Social Engineering
What Is Social Engineering?
Social engineering is the psychological manipulation of people into performing actions or disclosing confidential information that compromises security, serving the attacker’s objectives. Rather than exploiting technical vulnerabilities in systems, social engineering exploits human tendencies: the desire to be helpful, the respect for authority, the fear of consequences for non-compliance, and the tendency to trust communication that appears to come from familiar or legitimate sources.
Social engineering is the most consistently effective cyberattack vector because it bypasses the technical controls organizations invest heavily in building. A firewall cannot block an employee who voluntarily provides their credentials to someone impersonating IT support. An email filter cannot stop a phone call from a convincing fraudster.
Common Social Engineering Techniques
Pretexting
The attacker fabricates a scenario (a pretext) to create a believable context for their request. A caller who claims to be from the IT helpdesk verifying account details, or someone claiming to be a new executive assistant who needs urgent access to a system, is using pretexting to establish false legitimacy for their request.
Phishing and Spear Phishing
Email-based social engineering that impersonates trusted entities to steal credentials or deliver malware. Spear phishing personalizes messages with researched details about the target to increase credibility and success rates.
Vishing (Voice Phishing)
Phone-based social engineering where attackers impersonate IT support, financial institutions, government agencies, or vendors to extract information or convince targets to take actions that compromise security.
Baiting
Leaving infected physical media (USB drives) in locations where targets are likely to find and use them, or creating online offers that entice targets to download malicious software in exchange for promised content.
Tailgating and Piggybacking
Physical social engineering where an attacker gains unauthorized access to a secured area by following an authorized person through a controlled entry point, relying on social norms of politeness to avoid being challenged.
Defending Against Social Engineering
Technical controls have limited effectiveness against social engineering because the attack vector is human behavior. Effective defenses include security awareness training that builds recognition of manipulation tactics, verification procedures that require out-of-band confirmation of unusual requests, a culture where employees feel empowered to question and verify without fear of appearing unhelpful, and physical security controls that support challenge culture at entry points.
Key Takeaways
- Social engineering manipulates human psychology rather than exploiting technical vulnerabilities to compromise security.
- Common techniques include pretexting, phishing, vishing, baiting, and physical tailgating.
- Social engineering bypasses technical controls by exploiting human tendencies: helpfulness, authority deference, and urgency response.
- Effective defenses combine security awareness training, verification procedures, and a culture that supports questioning unusual requests.
- Social engineering is consistently among the most successful initial access methods in cyberattacks because human judgment cannot be fully automated away.