Social Engineering: The Science of Human Hacking, 2nd Edition

Description:

Harden the human firewall against the most current threats

Social Engineering: The Science of Human Hacking reveals the craftier side of the hacker’s repertoire--why hack into something when you could just ask for access? Undetectable by firewalls and antivirus software, social engineering relies on human fault to gain access to sensitive spaces; in this book, renowned expert Christopher Hadnagy explains the most commonly-used techniques that fool even the most robust security personnel, and shows you how these techniques have been used in the past. The way that we make decisions as humans affects everything from our emotions to our security. Hackers, since the beginning of time, have figured out ways to exploit that decision making process and get you to take an action not in your best interest. This new Second Edition has been updated with the most current methods used by sharing stories, examples, and scientific study behind how those decisions are exploited.

Networks and systems can be hacked, but they can also be protected; when the “system” in question is a human being, there is no software to fall back on, no hardware upgrade, no code that can lock information down indefinitely. Human nature and emotion is the secret weapon of the malicious social engineering, and this book shows you how to recognize, predict, and prevent this type of manipulation by taking you inside the social engineer’s bag of tricks.

Examine the most common social engineering tricks used to gain access

Discover which popular techniques generally don’t work in the real world

Examine how our understanding of the science behind emotions and decisions can be used by social engineers

Learn how social engineering factors into some of the biggest recent headlines

Learn how to use these skills as a professional social engineer and secure your company

Adopt effective counter-measures to keep hackers at bay

By working from the social engineer’s playbook, you gain the advantage of foresight that can help you protect yourself and others from even their best efforts. Social Engineering gives you the inside information you need to mount an unshakeable defense.

Table of Contents:

1 A Look into the New World of Professional Social Engineering

What Has Changed?

Why Should You Read This Book?

An Overview of Social Engineering

The SE Pyramid

What's in This Book?

Summary

2 Do You See What I See?

A Real-World Example of Collecting OSINT

Nontechnical OSINT

Tools of the Trade

Summary

3 Profiling People Through Communication

The Approach

Enter the DISC

Summary

4 Becoming Anyone You Want to Be

The Principles of Pretexting

Summary

5 I Know How to Make You Like Me

The Tribe Mentality

Building Rapport as a Social Engineer

The Rapport Machine

Summary

6 Under the Influence

Principle One: Reciprocity

Principle Two: Obligation

Principle Three: Concession

Principle Four: Scarcity

Principle Five: Authority

Principle Six: Consistency and Commitment

Principle Seven: Liking

Principle Eight: Social Proof

Influence vs. Manipulation

Summary

7 Building Your Artwork

The Dynamic Rules of Framing

Elicitation

Summary

8 I Can See What You Didn't Say

Nonverbals Are Essential

All Your Baselines Belong to Us

Understand the Basics of Nonverbals

Comfort vs. Discomfort

Summary

9 Hacking the Humans

An Equal Opportunity Victimizer

The Principles of the Pentest

Phishing

Vishing

SMiShing

Impersonation

Reporting

Top Questions for the SE Pentester

Summary

10 Do You Have a M.A.P.P.?

Step 1: Learn to Identify Social Engineering Attacks

Step 2: Develop Actionable and Realistic Policies

Step 3: Perform Regular Real-World Checkups

Step 4: Implement Applicable Security-Awareness Programs

Tie It All Together

Gotta Keep 'Em Updated

Let the Mistakes of Your Peers Be Your Teacher

Create a Security Awareness Culture

Summary

11 Now What?

Soft Skills for Becoming an Social Engineer

Technical Skills

Education

Job Prospects

The Future of Social Engineering

Index

End User License Agreement