“Social Engineering” tactics are often used by attackers to get someone to divulge personal information or to perform some action.  What can you do to protect yourself from such attacks?Give a couple of examples of attempts that might occur and your recommended method of dealing with them.

Introduction :

What are social engineering attacks :

The practise of persuading others to carry out a desired activity, such as disclosing private information, is known as social engineering. Attacks using social engineering succeed because strong reasons like money, love, or terror can persuade others to take action. By providing misleading opportunities to satisfy those impulses, adversaries prey on these traits. A numbers game is used in the simplest social engineering attacks: give enough individuals the possibility to win a few million dollars, and some will inevitably respond. However, these assaults are frequently fairly sophisticated, and even someone with a high level of suspicion can be duped.

Cybersecurity experts are very concerned about social engineering attacks because users can still be tricked into handing their credentials to a hostile actor, no matter how robust the security stack is or how well-honed the policies are. Once inside, the hostile actor can utilise the stolen credentials to pose as the authentic user in order to roam around, discover what defences are in place, install backdoors, and commit identity theft.

Attacks by social engineers may involve one or more steps. To prepare for an assault, a perpetrator first looks into the target in order to learn background details like probable points of entry and lax security measures. The attacker next makes an effort to win over the victim's trust and offer incentives for later security-breaking activities, such disclosing confidential information or allowing access to vital resources.

What are some common types of social engineering attacks :

Phishing :

The most well-known social engineering technique is a phishing attack. A phishing assault motivates its victims to take action by using an email, website, web advertisement, web chat, SMS, or video. Phishing attacks could pose as coming from a bank, delivery service, or government organisation, or they might be more targeted and pretend to be coming from a specific division of the victim's business, like HR, IT, or finance.

There is a call to action in phishing attack emails. They can request that the victim click on a URL that leads to a fake website or a dangerous link that downloads malware.

Baiting :

A victim may be drawn in by a tempting offer, such as free music, games, or ringtones, in a baiting assault in the hopes that the password they use to log in and access the free digital products is one they've already used on other, more significant websites. Even if the password is unique, the attacker can still package it with hundreds of other passwords and sell it on the dark web.

In the workplace, a flash drive left in a visible area, like the lobby or break room, is more likely to be the basis of a baiting assault. The drive uploads malware into the environment when the person who finds the drive plugs it into the corporate network to see who it belongs to.

Quid Pro Quo :

Similar to a baiting assault in that it targets a specific person with an offer to pay for a service, a quid pro quo attack is a social engineering scam. For instance, the threat actor can pose as an academic researcher willing to pay for access to the business setting.

Pretexting :

Pretexting is a type of social engineering in which the attacker creates a fictitious situation, or "pretext," to win the victim's trust. They might do this by posing as an expert investor, an HR representative, or another someone who seems trustworthy. Pretexting uses a sense of urgency, an offer that seems too good to be true, or an attempt to win over the victim's sympathies to prey on their emotions.

Tailgating :

Attacks on those who are tailgating are distinctive since they only take place in person. A tailgating attack, often referred to as a piggyback attack, happens when an attacker enters a building by persuading a worker to hold the door open for them. The attacker will try to steal or destroy any data and information once they are inside the facility.