When considering cyber attack methods a cybercriminal may use to gain access to a network or business’s IT system, the most obvious are cracking passwords, hacking computers or exploiting software vulnerabilities. However, one of the most dangerous methods is often not given enough attention. They are social engineering attacks.

What is social engineering?

Social engineering attacks rely on human interaction to manipulate users into breaching security policies or giving away sensitive information. These attacks are often highly effective as it is easier to find vulnerabilities in people than it is to find vulnerabilities in software or networks.

The first stage of many social engineering attacks is for the cybercriminal to perform research on the target employee or business. Through this research they formulate an attack by engaging and deceiving the victim to gain malicious access to a network or system. 

Common social engineering attacks

Phishing

Phishing is the most common social engineering attack, and one of the most common attack vectors in general. A phishing attack is where an attacker sends a fraudulent email disguised to be from a trusted source, with the goal of tricking the victim into clicking a malicious link or downloading a malicious file. 

Some phishing attempts may be sent out in bulk and be easily spotted through poor spelling and punctuation or if it is sent from an unknown email address. However, threat actors may do significant research before crafting a phishing email to tailor it to the victim. This may include making it look like the email is from a vendor or customer, or including information highly relevant to the target in order to gain their trust, making it more likely for them to open a link or download a file. 

Hackers can also spoof the email address to make it seem as though the email is sent from a trusted sender.

To protect your humans, employees, from phishing attacks consider instigating phishing and security awareness programmes to education and train your user community to spot potential attacks. 

Baiting

Baiting is the process of luring a victim into a trap that compromises a company’s network or a user’s personal information. A common baiting attack method is to leave a USB in a business or its car park. The USB may have a label on it with text that will pique the interest of a potential victim, such as ‘private’ or ‘important’. Once the USB is connected to a computer it will run malicious code and the hacker will gain access to the network or IT systems.

Pretexting

Pretexting is a method of social engineering attack whereby the attacker attempts to convince the victim to share valuable information or login credentials to a network or system. The attacker assumes a false identity, often a position of authority, in order to fool the victim. An example of this may be an email impersonating a CEO or business executive asking for login credentials for a system as they have ‘forgotten theirs’. This method of social engineering can be similar to phishing, however the focus in on creating a false narrative to obtain the information.

Watering hole

A watering hole attack is a social engineering method whereby the attacker identifies a website that is frequented by a target user or organisation and compromises the website with malware in order to infect the target. This is also a method of supply chain compromise as it uses the prior research to compromise a third party to breach the actual target.

How to protect against social engineering attacks

As social engineering attacks are focused on human interaction, the best method of preventing them is through education of employees and a strong security culture within an organisation. For phishing, baiting and pretexting, employees should be aware of the risk of an attack and methods that cybercriminals are using as this will make it more likely for an employee to notice and report an attempted attack before it is too late.

It can be difficult for a business to protect themselves against watering hole attacks as it is a third-party website that is infected. However, if a business keeps their software and operating systems up to date it greatly decreases the chance of the malware compromising a system. For phishing and pretext attacks it is also best practice to have protection in place that will flag phishing emails, email spoofing and malicious links before they even arrive in an employee’s inbox. Mimecast uses AI to do this and can run internal phishing tests to ensure employees notice and report phishing attempts, which can further strengthen an organisation’s security culture.If you want to find out more on how to protect your business against social engineering attacks, get in contact with us or explore our cyber security updates here >

Cyber security incidents are becoming more frequent and the consequences more severe. In order to safeguard your business from an attack, first you must understand the tools and methods cyber criminals use to orchestrate these attacks. One of the key concepts to understand is what an attack vector is and what are the most common attack vectors.

What is attack vector?

An attack vector is the way a cyber criminal gains unauthorised access to a network or computer to carry out malicious activities. Once a hacker uses an attack vector to enter a network or computer they can then access confidential information on a business or individuals or infect the system with malicious programmes.

Book a free cyber security health check to get better visibility over your organisation’s vulnerabilities and risk profile >

The cyber security threat landscape is ever changing, so we’ve created a list of the 10 most common attack vectors to watch out for in 2021.

