Social Engineering, Physical Attacks, Insiders and APTs

What it is

These threats target people, buildings and trusted access instead of breaking technology.

Social engineering means manipulating a person into giving away information or access. It works because people are often easier to fool than systems.

This page also covers physical attacks, insider threats and the advanced persistent threat, which is a patient, well funded attacker.

How it works

Most attacks here rely on trust, urgency or authority rather than technical skill.

Social engineering methods

Tailgating is also called piggybacking in some sources. It is a physical form of social engineering.

Attackers use pressure such as "your account will close today" or "the manager needs this now". The aim is to make you act before you think.

Signs of a phishing message

• an unexpected request for a password, payment or personal data
• a sender address that looks close to the real one but is slightly wrong
• a threat or deadline that creates urgency
• a link whose real destination differs from its text
• poor spelling, or an unusual greeting

The safe response is to stop, not click, and report the message through the proper channel. If you doubt a call or text, contact the organisation through a number you already know.

Physical attacks

Physical attacks need the attacker to be present, or to reach hardware. Examples are:

• theft of laptops, phones or storage media
• entering a server room or wiring cupboard without permission
• plugging a rogue device into a network port
• looking over a shoulder to see a password, known as shoulder surfing
• searching rubbish for useful papers, known as dumpster diving

Controls include badges, locks, cameras, visitor logs, security guards, a clean desk policy and shredding paper. Mantraps, which are small rooms with two doors, stop tailgating by letting only one person through at a time.

Insider threats

An insider threat comes from someone with legitimate access, such as an employee, contractor or partner. The harm can be deliberate, for example stealing data before leaving a job. It can also be accidental, for example sending a file to the wrong person.

Insiders are hard to spot because their access looks normal. Useful controls are least privilege, separation of duties, monitoring and logging, and removing access quickly when a person leaves.

Advanced persistent threat

An advanced persistent threat (APT) is a skilled and well resourced attacker that breaks into a network and stays hidden for a long time. The word advanced refers to the skill and tools. Persistent refers to the long, patient campaign.

APT groups are often linked to nation states or organised crime. Their goals are usually long term, such as spying or stealing intellectual property. A typical campaign moves through stages: gaining entry, setting up a foothold, spreading inside the network, and then taking data out slowly.

Defence in depth, monitoring and quick detection are the best answer, because a single control rarely stops a patient attacker.