{"id":17830,"date":"2024-11-11T15:12:36","date_gmt":"2024-11-11T14:12:36","guid":{"rendered":"https:\/\/www.ohb-ds.de\/wpml\/magazin\/was-ist-social-engineering"},"modified":"2026-09-17T12:25:41","modified_gmt":"2026-09-17T10:25:41","slug":"what-is-social-engineering","status":"publish","type":"magazin","link":"https:\/\/www.ohb-ds.de\/en\/magazine\/what-is-social-engineering","title":{"rendered":"What is social engineering?"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t<\/path><\/svg>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\tIT-Sicherheit<\/span>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What is social engineering?<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tFrom a seemingly harmless text message to a sophisticated phishing campaign\u2014how attackers exploit employees\u2019 vulnerabilities and trust to achieve their goals.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tSchedule an initial consultation now<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Social engineering is an important concept not only in today\u2019s digital world, but also in the home. It refers to how attackers exploit the vulnerabilities and trust of people\u2014including employees\u2014rather than relying on technical tricks and security vulnerabilities to achieve their goals.<\/p>

New Challenges: Today, IT specialists must not only implement technical security measures but also develop a deep understanding of the psychological aspects of social engineering<\/strong>. In this article, we will take a closer look at social engineering, explain exactly what it means, and why it is so important.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Definition of Social Engineering<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

To understand social engineering, it is essential to clearly define the term: Social engineering refers to the practice of persuading people to disclose confidential information, perform actions, or make decisions that are normally contrary to their own interests or those of their organization. This involves the use of various forms of social and psychological manipulation.\u00a0In doing so, the attacker often seeks to exploit human traits such as fear, respect for authority figures, trust, and a willingness to help in their victims.<\/strong><\/p>

This type of manipulation can take many forms, ranging from seemingly harmless text messages or instant messages in which the attacker pretends to be a family member in order to beg the victim for money, to sophisticated infiltration of large corporations through methods such as\u00a0phishing<\/a><\/strong>. Between these two extremes lies a wide range of tactics and techniques used by attackers to gain access to sensitive data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Social engineering attacks<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

According to a 2023 survey by G Data CyberDefence AG, 48% of all companies surveyed have been targeted by social engineering attacks. These attacks were primarily carried out by phone or email. In addition, attempts are also made to access internal company data through personal contacts or professional networks. According to the Federal Ministry of Information and Security, 66% of all spam emails were attempted cyberattacks.1<\/sup><\/p>

As explained in the definition, social engineering attacks can take many different forms. Generally speaking, they can be divided into two main categories, although there is a third, less common category:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t1. Human-based
\nsocial engineering:\n<\/span>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Without Technical Elements<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t2. Computer-based <\/br>social engineering:<\/span>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

With Technical Elements<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t3. Reverse <\/br>social engineering:<\/span>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The victim approaches the attacker of his own accord<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Nowadays, the two main categories\u2014human-based and computer-based social engineering\u2014are increasingly converging. The following section explains the categories most commonly encountered in the business world and outlines strategies for mitigating these attacks.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\n\t\t\t\t\t
1. Phishing <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Phishing<\/a> is concidered the most widespread form of social engineering, and virtually everyone has seen at least one phishing email in their inbox. In this technique, a malicious actor sends emails that contain harmful attachments or redirect recipients to dangerous websites.<\/p>

There are now a wide variety of phishing variants, ranging from classic spam phishing to highly specialized forms such as whaling, spear phishing, or even quishing (QR code phishing), to name just a few. Despite its widespread prevalence, the threat posed by phishing should by no means be underestimated, as well-executed phishing campaigns are often highly successful for attackers. It is important to realize that it only takes a single person within a company to fall for a phishing email.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t
2. Honeytrap <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This technique targets individuals who are active on online dating platforms or social media, for example. The attacker creates fake identities by setting up fake profiles in order to befriend the target over an extended period of time. The attacker then exploits the \u201ctrust\u201d built up in this way to trick the victim into installing malware, transferring money, or disclosing confidential company information.<\/p>

