Only those who have the patience to do simple things,perfectly ever acquire the skill to do difficult things easily.

Protected Voices: Social Engineering

The FBI’s Protected Voices initiative provides cybersecurity recommendations to political campaigns on multiple topics, including social engineering, to help mitigate the risk of cyber influence operations targeting U.S. elections.


Video Transcript

Hello, I’m Jay, a special agent with the FBI.

Welcome to social engineering—or, more bluntly, targeted lies designed to get you to let your guard down. Social engineering is the most common technique deployed by criminals, adversaries, competitors, and spies to exploit humans and computer networks. That's because it's all too simple—you don't need any technical skills to be successful.

Social engineering is the use of deception, through manipulation of human behavior, to target and manipulate you into divulging confidential or personal information and using it for fraudulent purposes. In the context of information security, social engineering might also mean psychologically manipulating people to take action to inadvertently give adversaries access to protected information or assets. Social engineering can also be used to embarrass and humiliate campaigns, voter groups, and others.

Phishing, phishing campaigns and spear-phishing are just a few examples of social engineering.

Phishing is the fraudulent practice of sending an email, which appears to come from a reputable source, to lure someone to reveal personal information or click on a link. Just like when you go fishing, you throw a hook into a body of water to bait a fish to bite on the hook. In this case that’s done by a malicious email.

Phishing campaigns generally target a group of individuals or companies by sending multiple fraudulent, but enticing emails, in the hope that at least one person falls for the bait. These emails are often designed to look official—as if coming from your campaign itself, a trusted vendor, donor, or other known sender.

Spear-phishing, on the other hand, is a very targeted and customized email to lure the targeted victim to take action. Typically the adversary has done some research on the victim to understand what would make this specific person fall for the scam. Criminal and foreign sponsored governments, cyber adversaries, use spear-phishing emails to get access to protected networks. Sometimes simply dropping the name of someone the target knows is enough to lower their guard.

So let’s talk about how and why cyber adversaries prefer social engineering tactics.

It’s easy, low cost, and widely successful. It’s easy because there are off-the-shelf apps or social-engineering exploitation kits available online. These kits aggregate open-source information about you from various social media sites to help the attacker craft a highly convincing spear-phish email.

Cyber advisories can also mirror a legitimate website by using off-the-shelf tools, so that they can direct you to a fake website that looks authentic to capture your login credentials.

And sometimes, the phishing needs no technology at all beyond a well-written email, with just enough social finesse to get you to reveal sensitive information.

If you download a malicious email attachment or click on a malicious link or log in to a fake mirrored website, you might be letting an attacker sneak past even the most robust cybersecurity defenses. Depending on the structure of your computer network, a successful phishing attack could compromise your entire network.  So, how can you minimize your risk of becoming a victim?

Two simple techniques will help you guard against these attacks.

First, before you open an email attachment or click on a link, even from people you know, look at the email header to see exactly what the sender’s email address is. Adversaries often change one letter, symbol or number in an email address so that it closely resembles a legitimate email address. If you don’t see that tiny change, you may be replying to a cyber adversary instead of a trusted friend. The same thing is true for embedded links. Hover your mouse over the link, and make sure it doesn’t have any masquerading characters.

Second, be careful when handling emails that contain attachments. If you don’t know the sender, call the person before you open it. If you do know the sender but weren’t expecting an attachment, call the person before you open the attachment. When possible, avoid using the phone number listed in the email. Also, avoid opening emails on mission-critical systems, where sensitive data resides. An infection on such a system may result in significant loss of information.

These techniques sound pretty simple. But in the context of political campaigns, it can be challenging to abide by them, particularly because you’re constantly communicating with constituents, most of whom you don’t know personally. So, how can you balance your critical need to communicate with constituents against your need to safeguard your computer networks?

Training and creating awareness is one of the most important steps your campaign can take. It’s extremely important for your campaign to educate staff and volunteers about social engineering as an attack vector.  That puts your staff in a better position to detect these attempts and avoid becoming victims.

You can get as creative as you want to deliver these training sessions. We’ve seen some organizations send out controlled phishing emails to their employees to determine if extra training is required for those who have trouble identifying phishing emails. You may also want to provide reference sheets or training videos about social engineering.

Encourage campaign staff and volunteers to think about all the information they’re publicly sharing on social media and review and restrict privacy settings on social media accounts regularly. Information that seems innocuous—such as office locations, meeting date and times, names of people written on a whiteboard in the background of a selfie shared online—can give adversaries information they can use to target you.

Adversaries may also target your personal email accounts and might even try to connect with you on social media. As a general rule, don’t accept friend requests from people you don’t know.

