Why is Social Engineering so Effective?

According to the CSO, in 2020, 6.95 million new phishing and scam pages were created, with the highest number of new phishing and scam sites in one month of 206,310.

• Key themes: COVID, gift cards, and gaming hacks.
• The three most targeted industries: technology, retail and finance.
• The top three countries hosting scams: US, Russia and British Virgin Isles.
• Gmail was the most popular email service used for phishing kits.

Sources: https://www.csoonline.com/article/3634869/top-cybersecurity-statistics-trends-and-facts.html, https://cobalt.io/blog/cybersecurity-statistics-2021, https://www.proofpoint.com/us/resources/threat-reports/state-of-phish

The six principles of influence

• 1. Reciprocity – If someone does a favour or gives you something, even if by accident, you feel inclined to return the favour or give them something back. Reciprocity is the universal understanding of repaying a favour or treating others the way they treat you. In social engineering, reciprocity would be a threat actor requesting sensitive data in return for a freebie.
• 2. Commitment and Consistency – To maintain a consistent sense of self, we may choose to stick with our decisions even if we know they are wrong. In social engineering, an employee would be committed to revealing sensitive data and portraying consistent behaviour when requested to do so, even though they understand the risks.
• 3. Social Proof – Human behaviour shows we are heavily influenced by what others do, including forming an opinion or decision-making. In social engineering, an employee could be influenced by a threat actor who provides false evidence that a colleague has complied with a request.
• 4. Liking – People will more likely do something for someone if they like them. Spear phishing is a type of social engineering attack whereby a hacker will take on the guise of a genuine person or organisation to lure victims into gaining their trust with the goal of stealing sensitive data.
• 5. Scarcity – People want things that are scarce as it makes them feel more special. An offer is more appealing when there are limited quantities available because of this principle. In social engineering, a threat actor may provide a potential victim with a persuasive reason to reveal sensitive information with urgency.
• 6. Authority – People usually submit to authority and will generally follow their lead. In social engineering, any demands from what someone deems to be an authoritative figure such as a CEO can influence an employee into taking actions which will be harmful to the business such as sharing business-critical data. Spear phishers will use a principle like authority to their benefit.