To protect yourself from this tactic, it is crucial to foster a strong awareness of online security and privacy and to be careful not to disclose personal information and financial details carelessly.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t
3. Baiting <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Baiting is a type of social engineering attack in which the attacker makes false promises to trick the victim into revealing personal information or installing malware.<\/p>

The phishing method is often initiated by enticing ads or emails, which frequently take the form of offers for free movie downloads, updates, games, and similar items. If the victim falls for this deception and, for example, enters their password for platforms like Amazon, the attacker gains access to this sensitive data and can misuse it for their own purposes.<\/p>

Baiting isn’t limited to the online world; there’s also a physical version in which a malware-infected USB drive is handed to the victim. As soon as it’s plugged into the computer, the malware stored on the drive is automatically installed.<\/p>

To protect yourself from online baiting, it is strongly recommended that you always view advertisements and enticing offers with a critical eye. When it comes to offline baiting, it is particularly important never to connect USB flash drives from unknown sources in order to minimize the risk of a malware infection. Raising employee awareness and providing training on such fraudulent methods is also recommended.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t
4. Diversion Theft <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Diversion theft is a multifaceted cyberattack that originally began offline but has since evolved to include online variants. This type of attack aims to distract or divert the victim\u2019s attention while criminal activities are carried out.<\/p>

In an offline diversion theft, the attacker manipulates physical events. For example, a thief might convince a courier to pick up a package from the wrong location, deliver the wrong package, or hand over a package to the wrong recipient. The diversion usually takes place in the real world, and the damage can be significant.<\/p>

In the online version of Diversion Theft, the attacker uses tactics to steal confidential information from the victim. By skillfully employing distractions and misdirection, the attacker tricks the user into sending this information to the wrong recipient. The attacker often disguises themselves as a familiar or trustworthy source to deceive the victim. This is frequently done through spoofing.<\/p>

To protect yourself from phishing, it is crucial to remain vigilant and skeptical, especially when faced with unexpected distractions or communications from supposedly trustworthy sources. Training employees on online security, implementing strong security policies, and raising awareness of the risks of spoofing are essential defenses against this threat.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t
5. Pretexting <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Pretexting is a form of social engineering in which the attacker devises clever scenarios or pretexts to persuade the target to disclose sensitive information.<\/p>

The attacker may impersonate an authority figure (such as a lawyer, law enforcement official, or tax advisor) or pretend to have an interest in the target (such as a talent scout or event organizer). In this context, the attacker would provide the victim with plausible reasons and ask targeted questions to gather additional information. This collected data is used to employ other techniques to obtain even more sensitive information or even gain access to the victim\u2019s personal accounts.<\/p>

To protect against pretexting attacks, heightened vigilance is essential. Above all, this means not carelessly disclosing personal or sensitive information and carefully verifying the identity of anyone who requests such information. Raising employee awareness and providing training on social engineering are crucial in this regard.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t
6. Business-E-Mail Compromises (BEC) <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Business Email Compromise (BEC) is a sophisticated social engineering tactic in which the attacker cleverly impersonates a trusted executive who is authorized, for example, to issue instructions regarding a company\u2019s financial affairs.<\/p>

In this attack scenario, the fraudster closely monitors the executive\u2019s behavior over an extended period and creates a fake email account using spoofing techniques. The attacker then uses this fake identity to send targeted emails to the executive\u2019s staff. In these fake messages, recipients are instructed to make wire transfers, change bank details, and carry out other financial transactions.<\/p>

BEC attacks can result in significant financial losses for companies. Unlike other cyber fraud methods, BEC attacks do not necessarily rely on malicious URLs or malware that can be intercepted by traditional cybersecurity tools such as firewalls or endpoint detection and response (EDR) systems. Instead, BEC attacks rely on a detailed understanding of the victims\u2019 personal behavior. This makes them particularly insidious, as they are often harder to monitor and detect, especially in large organizations.<\/p>

The risk of BEC attacks underscores the need for employee training and awareness, as well as the implementation of effective monitoring and security policies<\/strong>, to minimize the impact of this type of fraud.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t
7. Quid-pro-quo-Attack <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The quid pro quo attack is a social engineering tactic in which the attacker pretends to provide a service to the victim, often in connection with supposed IT issues that need to be resolved, such as poor internet connections or security updates.<\/p>

