IE 11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Many Cyber Attacks Begin by Breaking Human Trust

Sophisticated social engineering attacks have led to hundreds of data breaches this year. What can be done? And what new resources can help?   

hands on a keyboard overlaid with 0s and 1s
Shutterstock/PabloLagarto
Recent cyber attacks directed at MGM Resorts International, Caesars Entertainment and other businesses began with sophisticated social engineering attacks that tricked help desk staff into resetting passwords and more.

“Help desks want to help people,” according to Kevin Mandia, Mandiant CEO, in a recent interview on CNBC’s "Squawk Box." But these groups are very sophisticated at creating ruses that fool staff.

“They [the attackers] are also doing something called SIM swapping, where they get one-time passwords texted to their phone. … These people are very clever at what they do because they are breaking human trust.”

Digging deeper, this article from Reuters provides more details on these cyber attacks: “David Bradbury, chief security officer of the identity management company Okta, said five of the company's clients, including MGM and Caesars, had fallen victim to hacking groups known as ALPHV and Scattered Spider since August. …

“The hacks have cast fresh spotlight on ransomware attacks — cyber intrusions that affect hundreds of companies every year, from health-care providers to telecom firms. MGM and Caesars lost market value last week as stock prices fell, and MGM is yet to recover from various operations disrupted at the hotels and gaming venues it owns from Las Vegas to Macau. …

“Bradbury said the group had breached into MGM and obtained access to its Okta client, which allowed it further access to more credentials in the identity management firm's system.

“Scattered Spider appears to have worked with ALPHV on the latest hacks, Bradbury said, citing research by security analysts who have tracked both groups. 'Think of them more as business associates or affiliates,' he said.”

SOCIAL ENGINEERING ISN'T NEW, BUT ...


While these attacks are not new, the newer, more sophisticated social engineering techniques are getting harder to detect.

For example, before calling help desks, many hackers now acquire employee information including passwords by social engineering. They also use "SIM swapping," a technique where they trick a telecom company's customer service representative to reassign a specific phone number from one device to another, which they use to trick the help desk staff.

Here are some blogs that are helpful to go over to review social engineering attacks — especially during October’s National Cybersecurity Awareness Month:

NEW CISA RESOURCES TO HELP


The Cybersecurity and Infrastructure Security Agency (CISA) announced the kickoff of the 20th Cybersecurity Awareness Month last week. Throughout October, CISA and the National Cybersecurity Alliance(NCA) will focus on ways to “Secure Our World” by educating the public on how to stay safe online. “Secure Our World” will also be the enduring theme throughout the year as we work to drive behavioral change around core cybersecurity habits by providing everyone with the knowledge and tools they need.

“As cyber threats become more sophisticated, individuals and families, small and medium businesses, and large companies all have an important role to play to in keeping our digital world safe and secure,” said CISA Director Jen Easterly. “This Cybersecurity Awareness Month, we are asking everyone to do their part to ‘Secure Our World’ by adopting key behaviors that promote online safety and security.”
The CISA October Awareness Month launch announcement on LinkedIn can be seen here.

FINAL THOUGHTS


Purdue University’s cybersecurity website offers some great materials.

Here’s a fun video on passwords and cybersecurity:
There are many, many other great resources on the web to help overcome these social engineering challenges.

Here are some more ways to combat social engineering from:
Daniel J. Lohrmann is an internationally recognized cybersecurity leader, technologist, keynote speaker and author.