Root Cause Analysis of Social Engineering

Social Engineering

• Human Behavior
  • Desire to be helpful or avoid conflict
  • Employees fear repercussions for refusal
  • Trust in authority or familiarity
  • Attackers impersonate known individuals
• Awareness and Training
  • Training not reinforced regularly
  • No follow-up simulations or refreshers
  • Lack of security awareness training
  • Users unaware of phishing and impersonation tactics
• Communication Channels
  • Lack of verification mechanisms
  • No multi-factor identity confirmation
  • Use of unsecured platforms
  • Personal email and messaging apps for work
• Organizational Policies
  • Weak internal security culture
  • Security not prioritized across all departments
  • No clear reporting procedure for suspicious activity
  • Employees unsure how to respond to threats
• Technical Controls
  • No browser isolation or link scanning
  • Users exposed to malicious links directly
  • Lack of email filtering or spoofing protection
  • Spoofed messages bypass spam detection
• Incident Response
  • Inadequate post-incident analysis
  • Lessons not translated into preventive actions
  • Delayed detection and containment
  • Lack of monitoring for social engineering indicators

Suggested Actions Checklist

Here are some corrective actions, preventive actions and investigative actions that organizations may find useful:

• Human Behavior
  • Desire to be helpful or avoid conflict
    • Corrective Actions:
    • Conduct immediate awareness sessions emphasizing assertiveness in security contexts.
    • Implement a confidential reporting system for employees to report coercion or undue pressure.
    • Preventive Actions:
    • Promote a workplace culture encouraging employees to question and verify requests without fear.
    • Incorporate training modules focused on boundary-setting and conflict avoidance in security scenarios.
    • Investigative Actions:
    • Review past incidents where employees may have helped attackers due to conflict avoidance.
    • Conduct anonymous surveys to understand employee perceptions about saying no to suspicious requests.
  • Trust in authority or familiarity
    • Corrective Actions:
    • Enforce verification protocols for all requests regardless of the requester’s perceived authority.
    • Update security guidelines to require confirmation from multiple sources before action.
    • Preventive Actions:
    • Run campaigns emphasizing critical thinking, even when requests come from familiar or authoritative figures.
    • Include case studies on social engineering exploiting trust in authority in training.
    • Investigative Actions:
    • Analyze incidents involving attackers impersonating known individuals.
    • Map communication patterns to detect potential exploitation of familiarity.
• Awareness and Training
  • Training not reinforced regularly
    • Corrective Actions:
    • Schedule and deliver refresher training sessions within defined intervals.
    • Circulate quick security tips and updates via newsletters or intranet.
    • Preventive Actions:
    • Implement mandatory periodic training with tracking and compliance monitoring.
    • Develop gamified training tools to increase engagement.
    • Investigative Actions:
    • Assess training attendance and completion rates over time.
    • Evaluate knowledge retention through periodic quizzes or simulated phishing tests.
  • Lack of security awareness training
    • Corrective Actions:
    • Introduce foundational security awareness training for all employees.
    • Communicate training schedules and expectations clearly.
    • Preventive Actions:
    • Integrate security awareness into onboarding processes.
    • Maintain an accessible online repository of training resources.
    • Investigative Actions:
    • Survey employee awareness levels before and after training implementation.
    • Identify departments or groups lacking training records.
• Communication Channels
  • Lack of verification mechanisms
    • Corrective Actions:
    • Implement mandatory verification steps before processing sensitive requests.
    • Introduce a verification checklist for communication involving confidential information.
    • Preventive Actions:
    • Deploy tools that require multi-step verification in communication platforms.
    • Train employees to insist on verification regardless of urgency.
    • Investigative Actions:
    • Review cases where lack of verification led to security breaches.
    • Evaluate existing communication workflows for verification gaps.
  • Use of unsecured platforms
    • Corrective Actions:
    • Block or restrict use of personal email and messaging apps for official communication.
    • Provide secure, company-approved alternatives for communication.
    • Preventive Actions:
    • Develop policies prohibiting sensitive work on unsecured or unauthorized platforms.
    • Conduct awareness sessions on risks of unsecured communication.
    • Investigative Actions:
    • Monitor network traffic for use of non-approved communication tools.
    • Review past incidents linked to unsecured platform use.
• Organizational Policies
  • Weak internal security culture
    • Corrective Actions:
    • Launch organization-wide campaigns to promote security as a shared responsibility.
    • Recognize and reward security-conscious behaviors.
    • Preventive Actions:
    • Incorporate security objectives into department and individual performance goals.
    • Regularly communicate security priorities from top leadership.
    • Investigative Actions:
    • Conduct culture assessments and employee feedback surveys on security attitudes.
    • Identify gaps between policy and practice in various departments.
  • No clear reporting procedure for suspicious activity
    • Corrective Actions:
    • Establish and communicate a straightforward incident reporting process.
    • Set up dedicated hotlines or portals for reporting suspicious activities.
    • Preventive Actions:
    • Train employees on how and when to report security concerns.
    • Promote a no-blame culture encouraging reporting.
    • Investigative Actions:
    • Audit incident reporting logs for completeness and timeliness.
    • Survey employees’ knowledge of reporting procedures.
  • Employees unsure how to respond to threats
    • Corrective Actions:
    • Provide step-by-step response guides and quick reference materials.
    • Conduct scenario-based training to build confidence.
    • Preventive Actions:
    • Regularly update and disseminate threat response protocols.
    • Offer continuous support channels such as help desks or security teams.
    • Investigative Actions:
    • Assess employee responses during simulations or real incidents.
    • Gather feedback on clarity and usability of response instructions.
• Technical Controls
  • No browser isolation or link scanning
    • Corrective Actions:
    • Deploy browser isolation tools to sandbox suspicious content.
    • Implement link scanning technologies for all inbound emails.
    • Preventive Actions:
    • Integrate automated scanning as a default on all endpoints.
    • Regularly update and patch security software.
    • Investigative Actions:
    • Review security logs for incidents involving malicious links.
    • Evaluate effectiveness of existing scanning controls.
  • Lack of email filtering or spoofing protection
    • Corrective Actions:
    • Configure advanced email filtering rules and anti-spoofing protocols (SPF, DKIM, DMARC).
    • Quarantine suspected spoofed or phishing emails immediately.
    • Preventive Actions:
    • Continuously tune email filters based on threat intelligence.
    • Educate users on recognizing spoofed emails.
    • Investigative Actions:
    • Analyze phishing attempts that bypassed filters.
    • Audit email infrastructure settings.
• Incident Response
  • Inadequate post-incident analysis
    • Corrective Actions:
    • Conduct comprehensive post-mortem reviews after every social engineering incident.
    • Document lessons learned and share with relevant teams.
    • Preventive Actions:
    • Establish a standardized incident review process.
    • Integrate findings into ongoing training and policy updates.
    • Investigative Actions:
    • Track completeness and timeliness of incident analyses.
    • Assess how well lessons learned are implemented.
  • Delayed detection and containment
    • Corrective Actions:
    • Enhance monitoring to identify social engineering indicators early.
    • Set up rapid response teams for immediate containment.
    • Preventive Actions:
    • Automate alerts and escalation processes.
    • Train employees on early warning signs.
    • Investigative Actions:
    • Review timelines of incident detection and containment.
    • Identify gaps in monitoring tools or response protocols.