The rise of social engineering and the cost of personal devices: A security perspective

Many potential weak links and vulnerabilities can be exploited in business settings, whether in microenterprises, medium-sized companies or large corporations. Some weak links require a high level of technical knowledge to detect, making them difficult to protect against attacks. Others, however, are easily exploited and often overlooked, presenting low-hanging fruit for threat actors.

Unfortunately, in the latter case, humans are an ever-present weakness that can be easily exploited, unwittingly exposing enterprises to risks—whether it is by fraudsters targeting them mercilessly with sophisticated scams, such as smishing and robocall attacks, or because employees are simply bypassing security tools to optimize their work. In today’s remote/hybrid corporate world, BYOD policies are more widely implemented to boost employee productivity and reduce hardware costs, although both of those reasons may not always hold true in practice. While BYOD may bring these benefits, it also potentially carries a significant cyber risk.
 

Social engineering: Smarter and more dangerous

With the increasing sophistication of social engineering (and today with the use of artificial intelligence [AI] and deep fakes to create highly convincing voice impersonations), even the savviest users can have difficulty detecting these attack schemes.

Scammers will typically seek out the weakest link in an organization, which often is the human element—such as disgruntled employees, lost personal devices used for work or executives who think they are communicating with someone they know. Wherever your weak link lies, there is a prime opportunity for threat actors to gain access through phishing (email/messaging), vishing (phone/voice) or smishing (text/Short Message Service [SMS]) attacks. For instance, a global ride-sharing company’s network was compromised in late 2022 when an attacker targeted a contractor who was using a personal device. After the device was infected with malware, the threat actor bought the contractor’s corporate password on the dark web. After repeatedly rejecting multifactor authentication requests, the contractor eventually accepted a request, allowing the threat actor to gain network entry.¹

As another example, one of the world’s largest media and entertainment companies recently had to shut down its computer systems for 10 days² after it appeared that hackers successfully impersonated an employee and convinced the IT help desk to obtain the user’s credentials to access and infect the system. Just through some basic online research on social media, the hackers seemingly managed to eventually take control of a multibillion-dollar company’s computer systems. If these types of attacks and scenarios can happen to global brands with nearly limitless resources, what does that say for midmarket organizations?

With such a high level of network access, threat actors have a great deal of leverage, ready to demand a ransom or go straight to disclosing or selling your sensitive data on the dark web. Breaches of this nature can also significantly damage your brand reputation, translating to potential drops in share prices and the possible alienation of consumers with data privacy concerns.
 

Corporate usage of personal devices is proving costly.

Enterprises must also contend with the fact that humans have the natural inclination to make their lives as easy as possible, always looking to simplify and streamline operations. This inclination has translated into the growing use of personal devices, which can present a dangerous risk to enterprises as they lose visibility and control not just over business processes but also over corporate security. This risk is not always created maliciously by the employee. Instead, it simply reflects a very human impulse to get things done in a convenient and timely fashion. While there are potential advantages of using personal devices in terms of business productivity, their use can nonetheless compromise the integrity of the work environment. Most worryingly, they can lead to regulatory compliance failures and expose the enterprise to financial liability.

This is similar to what happened recently in several high-profile cases in the U.S. financial services industry, which came to light in 2021. A number of large financial services providers were heavily fined (from US$10 million to more than US$100 million each) by federal agencies such as the U.S. Securities and Exchange Commission (SEC) for improper policing of employees’ use of off-channel messaging services and for failing to maintain and preserve all official communications by their employees. The fallout was costly, both from a reputation and financial standpoint.

The human risk factor cannot be understated. As so many unfortunate tales making recent news headlines highlight, the digital landscape is fraught with danger and risks. The challenge for enterprises now is to constantly manage both attacks and device misuse while minimizing the potential blast radius on business operations.

From a risk perspective, there is no doubt that some of the low-hanging fruit involves human weaknesses. How are these weaknesses being actively exploited or triggered? Verizon’s “2023 Data Breach Investigations Report” (DBIR) outlines some of these threat vectors.
 

People problems

People include not just employees and executives but also customers and third parties in the supply chain. They can be targeted with spray-and-pray email phishing tactics, but increasingly we are seeing spear phishing (targeting specific individuals), whaling (spear phishing attacks targeted at high-level employees), smishing (phishing attack via text messaging/SMS) and vishing (phishing attack via phone call/voice) attacks deployed as well, with successful outcomes. These types of attacks often require little technical knowledge. Background secondary research on social networks and some inventive scamming are usually more than enough for the threat actor.

• According to the 2023 DBIR, 74% of all breaches include the human element, with people being involved either via error, privilege misuse, use of stolen credentials, or social engineering.
• Business email compromise (BEC) attacks—pretexting attacks where attackers will oftentimes play on an invented scenario—have almost doubled within the past year across the DBIR’s entire incident dataset and now represent more than 50% of incidents within the social engineering pattern. Moreover, BEC attacks cost victims US$10.3 billion in losses in 2022, as reported by the Federal Bureau of Investigation’s Internet Crime Complaint Center (IC3) unit.
   

Vulnerable technologies

Technologies that may be vulnerable include personal computers, mobile devices, network systems, cloud infrastructure, software and applications. Remote work is here to stay in the post-pandemic world, with 92% of remote workers using their personal devices for work tasks.³ They also use these devices for entertainment (social media, mobile apps, etc.), posing potential cyber risks. This is a huge challenge for enterprises due to policy and regulatory compliance risks and corporate data leakage. Verizon’s Mobile Security Index (MSI) reports that more than 50% of personal devices [used in the workplace?] fell prey to a mobile phishing attack in 2022, with text messaging (SMS) attacks increasing the odds sixfold to tenfold (compared to email phishing attacks). The problem is that these personal devices may be managed by the individual employee, with enterprises having little to no control or visibility over device use. As a result, employees may unknowingly engage with a threat actor, and their company may not be aware of that activity until it is too late.

• While stolen devices (laptops, mobile phones, etc.) certainly represent a risk to organizations, employees are much more likely to cause a breach accidentally through loss.
• 78% of employees use their work devices for personal activities (social media, email, etc.), and nearly half let friends and family use their work devices according to Verizon’s MSI. These seemingly harmless decisions can lead to a companywide network breach if devices are not protected and monitored.
• This pattern of employees using work devices for personal activities continues to be a problem for organizations as these small portable devices store more information, but employees continue misplacing them.