If the victim responds to this supposedly helpful gesture, the attacker often requests the \u201cnecessary\u201d login credentials to resolve the alleged issue. Once the victim has disclosed this information, the attacker uses it to intercept data or even infect the network with malware. There is also the possibility that the malicious actor will use this access to employ additional social engineering techniques with significantly higher chances of success.<\/p>

To mitigate this threat, it is essential that all employees have a thorough understanding of social engineering. In addition, clear guidelines and policies should be established that prohibit the sharing of login credentials, even with purported IT support staff.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t
8. Smishing \/ SMS-Phishing <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

SMS phishing, also known as smishing, is a type of phishing attack in which the scammer attempts to trick the victim into clicking on a malicious link via text message. Since this is a specific type of phishing, the same precautions apply as with traditional phishing attacks, which were discussed earlier.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t

\n\t\t\t\t\n\t\t\t\t\t
9. Tailgating\/Piggybacking <\/div><\/span>\n\t\t\t\t\t\t\t\n\t\t\t<\/path><\/svg><\/span>\n\t\t\t<\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Tailgating, also known as \u201cpiggybacking,\u201d is a physical method of gaining unauthorized access to corporate premises. In this scenario, the attacker often lurks near secured entrances, hoping that an employee will open the door using their access credentials and thereby, knowingly or unknowingly, let the intruder in. Common tactics include pretending to have forgotten their access card or similar credentials at home. Alternatively, the attacker may simply say, \u201cWait a second, I need to go in too!\u201d in the hope of persuading the employee to briefly hold the door open for the intruder.<\/p>

Once an attacker has successfully gained access, they have numerous opportunities not only to explore the building but also to steal sensitive documents, compromise the company network, attempt to install malware, and much more.<\/p>

To prevent this type of intrusion, it is essential to provide all employees with an appropriate level of training and awareness programs that highlight the risks involved.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Social engineering example<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Social engineering is not a new phenomenon; deceiving people by pretending to have good intentions in order to exploit their trust has existed since the dawn of civilization. In modern times, however, the acceleration of our communication\u2014and especially the rise of impersonal communication\u2014has brought this type of deception even more into the spotlight.<\/p>

A vivid example of social engineering is Robin Sage, a fictional persona created in December 2009 by security expert Thomas Ryan. This experiment resembled a honeypot attack. Using this fictitious identity, Ryan created several profiles on social media platforms and deliberately established contacts, primarily with security experts, military personnel, and employees of intelligence agencies and defense organizations.<\/p>

Despite his fake profile, Robin Sage received offers for consulting work from companies such as Google and Lockheed Martin. Over a two-month period, Thomas Ryan managed to obtain email addresses, bank details, and even location information for secret military bases.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

New Developments in Social Engineering<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In its report \u201cThe State of IT Security in Germany 2023,\u201d the Federal Office for Information Security describes the potential for using generative artificial intelligence (GAI) in the field of social engineering<\/strong>.1 <\/sup>GAI models designed to generate human-like text or even voices enable attackers to create even more convincing and tailored deceptions.<\/p>

With GKI, social engineering attacks can be taken to a whole new level. Malicious actors can create personalized phishing emails, fraudulent calls, or fake social media profiles based on the individual characteristics of their potential victims. This can make it harder to detect fraudulent activity and reduce the effectiveness of security training.<\/p>

The implications of this technology for cybersecurity require heightened attention and proactive measures. Companies must keep their security infrastructures up to date at all times to be prepared for the evolving capabilities of GKI in social engineering scenarios. In addition, it is crucial to raise employee awareness of this specific threat to ensure a stronger defense against such deception attempts.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Precautions Against Social Engineering<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In social engineering, attackers exploit human vulnerabilities\u2014such as the desire to resolve issues quickly and easily\u2014to achieve their goals. This makes this type of attack particularly difficult to reliably thwart.<\/p>

To protect yourself as effectively as possible against this threat, you should implement the following protective measures<\/strong>:<\/p>