’s job title and the company’s IT supplier can phone them by name, pose as IT support and ask for remote access.
• Being helpful can be used against people. A stranger who asks for a door to be held because they forgot their badge is counting on people wanting to help and to avoid an awkward moment.
• A feeling that something is off is worth acting on. Pressure to act fast, or an offer that sounds too good or too bad to be true, is a signal to check the request before doing anything.