New data shows that despite the massive evolution of the cybercrime economy, threat actors are sticking with the basics in social engineering attacks, with a goal at stealing data.
I probably could have called this purely based on all the articles I’ve written (and all the articles I’ve read that never made it here). But when it comes to protecting your organization from social engineering, stick to the basics.
According to the latest Verizon Data Breach Investigations Report, data breaches that rely on social engineering use three basic methods – pretexting, phishing and extortion, as shown below:
Source: Verizon
All three methods rely on establishing credibility with the victim enough to get the victim to respond. Pretexting is the most rudimentary social engineering where the attacker attempts to get the victim to trust them and, eventually, share information. It’s the precursor to other attack types and is used to gain intelligence that will be leveraged in a future threat action.
And because there’s no malicious links or attachments, there’s little means to detect it as being risky to the organization. That’s probably why we see it in the number one spot, represented in just over 40% of social engineering-based data breaches.
The use of pretexting also speaks to the need to educate users about such “attacks” (which won’t feel like an attack at all, but more a reaching out and establishing content) through security awareness training designed to elevate a users sense of vigilance such that, even when an email appears benign in nature, there’s still a default level of disbelief and scrutiny, helping to lower the risk of an attack.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
