Social Engineering
Social engineering is the psychological manipulation of individuals to bypass security processes or disclose sensitive information. It is one of the most powerful attack strategies because it targets human behavior rather than technology.
Table of Contents
- What is social engineering?
- How it typically works
- Common techniques and variants
- Impact
- Further reading
What is social engineering?
Social engineering is at the core of many cyberattacks. It involves tricking people into breaking security protocols or handing over confidential data. Attackers exploit emotions such as fear, trust, urgency, or curiosity to increase compliance.
How it typically works
- Reconnaissance: attacker gathers personal, professional, or contextual information about the target.
- Approach: attacker initiates contact using a convincing pretext, often through email, phone, or social media.
- Manipulation: attacker persuades the victim to provide information or perform actions against their interest.
- Exploitation: attacker uses the gained access or data to commit fraud, escalate privileges, or deploy malware.
Common techniques and variants
- Phishing: mass or targeted fraudulent messages designed to harvest data
- Spear phishing: highly targeted phishing with personal details
- Smishing and vishing: social engineering adapted to SMS and phone calls
- Pretexting: creating a fabricated scenario to justify a request
- Baiting: offering something desirable (free downloads, media) to trick victims
Impact
Social engineering is often the starting point of security incidents. It enables attackers to bypass technical defenses by exploiting the weakest link: human behavior. Impacts include identity theft, fraud, unauthorized access to sensitive systems, and large-scale data breaches. For organizations, social engineering not only leads to financial and operational damage but also exposes gaps in awareness and training.
Further reading
- NIST: Social Engineering. Read more
- CISA: Avoiding Social Engineering Attacks. Read more
- OWASP: Social Engineering. Read more