Connect with us

Hi, what are you looking for?

OPINIONS

Simple steps to protect you against COVID-19 social engineering attacks

As people around the world are faced with fears and concerns over the COVID-19 virus, criminals are also taking note.

By Renee Tarun
Vice President of Information Security, Fortinet

As people around the world are faced with fears and concerns over the COVID-19 virus, criminals are also taking note. And unfortunately, they are using this as an opportunity to try and steal money and personal information by generating social engineering scams via email, text, and phone calls. 

Over the past few weeks, there has been an increase in attempts to lure unsuspecting victims into going to malicious sites, clicking on malicious links, or providing personal information over the phone under the auspices of COVID-19. Many of these scams attempt to impersonate legitimate organizations, such as the Center for Disease Control or the World Health Organization, by offering fake informational updates and even promises of access to vaccines – all for a price, of course.

Social Engineering Constantly Preys on the Only Vulnerability That Cannot Be Patched, Humans – You and Me

Moreover, nobody is safe from these efforts – from administrative employees, contractors, and interns on up to the C-Suite and even business partners can be targets to obtain access to our networks and sensitive information. And for those of us now connecting to the office through our home networks, even our children are potential targets. It is a perpetual bombardment, every day, every minute of the day, 24/7/365. 

Advertisement. Scroll to continue reading.

Threat actors prefer the path of least resistance. They hack the psyche of targets (who rarely realize the disguises) as well as rely on publically available intelligence and interactions to generate victim profiles. Cybercriminals are experts in the art of masquerading, manipulating, influencing, and devising lures to trick targets into divulging sensitive data, and/or giving them access to our networks and/or facilities. 

Why Waste an Expensive 0-Day When Social Engineering Is So Effective?

Understanding the primary attack vectors used by the adversary is key when it comes to deterrence; examples of social engineering based attacks include the following. 

Digital Attacks

  • Phishing/Spearphishing – Email-based attacks that target everyone or a specific person or role within an organization in order to entice individuals to click on malicious links or enter credentials or other personal information.
  • Social Media Deception – Adversaries create fake profiles to befriend victims while posing as a current or former co-worker, job recruiter, or someone with a shared interest on social media, especially LinkedIn. Their goal is to trick the victim into providing sensitive information or downloading malware to their device.
  • Pretexting –Attackers focus on creating a good pretext, or a false but believable fabricated story, so that they can use it to pretend to need certain information from their target in order to confirm their identity.
  • WaterHoling – An attack strategy where attackers gather information about a targeted group of individuals within a certain organization, industry, or region as to what legitimate websites they often visit. Attackers look for vulnerabilities in these sites in order to infect them with malware. Eventually individuals in the targeted group will visit those sites and then become infected.

Phone Based Attacks

  • Smishing – A text-based message attack that impersonates a legitimate source in order to lure a victim into downloading viruses and malware onto their cell phone or other mobile device.
  • Vishing – Phone-based attack in which adversaries call a cell phone pretending to be from a legitimate source, such as a bank, as a means to try and convince the target into divulging sensitive information such as credit card information or social security numbers. Tactics used by these scammers often rely on what’s known as “caller ID spoofing.” ID spoofing allows them to generate phone calls that appear to be from a legitimate or local sources.

While our goal is to stay ahead of attacks, even the most advanced technology cannot always provide sufficient blockades against the constant barrage of cyberattacks, especially social engineering. The problem is, human error is involved in 95% of all security breaches. That is why it is imperative to ensure you and your fellow employees become the first line of defense, and that requires becoming security aware.

Strengthen Security by Taking These Simple Steps to Protect Your Personal and Proprietary Information

  • Be suspicious of any email or text message requesting sensitive information or financial transactions 
  • Hover over and review all hyperlinks prior to clicking to confirm they are from legitimate sources
  • Use multi-factor authentication for gaining secure access to sensitive systems and databases 
  • Ensure your browser, mobile devices, and computer systems are updated with the most recent protections
  • Never reuse passwords across multiple accounts and devices. Password uniqueness and complexity are paramount to safeguarding against additional risk to our networks

We have all been practicing social distancing over the last few weeks to protect against viruses and illness. Likewise, we should consider cyber distancing ourselves from our attackers. Keep your cyber distance by staying wary of suspicious requests, unknown attempts at contact, and unsolicited information and be the protector of your information, your networks, and your health. 

Advertisement
Advertisement
Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

According to a report, downtime and lost productivity are the most concerning business problems caused by ineffective IT security, an opinion expressed by 38%...

HEADLINES

Companies plan to increase their IT security budgets by up to 9%. The median cybersecurity budgets for large enterprises were US $5.7M with US...

HEADLINES

Globe has been a consistent advocate for a safer and more responsible digital space

HEADLINES

The attackers used a series of campaigns with novel exploits and customized malware to embed tools to conduct surveillance, sabotage and cyberespionage as well...

HEADLINES

Financial phishing attacks are rapidly increasing in the country as cybercriminals continuously evolve and adapt their tactics, making them sophisticated. The number of attacks...

HEADLINES

A Scale of Harm study by the International Justice Mission revealed that almost half a million Filipino children were trafficked to produce new child...

HEADLINES

Yondu launched an extensive, month-long cybersecurity awareness campaign focused on modern threat detection, incident response, and social engineering defense.

ELECTRONICS

Philips EasyKey partnered with Megaworld and equipped their world-class properties with only the best-in-class smart locks we have on offer, the Philips EasyKey 9300.

Advertisement