Hackers build trust to gain access to information systems. It takes more time to build trust. Attack vectors –vishing, tailgating, pre-texting (making a situation happen so the victim initiates contact

Koome, Ian

Owino, Michael Ogada

Oyuga, Victor

SU+ Digital Repository

Human Exploits in Cyber securityAuthors:Michael OwinoIan KoomeVictor OyugaPre-emptionWhat is Social engineering?An attack vector which malicious individual(Hackers)use psychological manipulation to exploit human weakness to gain illegitimate access to information or systems.Human weakness AuthorityIt commands respect to high ranking officials .Commands or emails from high ranking officials are treated with urgency unlike peer staff.An example is spear –phishing attacksLiking and FamarialityUse of celebrities by well known companies to push their agenda.Example is Shoulder surfing, tailgating, Evil twin and pharming.Human weaknessReciprocation of favorsHackers build trust to gain access to information systems.It takes more time to build trust Attack vectors – vishing,tailgating,pre-texting(making a situation happen so the victim initiates contact) Social validationPeople are often more willing to do something that others like Attack vectors – Rogue websites with falsified information, pharming and phishing.Human weaknessScarcity People are often encouraged when they think there is a limited quantity .”Click here to get a free phone”Attack vector – phishing CuriosityPeople always want to meddle in other people’s business and this can make them vulnerable.Attack vector – Phishing, water-hole attacks, evil twin attacks. ”Amazon would like your feedback to the item below …”Statistics• Total cost and % of cyber cases in 2017 by Serianu.• Social engineering attacksamounted for 65 % of the attacks(worth $136.5) in 2017. S.E. Data exfiltration Attack on computers RansomStatisticsBreakdown of attack vectors used in social engineeringStatisticsMost affectedSectorsImpacts of social engineering StatisticsMost attacked ports Most used spam  servers DEMOSOLUTIONSHow will we protect ourselves ?EDUCATE!  EDUCATE!• Use of on-screen keyboards when using highly protected websites for example banking apps• Scrutinize email before opening the email and attachments too.(Hovering on the links to confirm legitimacy)• Never share personal information over email / phone ensure proper authentication• Use ALT +F4 /CMD + Q to close pop ups as you are one clicking away from being infected.• Never ignore an important update SOLUTIONS• How to detect phishing emailsSOLUTIONSLinkedIn phishing messages SOLUTIONSMacros in word documentsSOLUTIONS• Strict internal policy controls in organizations.• Frequent assessment of organization security defense.• Use of sentence – length passwords which are frequently changed.SOLUTIONS• Proper employee and contractor management when they resign avoiding insider attacks.• Defense in depth – use of antivirus , Cisco Stealth watcher(DNS attacks), DMZ, Email proxies.Remarks“The internet never forgives and never forgets”

Human exploits in cyber security

https://su-plus.strathmore.edu/bitstream/11071/6422/1/Human%20Exploits%20in%20cyber%20security.pdf

Human exploits in cyber security

Abstract

Similar works

Full text

Available Versions

SU+ Digital Repository