Workscape Institute

Spyware and social engineering attacks are two serious security threats with very different tactics, but both can be prevented through the same measure: an informed and responsible workforce.  This is because knowing how these attacks work makes you immediately equipped to prevent their occurrence.  To that end, let’s start with spyware.

Follow up:

Often bundled with “free” applications, spyware typically slows computer performance and tracks and reports your behavior to third parties.  Some spyware is much more malicious, and can hand over visibility into – or control of – your computer to other individuals.  These are clearly dangers for businesses in terms of maintaining computer health and protecting sensitive information.  With 24/7 workdays, it is not uncommon for a single laptop to contain confidential company and personal data – and spyware exposes both to risks of theft, alteration, or loss.

One interesting note to bear in mind is that most spyware usually ends up on a computer because it was downloaded by the user.  Email is still the top delivery mechanism for viruses, but spyware is a more common problem because it’s packed into “free” applications that deliver a variety of features.  When people are in a hurry, or want to sample software tools, they often search online for a “free” download that accelerates a current task.  Note that “free” software and “open source” software are not the same. Reputable open source projects are far less likely to contain spyware than a neat browser add-on written by some guy from half-way around the world.  The best tactic for avoiding spyware problems is to rely on applications from known and trusted vendors.

Social engineering attacks are a much different animal.  During our work day each of us answers dozens of questions from co-workers and outside contacts on a broad range of topics.  And, between all of the communication mediums available today, these questions can seem to come from a “trusted” source in email, instant messaging or even the old-fashioned phone line.  However, this influx of inquiries sometimes lets people drop their guards, and that’s when critical information becomes vulnerable.

Social engineers exploit the natural inclination to help out by contacting individuals under the guise of a peer and request confidential information.  A brief phone call or instant message that appears to come from a remote co-worker may be someone else, so answer these questions with caution.  If you can’t validate the person’s identity, the best tactic is to halt the present conversation, telling subject that you will get back shortly.  Then you can securely answer the inquiry by replying to that person’s company email address or simply calling back.

Speaking of responding, I’d love your feedback on what security topics would be timely and interesting for the future.  Until next time, stay secure.