The human firewall in countering cyber-attacks

According to Indonesia’s communications and information ministry, there have been 36.6 million cyber-attacks in Indonesia in the past three years. Most of the recorded attacks are attempts at data theft.

Not only are corporations and government institutions affected, but every other Indonesian is also susceptible to this type of attack on a daily basis.

You may have encountered an SMS malware circulating with the following message: “Congratulations you won a prize! Please call us to claim your prize!” accompanied by an illegitimate phone number getting people to transfer money, or an email that prompts Internet users to install an “app” which actually leads them to download malware. These types of threats may happen to the best of us, and they share one common theme — exploiting the human subconscious.

Many people may be familiar with renowned psychologist Robert Cialdini’s “Six Principles of Influence”. In its most basic form, Cialdini offers a step-by-step psychological guide to getting people to say yes. Very effective in the workplace or that crucial sales meeting, but these principles aren’t necessarily confined to the noble quest of “better business.” In fact, cyber-criminals are now swotting the latest social psychology tactics in order to get their hands on your data.

The prevalence of social engineering in many publicly disclosed cyber-attacks demonstrates either an inherent weakness in the acumen of victims to identify malicious communications, or that cyber criminals are using more complex methods to bypass the “human firewall’.

The answer, of course, likely lies somewhere in between these two statements, but regardless of the root cause, it does demonstrate that the first line of defence is evidently failing.

The default position to blame users as the cause for breaches is not entirely fair. Whilst there will be examples where unsafe practices are clearly being employed, Intel Security’s latest whitepaper “Hacking the Human Operating System” discusses the techniques used by attackers to bypass the consciousness of their targets and attempt to manipulate victims through leveraging subconscious levers of influence.

One of the techniques is using scarcity, because people tend to comply when they believe something is in short supply. An offer too good to be true? It probably is. An email from your bank asking you to do something within 24 hours? Seems too scary to be legitimate? You’re probably right.

Cyber-criminals often use scarcity and urgency to dupe people into clicking on something malicious without taking the time to think. Or they could also leverage authority to make victims comply. Criminals don’t have to dress up in dodgy outfits to mimic a public official or a trusted source anymore. All they need is a decent replica impersonation of an email or SMS. Ask yourself, why has that delivery company sent me that email when I haven’t ordered anything? 

So what can we do to sniff out a cyber-criminal? Intel Security has been analysing the most common psychological levers being used by these hackers and phishers and has updated Cialdini’s principles to reveal how they apply in the digital world and what you need to do to stay safe.

Using security software across all of devices can help to scan and monitor any suspicious activities and malicious files. But at the same time, more than ever, we are urged to always reconsider before we click on anything. Use our best judgement when responding to an email. Are we expecting a parcel delivery? Or why would our bank send us an urgent notification asking us to update our account? Consider what you’re being asked to do before rushing to do something you could regret later.

If we value the contents on our mobile devices, be sure to include a PIN or passcode so if it becomes hacked, lost or stolen, people will not be able to access our information.

Always use strong passwords that won’t be easily compromised, and don’t share passwords with anyone, including significant others and family members. If you need to share it, create a unique code just for that account, and change it immediately if you suspect foul play.

Don’t forget to always check and verify — received a text message, email or message on social media from a friend that just doesn’t sound right? Call them, ask them if it really was them. Same goes for bank notifications — find the bank’s legitimate phone number and ring up their customer service to check and verify that everything is above board.

The modus operandi for most of the common data breaches is to leverage some form of social engineering to coerce the user into an action facilitating malware infection.

For us, this threat may be regarded as a low-tech attack due to the limited technical resources required to conduct the attack, but nevertheless the abuse of social engineering is very real.

While technology can be used as a control, it will need us as users to understand the nature of social engineering attacks and be our own firewall to mitigate the risk.