In a recent Tessian podcast episode, Jenny Radcliffe, world-renowned social engineer, explained how cybercriminals can manipulate employees and revealed what organisations can do to mitigate this risk.

Listen to the full podcast here, or read on for Jenny Radcliffe’s top three takeaways.

The bulk of cybersecurity attacks are planned with humans in mind

There is no typical day in the life of a people hacker, but there are common elements between assignments: 

• Can I get past the humans?
• Can I get past the physical security?
• Why is this the case?

When preparing an attack, I want to know everything about the target organization. This includes how it started, who founded it, whether it is public or private, and how the organization has evolved. You might be surprised by the level of detail, but these details help me uncover the personality of the organization, and let me know what makes it tick. I treat each organization and the people in it as though they were one entity – and I need to know that entity very well if I want to successfully infiltrate it.

I also look at the way people move around the building, where they go to share secrets, and the secret things that the employees do. I need this information to help me identify and get to know my target. Additionally, I look at the teams and where they congregate – officially and unofficially. There are unofficial sources of power and news in every organization, because there will always be someone who knows everything and everyone, and communicates that information freely. As attackers, we are looking to know the organization just as well as a person who works there – possibly even better. 

So, the piece of advice that I always give is to know your organization better than the bad guys. Know your people really well so that if something falls out of sync, you notice.

Social engineering attacks are often more sophisticated than people think.

I only decide who I am going to target once I have enough background information. This is because I want my attack to hit home. A scattergun approach is not good enough – I need whatever I say, whether in an email or in person, to resonate with the recipient so much that they cannot help but respond.

With a human target, I find out the answers to questions such as: 

• What do they protect?
• What do they love/hate?
• What is the last thing they’d give up?
• What are they frightened of?

If I then combine this information with local knowledge, establish some trust and authority, and use persuasion techniques, that person is highly vulnerable when I do eventually communicate with them.

So these attacks are very precise, but there are still many people in cybersecurity who don’t understand that. Many think that all I do is put on a cheeky smile and tailgate into buildings – and I do do that! But it is a little more sophisticated, with a lot of preparation, and that’s because the targets that I deal with and the problems I’m given to solve are fairly complicated.

Technical solutions should be implemented in combination with human solutions

We have to work with humans in tandem with technical solutions. Technical solutions can limit access, and track and detect problems. This helps in preventing an attack from getting to a human in the first place, which is great. I think that the problem is that it is easier to buy and implement technical solutions than it is to fix your culture and really understand the way your people work. 

The issue of insider threats and security culture generally isn’t something you can throw money at. It needs time, attention and focus. Again, the answer comes back to knowing your humans better than bad guys do – and this should be the case at line manager level. Because if you do not do that, cyber criminals will find someone who is chatty, unhappy, naive, or new and they will find a way to get to them. 

This is why you have to be able to see when someone is behaving differently, and that person needs to feel like they can come to you if something is not right. You can throw money at the problem, but ultimately you have to understand your people – people are the question, and they are the answer. 

For more from Jenny and the secrets behind social engineering attacks, listen to our Tessian Podcast episode, here, or check out her podcast – Human Factor Security.