- Let's go over
a few social engineering countermeasures.
By far
one of the best countermeasure is user education, right?
Train your users to basically demand proof
of identity of somebody, right,
calling you on the phone or
in person
and demanding information.
And also define values
for the types of information
that you want to classify within the organization.
Like usernames, passwords, network addresses.
And then the greater, the value,
the higher the security
around those items should be maintained.
And then you educate your users to know,
you know, of course that these
are sensitive information
that should not be shared with anybody.
Of course, username and passwords
and network addresses are pretty simple
and self explanatory, but you may define other types
of information that you may also want to prioritize
and make sure that nobody
actually shares that type of information.
Now, if someone requests privileged information,
have the employees find out why they want it
and whether they're authorized to obtain it
or not.
Have the users actually challenge that person
and truly identify themselves
and justify why they want that information.
Even if that other person is an employee
of the same company, right?
As we mentioned before,
a lot of attacks start from the inside.
So the insider threat is absolutely real.
Now, another thing that I want to highlight is to
take advantage of email security features in email services
and email servers that sometimes, you know,
may be able to add some text message
to the subject of an email
if they actually come
from an outside address or an outside domain.
For example, you know, in this case
we have an email
that came from Dr. Joe Doe
and the subject has now these automatic
external
you know, tag, if you will
or text that is specifying that this email actually came
from an external source, right?
In some cases you will actually mark it potential spam
different ways
and different features that email servers
and services including cloud services,
they actually provide nowadays.
But again, user education is one
of the most effective ways to countermeasure
and combat social engineering attacks.