At the end of the day, you, the human user, are the first line of defense against social engineering attacks. Your campaign should consider educating all staff and volunteers about how social engineering works and the harm it can cause. The more training, the better. Make it a regular part of your campaign week. Ask your colleagues to watch this video, or pass the information to them yourselves.

The social engineering tips won’t keep your campaign’s information systems safe from every kind of cyber threat, but they will help you significantly minimize your risk.

Remember, your voice matters, so protect it.

Packed with amazing data about the world in 201的更多相关文章

  1. 13 Amazing Component Sets Driving Success In Delphi Berlin On Android And IOS

    There are quite a few Firemonkey component sets available for Delphi Berlin which can get you ahead ...

  2. My journey introducing the data build tool (dbt) in project’s analytical stacks

    转自:https://www.lantrns.co/my-journey-introducing-the-data-build-tool-dbt-in-projects-analytical-stac ...

  3. SAE J1850 VPW Implement

    ---恢复内容开始--- OBDII Interface Project When I can ever find enough time away from schoolwork, I try to ...

  4. Ogre 1.8 terrain 和 paging 组件

    以下转自:http://hi.baidu.com/xocoder/item/e8d87cf53d87612b753c4cfd OGRE地形生成 OGRE可以通过两个接口来生成地形,分别是void Te ...

  5. CPU二则

    CPU二则 CPU二则 aligned load & unaligned load non-temporal store(streaming store) 参考文献 aligned load ...

  6. 转:Ogre TerrainGroup地形赏析

    1.1  参考 http://www.ogre3d.org/tikiwiki/tiki-index.php?page=Ogre+Terrain+System http://www.ogre3d.org ...

  7. OpenStack_Swift源代码分析——Ring的rebalance算法源代码具体分析

    1 Command类中的rebalnace方法 在上篇文章中解说了,创建Ring已经为Ring加入设备.在加入设备后须要对Ring进行平衡,平衡 swift-ring-builder object.b ...

  8. Video processing systems and methods

    BACKGROUND The present invention relates to video processing systems. Advances in imaging technology ...

  9. [Windows] Access SMBIOS

    SMBIOS architecture System Management BIOS (SMBIOS) is the premier standard for delivering managemen ...

随机推荐

  1. opencv读取并播放avi视屏

    视屏的本质是一些静态的图像的集合,opencv可以不断读取视屏中的图片,显示,就产生了类似电影的效果. 这样也就可以通过opencv对实时的视屏流进行处理了. #include "stdaf ...

  2. jq 获取name值一样的数组

    <input type="text" value="" name="wid"/><input type="tex ...

  3. 《java笔记》

    1.判断是否是整数,包含正数和负数 /** * 判断是否是整数包含正负 */ public static boolean isInteger(String str){ Pattern pattern ...

  4. HttpUrlConnection使用详解--转

    http://blog.csdn.net/fightingXia/article/details/71775516 一,HttpURLconnection的介绍 在Android开发中网络请求是最常用 ...

  5. Mybatis学习(2)原始dao开发和使用mapper接口代理开发

    基础知识: 1).SqlSessionFactoryBuilder: 通过SqlSessionFactoryBuilder创建会话工厂SqlSessionFactory.将SqlSessionFact ...

  6. Storm存储结果至Redis

      原有的事务支持使用MemcachedState来进行,现在需要将其迁移至Redis,并且需要记录所有key值列表,因为在redis中虽然可以使用keys *操作,但不是被推荐的方式,所以把所有结果 ...

  7. javascript面向对象的程序设计之Object.getOwnPropertyDescriptor()

    Object.getOwnPropertyDescriptor()用于获取给定属性的描述信息,这个描述信息是一个对象. 如果是访问器属性,则这个对象的属性有configurable,enumerabl ...

  8. ExtJS模版技术

    学习ExtJS一段时间以后,大家基本都会对于一些显示数据的组件不太符合需求,可能自己需要的组件在ExtJS里面不存在,这是大家基本就会使用Html属性,直接使用Html进行绘制页面数据展现. 但是,使 ...

  9. 为github帐号添加SSH keys(Linux和Windows)

    文章转自:https://blog.cofface.com/archives/406.html/2 一.Linux增加ssh keys方法: 使用git clone命令从github上同步github ...

  10. django返回状态码的页面,指定p地址访问

    只有DEBUG = False 才能展示自定义的错误页面,否则djnago会报错,给出提示信息.  ps:django  DEBUG=FALSE, 会导致不能加载静态文件 ALLOWED_HOSTS ...