Understanding the ongoing risks of social media and staying vigilant

Here are some updates on social media risks and trends, and how we can reduce exposure to social engineering campaigns

Social engineering has become one of the most powerful tools in the cybercriminal’s arsenal. Unlike traditional hacking methods that exploit technical vulnerabilities, social engineering uses human psychology. This approach is effective because it exploits inherent human traits such as trust, curiosity, fear, and the desire to help others.

One of the main reasons why social engineering is so effective is its ability to bypass even the most sophisticated security systems. When a phishing email is labeled with the right personal information and references to real colleagues and business contacts, it can trick employees into divulging sensitive information without setting off security alarms.

Social engineering involves various techniques to achieve their goals. Phishing, vishing (voice phishing), smishing (SMS phishing), and pretexting are some common tactics. Phishing involves sending emails that impersonate sources that people typically trust, tricking recipients into clicking on links or login pages and providing sensitive information.

According to Shannon Murphy, Global Security & Risk Strategist at Trend Micro, cybercriminals are using generative AI to make it easy to send targeted, error-free, and tonally convincing messages at scale in multiple languages. “And this is already expanding beyond email and text messages to include convincing audio and video ‘deepfakes’ for an even greater threat to businesses,” she said.

***Shannon Murphy, Global Security & Risk Strategist, Trend Micro***

Another continuing factor contributing to the effectiveness of social engineering is the ability of attackers to gather information about their targets. With the advent of social media and the Internet, cybercriminals can easily gather data about individuals and organizations. This information is then used to create personalized attacks that are more likely to be successful. For example, an attacker might pose as a colleague or a trusted service provider (a business email compromise), using details from social media profiles to build credibility.

Revisiting our online social habits

When internet connectivity and photographic features in mobile phones finally became more affordable and of better quality, social media platforms took off. Digital natives flourished on information-sharing media platforms, professional networking sites and various online communities, spreading their passion to reach young and old.

While these platforms offer numerous benefits, they have also come with significant risks, particularly when it comes to social engineering. One of the main factors that makes individuals susceptible to social engineering attacks is their propensity to share personal information online.

People often post details about their lives, such as their daily routines, whereabouts, achievements, and even their life stories. Sharing this information openly (rather than limiting access to close circles of friends), while seemingly harmless, has been and continues to be a goldmine for cybercriminals.

Furthermore, the desire to connect with others and expand your network can lead to accepting friend requests or invitations from strangers. This behavior has been linked to numerous cases of cyberbullying, blackmail, sexual exploitation, pedophilia and other social ills.

By publicly celebrating promotions, new features, major achievements, and tagging each other to spread the information, Internet users have for years inadvertently provided attackers with valuable information about their lives. This information has been used by scammers and fraudsters to create targeted attacks, such as spear-phishing emails and emails that appear to come from a trusted source.

Creating a culture of vigilance on social media
According to a contributed story by Fabio Fratucello, Field CTO (International), CrowdStrike, “As adversaries rely on identity attacks such as social engineering to gain initial access to networks, security teams at all maturity levels must be more proactive in detecting and mitigating evolving threats. Enhancing technology capabilities for identity and endpoint monitoring is a step in the right direction. Unified visibility across security operations eliminates gaps or silos that adversaries could exploit.”

Fratucello also recommended further training and education of employees on safety procedures and the associated risks of non-compliance, in order to foster a deep-rooted culture of social vigilance.

Other experts have mentioned the following tips before. They are useful for people of all ages who share information online or are attracted to it, whether for personal or professional reasons.

For IT teams: Conduct regular training sessions and simulated phishing tests to emphasize the importance of cyber hygiene with social engineering.
For general social media users: Instill a healthy dose of skepticism across all contacts to collectively increase vigilance against social engineering. With AI and deepfakes making it even harder to identify scams and spear-phishing campaigns, everyone needs to be on their guard — especially when it comes to typical approach methods around the usual topics of urgent crises/personal matters; failed deliveries; requests for money/information; unsolicited business/investment proposals; giveaways and prizes, health scares, and clickbait-like claims to get people to react and take action.
To all social media users: Limit information sharing: People should be careful about the information they share online. Review and enable every privacy setting on social media platforms. Platforms even change their default privacy settings and add new ones periodically: make sure you stay up to date with changes, otherwise settings that were previously considered sufficient may be overridden by new platform policies and adjustments. Limit information sharing to specific circles of contacts and remind them to be discreet about spreading information that is meant for their eyes only.
For cyber defenders and IT teams: Implement strong security measures (such as biometric or unhackable multi-factor authentication) and conduct regular security audits to identify vulnerabilities. Ensure security measures are up to date, including assessments of both technical systems and human factors.
For everyone in general, this also applies: Your behavior on social media platforms can provoke unpleasant actions, including trolling. doxxand stalking by online ‘frenemies.’ Therefore, always follow the chat group rules; watch your language and tone; avoid personal attacks and treat others with respect. When disagreeing, keep your emotions in check and seek guidance from moderators if necessary.

By understanding the dual aspects of social engineering and taking proactive steps to improve cybersecurity hygiene, individuals and organizations can significantly reduce their risk of falling victim to social engineering attacks. The key is to balance the benefits of connectivity and information sharing with the need for vigilance and security.