What's in it for the Social Engineers?

A necessary skill for any successful hacker is an understanding of how the human mind works, according to a post in IT Pro. Knowing how to manipulate technology is a major part of the job, but this knowledge
can be complemented with social engineering to launch much more successful and efficient attacks.

These talents can be used for good, and many white-hat hackers have made successful careers out of being able to think outside of the box. James Plouffe, a strategic technologist at MobileIron, told IT Pro that hackers will always be one step ahead of technical solutions.

“The nature of the hacker has been one of constant evolution and, to some extent, hackers have always been able to remain ahead of technology” Plouffe said. “In recent years, the advancement and uptake of cloud computing have eroded the traditional network perimeter, providing hackers with an ever- increasing number of access points to enterprise resources to exploit. The standard equipment used to secure the traditional network perimeter, such as gateways and firewalls, are no longer fit for purpose.” An anonymous ex-hacker who works for Rapid7 told IT Pro that social engineering is the easiest way to breach an organization’s perimeter.

“The human factor is often the weak point, and social engineering is the typical tool to take advantage of that weak point,” he said. “Social engineering often does not require any advanced technical skills and is the quickest and easiest method to compromise an organisation. Although with proper training and education, this weak point can be reduced but not eliminated. However, if training is combined with solid incident detection and response (IDR) solutions, organisations can greatly reduce the risk and impact of these types of attacks.”

Likewise, Roger Grimes, KnowBe4’s data-driven defense evangelist, said that social engineering plays a role in most attacks.

“About 70-90% of all successful malicious hacking happens because of social engineering,” Grimes said. “So, it’s by far the biggest threat out of all types of hacking. But technical attacks play a role in 20-40% of all hacks as well. Hacking by social engineering is so easy to do that most white hat penetration testers I know don't want to use it as it's too easy and too boring.”

Technical solutions and employee education are both essential defenses for every organization. New-school Security Awareness Training can minimize your risk surface by addressing the human weaknesses within your organization.

IT Pro has the story: https://www.itpro.co.uk/security/hacking/354310/inside-the-mind-of-a-hacker