Purpose of Social Engineering

The purpose of a social engineering attack is what the attacker is trying to achieve — the reason for deceiving a person in the first place. The trick is only the method; the purpose is the prize behind it. Most attacks are aimed at one of a small number of gains:

• Login details, so the attacker can sign in as someone else.
• Money, through bank details, card numbers, or a payment the victim is talked into making.
• Personal data such as names, addresses and dates of birth, which can be sold on or used for fraud.
• A route past the organisation's defences for malware, by getting a user to open an attachment or install a file that its filters would otherwise have blocked.
• Access to a network or a building, such as a password, a door code or a door held open for a stranger.

How, purpose and threat

When you describe a social engineering attack in a scenario, give three parts. How the attack was used — the method and what the victim was persuaded to do. The purpose — what the attacker gained or was trying to gain. The threat it posed — the harm that could follow for the devices, systems or organisation. Stopping at “they sent a fake message” describes the method but says nothing about why it was sent.

For example, a message posted in a school class chat, apparently from a teacher, asks students to sign in through a link to confirm next year's subject choices. How: students are rushed into typing their school username and password into a page that only looks like the school login. Purpose: the attacker collects dozens of working logins. Threat: every one of those accounts can then be opened, so coursework, email and saved files could be read, changed or deleted, and more messages could be sent from an account people already trust.