BBB Business Tip: Protect against social engineering attacks with cognitive security

Hackers have learned that tricking a person is often easier than cracking a system. This is why social engineering scams are becoming more common.

These cyberattacks use trust and human mistakes to access information. They can be very convincing, especially when they use artificial intelligence (AI).

So, how can your business protect against social engineering attacks?

Cyber criminals who use social engineering methods will impersonate someone else or pretend to be from a trusted organization or vendor. After gaining your trust, they will attempt to influence you to give up sensitive information, perform tasks, or provide access to restricted areas, which could lead to a data breach.

Social engineering can happen in person or through digital channels like email, text, or phone. These threats can occur over time to gain your trust or be quick through traditional phishing attacks that rely on a sense of urgency.

You may have already encountered some AI-generated images and videos that look real. While these images and videos can be fun to create, bad actors can use this technology to impersonate others and manipulate their targets, whether it’s through photos, videos, or even the phone through voice cloning.

Generative AI can also make social engineering attacks very specific and convincing. For example, according to CrowdStrike, regarding Business Email Compromise scams, AI tools can “search, analyze, and mimic examples” of an executive’s writing style and target their employees through impersonation.

With AI’s ability to comb through massive amounts of online information with the click of a button, it’s no surprise that this technology can create messages that appear very real.

• Include educational materials about social engineering attacks in your regular cybersecurity training. Hopefully, your business has already implemented regular cybersecurity training for your staff. (If not, this is a must!) Ensure these trainings cover social engineering and the threats that can target individual employees. Consider holding social engineering training sessions in person instead of online, so your team can better understand how these manipulation strategies work and what they look like.
  
  
• Start shifting your business’s culture around cybersecurity threats. Encourage your staff to share experiences and maintain an open dialogue about cybersecurity. Social engineering threats can be sneaky, so encouraging your staff to talk openly with one another about potential threats or out-of-ordinary situations can help spot these threats sooner rather than later.
  
  
• Implement additional safeguards for sensitive business information and restricted locations. Of course, some employees at your business will likely have access to all information and locations. But remember, social engineering attacks can target and manipulate everyone, even your senior leaders. In addition to multi-factor authentication, consider requiring additional “permissions” or “checks” to access your business’s most sensitive data and restricted areas. For example, you could require a second employee to be present when accessing restricted areas, or “sign off” on accessing sensitive documents.
  
  
• Encourage your employees to limit the amount of personal information they share publicly. Impostors and those who engage in social engineering can be convincing because they can readily find information online about the people they are pretending to be. Remind your employees to be careful about what they share online if they have public social media accounts, as this information could be used to trick another employee into giving up sensitive business information. If you don’t already have a social media policy in place for your business, consider making one.