Psychological Principles behind Social Engineering
Last updated
Last updated
Source: [ChatGPT/DALL·E] In this section of the module Social Engineering, we will explore the psychological tricks and methods used in social engineering attacks and why, despite widespread knowledge of these tactics, they remain some of the most efficient in cyberspace.
While many assume that technical flaws are the main cause of cyberattacks, in reality, social engineering often initiates these breaches. In fact, up to 91 percent of cyberattacks begin with a simple phishing scheme, as stated in an article from Microsoft [1].
Even the most cautious individuals can fall prey to the sophisticated manipulation of social engineers who skilfully exploit psychological principles such as trust and authority.
These methods often go unnoticed because they are woven into the fabric of everyday interactions, making them particularly stealthy and difficult to thwart. This article will shed light on why these human-centric strategies continue to pose a formidable challenge to cybersecurity.
Social engineering effectively manipulates individuals by leveraging specific psychological principles. Below are some of these most known principles along with some examples:
Reciprocity: People feel obliged to return favors.
Example: A hacker might offer exclusive access to beta software, making the user feel obliged to reciprocate, perhaps by completing a 'feedback' form that phishes for sensitive information.
Commitment: Once a decision is made, people tend to stick with it.
Example: Starting with agreeing to a small, seemingly harmless action, like confirming an email address, the user is gradually led to more significant commitments, like sharing confidential data.
Social Proof: People follow the lead of others.
Example: An email stating that most team members have switched to a new communication platform, complete with a malicious link, can prompt others to follow suit without questioning.
Trust and Authority: People respect authority and are more likely to comply with requests from authority figures.
Example: A phishing campaign where the attacker poses as a high-ranking company official, urgently requesting sensitive information, can bypass the usual security skepticism.
Liking: People are more likely to be influenced by people they like.
Example: By creating a profile that shares similar interests and backgrounds with the target, attackers can build a rapport, making their requests more persuasive.
Scarcity: Perceived scarcity can increase demand.
Example: A message stating that there are a limited number of slots for a cybersecurity webinar could push people to sign up quickly, compromising their data.
Of course, this is only a brief overview of the most well-known principles. There are many more, and probably some that are not even known yet. But if you want to delve deeper into the subject, I recommend the book "Social Engineering: The Science of Human Hacking" by Christopher Hadnagy [3].
Of course It's now natural to question: "Why would anyone fall for this?" Many reasons exist, but a prominent one is the lack of awareness about the tactics of social engineering. Most people navigate their daily lives with an innate trust in others, not anticipating malicious intentions. Amidst the hustle of everyday tasks, the thought that one could be a target of manipulation is often a distant concern. Here is an overview of the most common reasons why social engineering works:
Cognitive Overload: People can only process a limited amount of information at a time
Example: An attacker might overwhelm a target with technical jargon to cloud their judgment and extract sensitive information during the confusion.
Emotional Decision Making: Social engineers trigger emotional responses to override logical thinking.
Example: A fake urgent notice about a security breach might prompt an employee to hastily provide password details without proper verification.
Trust as a Default: Most people operate on implicit trust, especially in professional settings.
Example: An email that appears to come from a trusted colleague asking for file access can lead to unauthorized information sharing.
Authority Compliance: There is a natural inclination to obey figures of perceived authority.
Example: Impersonating a high-level executive, social engineers can direct employees to transfer funds or divulge confidential data.
Exploitation of Social Norms: Individuals may comply with requests to adhere to social etiquette.
Example: Out of politeness, a person might hold a door open for a 'technician', inadvertently allowing unauthorized access to secure areas.
Technology as a Veil: The anonymity of technology makes it easier for attackers to conceal their identities.
Example: Through Emails and phone calls, its hard to verify the identity of the sender, making it easier for attackers to impersonate others.
As you can see, there are many reasons why social engineering works. And this is just a small selection of the most common reasons. But we're such complex creatures that it's impossible to generalise about why it works so effectively. You could still say, though, it all boils down to something like: Humans are the weakest link in the security chain because they are prone to making mistakes and errors in judgement and that is just our human nature. But it's this very human aspect that holds the potential for increased awareness and resilience. Social engineering thrives on exploiting our imperfections, but with continued education and vigilance we can strengthen this seemingly weakest link. This complex interplay is what makes social engineering such an enduring challenge in cybersecurity.
In the next sections of this module we will look at the tools and techniques that social engineers use to exploit these psychological principles, and then we'll look at how we can defend against these attacks.
1 Website: The psychology of social engineering - the “soft” side of cybercrime - By Microsoft Security Team, June 30, 2020
2 Website: Understanding the Psychology Behind Social Engineering Attacks - By Mike Varley, Oct 1
3 Book: Social Engineering: The Science of Human Hacking - By Christopher Hadnagy, 2018
4 Website: The Psychology of Social Engineering – Why It Works - By Colorado Department of Education, January 21, 2020