1: Phishing

Phishing is the most common attack vector and has been for many years. Phishing is where a cybercriminal contacts a target by email, telephone or SMS posing as a legitimate individual, or business to deceive the victim into clicking a malicious link or providing sensitive information, such as passwords or payment card information.

In the video below, Gary Duke discusses phishing attacks in more detail:

2: Lack of encryption

Whenever sensitive data is transferred is should be encrypted to ensure that even if it is intercepted it cannot be read without the encryption key. Many businesses still use unencrypted FTP sessions to transfer data, meaning that if a hacker intercepts the data, it is in plain text. It should also be noted that not all encryption is created equally. Low-level encryption is safer than no encryption at all, however, strong SSL/TLS encryption is favoured as it is significantly more difficult to obtain the encryption key.

3: Compromised or weak credentials

Compromised credentials is when a cyber criminal gain access to a network or system by obtaining the user credentials, such as a username and password. These credentials are often obtained through a phishing attack or poor password hygiene. Similarly, having weak credentials, such as a common password, allows cyber criminals easy access to a supposedly secure network.

4: Malicious insiders

When considering potential attack vectors, one that is often ignored is that of malicious insiders. These are individuals who are current or former employees that have legitimate access to company data and use this access to carry out malicious activities. This threat can be difficult to detect as employees need access to networks and data to do their jobs, however there are policies that can be put in place to reduce this risk. 

5: Distributed Denial of Service

Distributed Denial of Service or DDOS is a malicious attack where a cybercriminal overwhelms a target server, service or network with internet traffic to disrupt normal traffic. The goal of these attacks may be to stop legitimate traffic from visiting a site, or to overwhelm network equipment, such as firewalls, in order to launch another cyberattack.

6: Misconfiguration 

Misconfiguration is when a system is not configured correctly. For example, leaving the default username and password when configuring a device or in a setup page. This also includes not updating software when there are security patches and leaving unused features on a device enabled. This is particularly common with networking devices and database setups.

Many data breaches are because of poor configuration of a network, such as putting a CRM or HR server internet facing. Gary Duke explains why this happens in the video below:

7: Malware

Malware is one of the oldest forms of attack vector, first originating in the 1980s. Malware is any software that is intentionally designed to cause damage to a computer, server, or network. This includes viruses, ransomware and trojan horses. Malware is often distributed through malicious emails, websites and advertising.

8: Malvertising

Malvertising is a relatively new method of spreading malware, including ransomware. This attack vector is where a cyber criminal pays for legitimate advertising space on search engines and social networking platforms, but the website that is being advertising contains malware that when downloaded will infect the victim’s computer or network.

9: Brute force

A brute force attack is when a cyber criminal finds the correct login credentials to a secure device, account or network by submitting many passwords until they find the correct one. A hacker uses a programme to do this which can submit 1000s of login attempts per second. This attack vector is easy to negate with long, complex passwords that utilise numbers and special characters. 

10: Man-in-the-middle

A man-in-the-middle attack may include intercepting messages and emails between individuals that include sensitive data, or intercepting login credentials between a user and an IT system. There are many different methods that can be used to carry out a man-in-the-middle attack, however most of these can be avoided with firewalls, encryption, multi-factor authentication and a strong security culture within an organisation. 

These are the ten most common attack vectors. Some basic knowledge of each can help you identify attack attempts before they become a cyber security incident. However, for each of these 10 attack vectors there are multiple methods of execution, and each year they become more advanced. It can be difficult to stay up to date with each new method and best practice for avoiding an attack, so if you need help deploying a comprehensive cyber security solution to keep your organisation and data safe, let our cyber security services team know! 

The biggest cyber security threat we see in 2021 is phishing. In the last year phishing attacks have increased by 600% in part because of remote working, but also because they are a highly successful vector for cyber criminals.

In this video interview, Gary Duke, shares why this is and how you can protect your organisation from this cyber security threat.

Learn more about Phishing & Security Awareness as a Service here >