Social Engineering

Social engineering is obtaining confidential information or access by manipulating people. The attacker does not break into the computer system; they persuade someone who is allowed to use it to hand over what they need.

Pretending to be someone trusted

An attacker's request only works if the victim believes it is genuine. Attackers therefore impersonate a person or organisation the victim already deals with, such as their employer, school, a delivery company or a colleague in another department. A phone call, message or face-to-face conversation can all be used, so the attacker does not need any technical skill.

For example, a man wearing a lanyard and carrying a toolbox arrives at a school reception. He says the company that maintains the school network has sent him to check the server room, and mentions the name of the deputy head as though he has worked with her before. The receptionist signs him in and lends him a key. Nobody challenges him because he looks as though he belongs.

What the attacker is after

Attackers want information that unlocks money or systems:

• Usernames and passwords, which give access to accounts and networks.
• Bank and card details, which are used to spend the victim's money or take out credit in their name.
• Other personal data, such as dates of birth or addresses, which is sold on or used to make the next trick more convincing.

Often only the first step

Social engineering is frequently used alongside a technical attack. Details handed over during a convincing conversation let the attacker log in as a real user, install malware or copy files out. The technical attack succeeds because the attacker already has valid access.