Blog Elements

What is social engineering, according to Merriam Webster social engineering is “management of human beings in accordance with their place and function in society” (www.merriam-webster.com, 2014). Social engineering is a non-technical form of intrusion that relies on human interaction in an attempt to get the victim to break normal security. An example would be the hacker acting like an engineer calling a company trying to get information on what type of firewall or networking equipment is being used in a company. This information could be used to help a perpetrator to gain access to the system, by allowing them to research vulnerabilities and default passwords.

Most exploits to a system are through social engineering. Almost everyone has received an email offering a free flashdrive, whitepaper or etc for filling out a survey. Moreover, have received an email from the bank or credit card company saying that there is suspicious activity on their account and please provide critical information needed to take care of the problem.
Why would a social engineer attempt to “hack” the person instead of hacking the system directly? The person is usually the weakest link. There is a lot more effort needed to gain access to the system by going through firewalls then tricking an unsuspected user.

Some of the techniques that a social engineer uses are Quid pro quo, Shoulder Surfing, Pretexting, Phishing, Spear Phishing, IVR/Phone Phishing, Trojan Horse, Dumpster Diving and Road Apples to name a few.

“Since there is neither hardware nor software available to protect an enterprise against social engineering, it is essential that good practices be implemented” (Peltier, 2014). How do we defend against the social engineer? Some practices that should be deployed:

Read the rest on Examiner.com’s website.

SANS Network Security 2014: Las Vegas, NV: October 19-27

2014-07-21/0 Comments/in General Security/by SecurityOrb_Staff

SANS Network Security 2014 is coming up soon in Las Vegas on October 19-27. Join SANS at Caesars Palace for more than 45 cybersecurity courses, special events and evening talks, and a huge vendor expo, all of which are offered to teach you a valuable skill set that you can put to work as soon as you return to the office.

To see our list of courses, with links to the course descriptions, GIAC Certs offered, and instructor bios, please visit: http://www.sans.org/info/164367

(***Save $150 off your SANS Network Security 2014 course: use the ‘SANS_SecOrb150’ code when registering***)

SANS Network Security 2014 is your networking opportunity with something for everyone! The following new hands-on immersion courses will be available:

New! SEC511: Continuous Monitoring and Security Operations taught by Eric Conrad
New! SEC760: Advanced Exploit Development for Penetration Testers taught by Stephen Sims
New! FOR526: Memory Forensics In-Depth taught by Alissa Torres
New! FOR572: Advanced Network Forensics and Analysis (GIAC-GNFA, Simulcast) taught by Philip Hagen
New! FOR585: Advanced Smartphone Forensics taught by Heather Mahalik
New! ICS410: ICS/SCADA Security Essentials (GIAC-GICSP) taught by Graham Speake
New! HOSTED: Embedded Device Security Assessments For The Rest Of Us taught by Paul Asadoorian

Don’t miss the opportunity to participate in the SANS NetWars Tournament, a live and timed event that runs over an intense two-evening period – October 23 and 24 with Ed Skoudis. It is a competitive environment that creates a sense of urgency and pressure among the participants, with a real-time scoreboard available for viewing. Many enterprises, government agencies, and military organizations rely on NetWars Tournament training to help identify skilled personnel and as part of extensive hands-on skill development.

Another option is SANS DFIR NetWars Tournament on the evening of October 23 and 24 with Rob Lee. This is an incident simulator packed with a vast amount of forensic and incident response challenges, for individual or team-based “firefights.” It is developed by incident responders and forensic analysts who use these skills daily to stop data breaches and solve complex crimes. DFIR NetWars Tournament allows each player to progress through multiple skill levels of increasing difficulty, learning first-hand how to solve key challenges they might experience during a serious incident. DFIR NetWars Tournament enables players to learn and sharpen new skills prior to being involved in a real incident.

Also, enrich your conference experience – at no charge to all who register for a course! Our bonus sessions are open to all paid attendees at no additional cost.

You won’t want to miss SANS Network Security 2014! SANS’ top-rated practitioner instructors are looking forward to seeing you there. For complete details regarding the training event and to register, please visit: http://www.sans.org/info/164367

(***Save $150 off your SANS Network Security 2014 course: use the ‘SANS_SecOrb150’ code when registering***)