Social Engineering

Social engineering is the use of deception to trick people into giving away information or access. The attacker does not try to break the software or crack the encryption — they go after the person using it instead.

Why people are the weak point

A system can have strong passwords, encryption and a firewall, but all of that only works if the people using it behave safely. Social engineering gets around technical security entirely: if you can be talked into holding a locked door open for someone, no amount of good software protects the system. That is why people are described as the weak point in a system.

The attack only works because of ordinary human behaviour, so it plays on feelings rather than on software flaws:

• Trust — you believe someone who sounds official, so you answer their questions.
• Fear — you are told your account will be closed down unless you confirm your details.
• Urgency — you are pushed to act quickly, before you have time to check whether the request is genuine.
• Curiosity — an email from a stranger headed "photos from Saturday", or a link promising to show who has viewed your profile, is hard to ignore.

What the attacker wants

The purpose is to obtain information or access that the attacker should not have. That could be a door code, the name of the company's email provider, a delivery date, or one password. The gain is often small, but it is a way in: one password can lead to an email account, and an email account can lead to everything else.

Phishing is the best-known form of social engineering, but the trick works face to face or over the phone just as well.

Worked example

Your phone rings. The caller says they are from the school's IT support and that your account is about to be deleted, but they can save it if you confirm your username and password right now. There is nothing technical about the attack — no software is broken — but the story, the authority and the pressure of the deadline are designed to make you answer before you think about whether the call is real.