Social Engineering: Defending Against Technology-Based Deception

The main goal of technology-based social engineering is to obtain confidential information from individuals within an organization for the purpose of gaining access to the enterprise's network. Attackers either deceive individuals into divulging access information or they obtain information left on discarded company documents and/or storage devices (hard drives, storage media, etc.). This note provides an overview of the most common types of technology-based deception and recommends a series of protections to mitigate those threats.