2

There is a says that "There is no patch for human stupidity" Human is the weakest point of any system, In the field of Security "Social Engineering" is a very popular technique to gather information.

A lot of employees Knowingly or Unknowingly becoming the thread for organization So my question is How can someone prevent to be a victim of social engineering?

closed as off-topic by alecxe, Bharat Mane, Peter M. - stands for Monica, Kevin McKenzie, IAmMilinPatel Jun 14 '17 at 2:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about software engineering unrelated to testing are off-topic here, but can be asked on Programmers Stack Exchange." – alecxe, Bharat Mane
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    This question would be better asked in the information security stack exchange - although I would suggest searching there first, since it's probably already been asked and answered. – Kate Paulk Jun 13 '17 at 11:17
  • @KatePaulk this or any similar Question is not available on information security stack exchange I searched before asking. thanks – Nitin Rastogi Jun 13 '17 at 11:30
  • @nitinr - Your question still belongs to security exchange, not here. Show me the proof. Did you asked there? Show me the link. Show me your research. – Peter M. - stands for Monica Jun 13 '17 at 13:51
  • 3
    I'm voting to close this question as off-topic because - it is related to security, not testing. – Peter M. - stands for Monica Jun 13 '17 at 13:51
  • 1
    You could do worse than reading the answers to the questions listed here security.stackexchange.com/search?q=social+engineering None ask your specific question, but many come close, particularly the ones about defending against social engineering. – Kate Paulk Jun 13 '17 at 14:06
2

Continuous education is the key. Implement a strict security policy as well.

Social engineering threat originates from both internal employees and external strangers.

For Internal Employees:

  • In recent years, the most common factor in security breaching is revenge. People do not walk around with a revenge meter on the top of their heads, so there is no way to effectively identify people who are holding a grudge and about to breach security via social engineering.
  • People who hold a grudge can look over others' shoulders for admin passwords, can sweet-talk to other colleagues into giving away confidential information and etc.
  • Continuous education is the best defense you can get, although it is not a silver bullet.
  • A company should establish its own security policy and educate its employees on regular intervals.
  • Do not allow an employee to bring in their own laptops or take home work laptops if the project they are working on has a high sensitivity.
  • Limit sensitive information to a need-to-know basis.

For external strangers:

  • External strangers will have to "social engineer" internal employees into giving away information.

  • Educate internal employees so that they are less likely to give away confidential information.

  • Do not allow internal employees to take home any data storage hardware.

Will it work?

  • To a degree, yes, but there is no bullet-proof in social engineering prevention.

  • People will tell others secret voluntarily just to show off "I know something you do not."

  • People will steal information for money, for revenge and etc.

  • When a company grows beyond a certain size, you can not effectively control so many people or monitor them, at the end of the day, it all comes down to their willingness to keep a secret.

Not the answer you're looking for? Browse other questions tagged or ask your own question.