I’m a Nigerian Prince, and I need you to give me your bank account number so I can transfer money to you…
You’ve won the lottery in Uzbekistan…
We need your Password so we can verify your PayPal account before your account access is permanently revoked…
Social engineering is a term in computer security that refers to a multitude of fraud schemes on your computer systems through the weakest link in most systems… the user. Hackers and thieves try to manipulate you to gain access to your personal information, or to your computer systems where they can do some serious damage. There is a whole host of attacks that people can and will try on you. The key is being aware and remembering the adage if it sounds too good to be true, it probably is! Here’s a brief list of attacks that can be used against you:
Phishing- This is probably the most common attack we see. This can be a simple email asking for you to verify your Gmail account or a PayPal account. Criminals are looking, or phishing, for your personal information. There are key ways to identify these emails as fraudulent:
1. Grammar mistakes and misspellings
2. Threatening language
3. Fantastic job offers or promotions
4. The link addresses don’t match the sender of the email. Google is spelled with zeros instead of o’s
5. Requests for money
6. Unsolicited requests to change passwords
7. In general, it sounds too good to be true
It’s important not to click any links in suspect emails! This could start the download of a whole host of malicious software that can compromise your computer systems, and you could have a HIPAA breach on your hands.
Some other social engineering techniques include:
Pretexting, baiting, quid pro quo, tailgating (It’s amazing the things people will use to get at your information! Here’s more information on Wikipedia… Be alert! Criminals are looking for ways to compromise your system, and they are looking for the easiest way in.
Do a little social engineering of your own and train your employees on how to use their workstations properly, what HIPAA is, and how they can support your efforts to keep client information safe. HIPAA security training covers these potential attacks on your system and much more. Remember HIPAA training is NOT optional, and the best business practice is retraining annually.
