Social engineering exploits human behavior such as helpfulness or respect for authority to obtain confidential information. When communicating with unknown people, be careful what information you disclose.
Places and media used for social engineering:
- public transportation
- at the lunch table
- at business events
- in the company parking lot
- by telephone
- by e‑mail
- online surveys
- through spyware
Typical information attackers are interested in:
- Company secrets and intellectual property (IP)
- Organization charts
- Supplier relationships
- Customer relationships
- Price information / price lists
- Passwords & access data
- Information about the used IT systems
- Information about IT security systems
Keep in mind: Partial information that seems unimportant individually can be combined from different sources and then used for planning a social engineering attack!
Internal (primarily sensitive) information must not be shared unchecked with third parties whose identity is not clearly established and confidentiality agreements legitimize the arrangements.
You can find a list of all security awareness tips from SEC4YOU in our sticky notes.
