Social engineering is a term that refers to cyberattack strategies that use psychological manipulation to induce employees to engage in behaviors that create “cracks” in a company’s cyber defenses in different ways. For example, threat actors may send an email (i.e., phishing) that induces employees to download a file, which then installs malware on the company’s system. Or threat actors may send a text message that encourages employees to click on a link that leads to a form that requests their login credentials.

The defining feature of social engineering, however, is manipulative communication that plays upon employees’ natural emotions. For example, an email may communicate a request, apparently from an authority figure of the employee’s company, with an urgent deadline. An email might offer some sort of reward that needs to be claimed quickly, or it might warn of undesirable consequences if the recipient doesn’t complete an action within a short timeline. By creating a sense of urgency or pressure, threat actors try to trick employees into acting without thinking. Because social engineering is solely focused on inducing employee error, security awareness training is the best way to reduce this type of cyber threat.

Hackers use an ever-changing bag of tricks to manipulate employees, such as:

• Sending authentic-looking emails that appear to be from authority figures
• Creating feelings of pressure or urgency to act now
• Requesting credentials or other sensitive information
• Prompting the employee to click on links or download attachments

NexusTek’s security awareness training includes objectives such as:

• How to authenticate email sources even when they look genuine
• How to spot suspicious emotional appeals
• Differentiating between acceptable and risky requests for information
• How to determine if a link or attachment is safe or risky