How do you a prevent Social Engineering attack IA?

Answer 1

It's pretty tough to prevent a social engineering attack - but you can prevent such an attack from being successful...

Three pillars of defeating attempted social engineering attacks are:

1) Policy and procedure

2) Education

3) Enforcement

Nearly all social engineering attacks attempt to trick people into doing something that in retrospect is STUPID - like giving out their passwords to a stranger over the phone. Companies and individuals can fight this kind of attack by establishing policies and procedures for dealing with all incoming communications. These may or may not include: never opening email from unknown sources, never providing access information over the phone or by email, and independent verification of the source of any request for information. The point of the policies and procedures is that if they are well crafted, social engineering attacks usually cannot work.

Even the best policy or procedure is useless if the users don't know about it. Education needs to occur early and often. Users should be educated on the policies and procedures before being granted access to a computer system and required to undergo refresher training on a regular basis. As new threats and scams appear, the users should be alerted to them.

Finally, if the users don't follow the policies and procedures, they still don't do any good. This is where enforcement comes in. System administrators and managers should enforce the policies and their should be consequences if a user is found not to be following them. The consequences should be proportional to the risk incurred by the violation however. They can range from a gentle reprimand (like I do with my kids on occasion when they do something dumb) to cutting off system access, to termination, and, in extreme cases, prosecution. It is human nature to ignore rules if they are not enforced, so enforce them!