There is a says that "There is no patch for human stupidity" Human is the weakest point of any system, In the field of Security "Social Engineering" is a very popular technique to gather information.

A lot of employees Knowingly or Unknowingly becoming the thread for organization So my question is How can someone prevent to be a victim of social engineering?

  • 2
    This question would be better asked in the information security stack exchange - although I would suggest searching there first, since it's probably already been asked and answered.
    – Kate Paulk
    Jun 13 '17 at 11:17
  • @KatePaulk this or any similar Question is not available on information security stack exchange I searched before asking. thanks Jun 13 '17 at 11:30
  • @nitinr - Your question still belongs to security exchange, not here. Show me the proof. Did you asked there? Show me the link. Show me your research. Jun 13 '17 at 13:51
  • 3
    I'm voting to close this question as off-topic because - it is related to security, not testing. Jun 13 '17 at 13:51
  • 1
    You could do worse than reading the answers to the questions listed here security.stackexchange.com/search?q=social+engineering None ask your specific question, but many come close, particularly the ones about defending against social engineering.
    – Kate Paulk
    Jun 13 '17 at 14:06

Continuous education is the key. Implement a strict security policy as well.

Social engineering threat originates from both internal employees and external strangers.

For Internal Employees:

  • In recent years, the most common factor in security breaching is revenge. People do not walk around with a revenge meter on the top of their heads, so there is no way to effectively identify people who are holding a grudge and about to breach security via social engineering.
  • People who hold a grudge can look over others' shoulders for admin passwords, can sweet-talk to other colleagues into giving away confidential information and etc.
  • Continuous education is the best defense you can get, although it is not a silver bullet.
  • A company should establish its own security policy and educate its employees on regular intervals.
  • Do not allow an employee to bring in their own laptops or take home work laptops if the project they are working on has a high sensitivity.
  • Limit sensitive information to a need-to-know basis.

For external strangers:

  • External strangers will have to "social engineer" internal employees into giving away information.

  • Educate internal employees so that they are less likely to give away confidential information.

  • Do not allow internal employees to take home any data storage hardware.

Will it work?

  • To a degree, yes, but there is no bullet-proof in social engineering prevention.

  • People will tell others secret voluntarily just to show off "I know something you do not."

  • People will steal information for money, for revenge and etc.

  • When a company grows beyond a certain size, you can not effectively control so many people or monitor them, at the end of the day, it all comes down to their willingness to keep a secret.

Not the answer you're looking for? Browse other questions tagged or ask your own question.