As a business leader, you understand that your IT infrastructure is important. You have invested in technology that positions your business for success. You’ve put security measures in place to keep your data safe. But, you know that risks still exist. You want to minimize them.
Social engineering tactics are designed to trick your employees into providing access to sensitive information. One of the security risks you need to understand and protect against is a social engineering ploy known as baiting.
Don’t panic.
There are a lot of social engineering ploys out there and it’s hard to keep them all straight. I work at an IT service provider and customers ask us about social engineering frequently. Don’t worry though, I’m not writing this article to convince you to work with Kelser or to tout the benefits of managed IT services.
We understand that not everyone is an IT expert, so we publish articles like this that include all the information you need without bogging you down in technical jargon.
In this article, I’ll provide a straightforward explanation of what baiting is, who it targets, how it works, what it looks like, how to spot it, and how to avoid it.
People who enjoy fishing know that the better their bait (or lure), the more likely they are to land the big catch.
In social engineering terms, baiting is a tactic in which a perpetrator provides a link (the bait) that piques the user’s curiosity or appeals to their desire for money or power. In return, the outsider hopes the user will take an action that provides an opportunity to infect a network or system with malware and gain access to sensitive information.
Everyone who uses electronic media is a potential victim.
Age is not a discriminator. Experience is not a discriminator. Everyone from young people to business professionals to senior citizens (and everyone in between) can be a victim of a baiting scheme.
No one is immune, but knowledge is power.
No matter what form it takes, all baiting campaigns capitalize on human curiosity or greed.
Baiting campaigns can be delivered via a variety of devices and platforms including social media, ads, email, external storage devices (like flash drives), and text messages.
In the not-so-distant past, a baiting campaign may have promised riches from a foreign dignitary. Nowadays, most people would recognize that as a ploy of some sort. They might not know it is baiting, but they’d probably not be likely to click on the link.
But what if you receive an email that includes what looks like a link to salary ranges for co-workers, or a text link promises you a deal on the latest smartphone? What if you find a random flash drive left in the parking lot or the break room?
Curiosity would drive most of us to want to know more. These are all examples of baiting schemes. And, all of them are designed to exploit human curiosity.
As with other forms of social engineering, certain telltale signs can help you recognize a baiting attempt.
The reward will likely not be worth the risk. Re-train your brain to be cautious.
Remember the old adage: If it sounds too good to be true, it probably is. (And, it may be dangerous as well.)
There are numerous steps to take that will help your organization avoid baiting. Here are some to take immediately:
You’re already in a better position to protect yourself simply as a result of reading this article.
Now you know that baiting is a social engineering ploy perpetrators use to try to appeal to human curiosity and greed, with the ultimate goal of installing malicious software and gaining access to sensitive information.
You know that anyone (no matter their age or experience) can fall victim to baiting.
You also know what baiting looks like and how to recognize it as well as 6 important steps to take today to avoid it.
This knowledge will help you protect your organization.
Some IT service providers provide cybersecurity awareness training as part of a managed services offering. We know that managed IT isn’t right for every organization, but if you are considering outsourcing your IT, managed services might be a solid solution.
Find out more about managed IT by reading this article: What Does A Managed (IT) Service Provider Do? (Essential & Premium Services)
Whether you ultimately decide that managed IT is right for you or not, use the information outlined above to educate your workforce about phishing and how to recognize and avoid it. We publish articles like these because Kelser is committed to transparency and providing the information you need to keep your IT infrastructure safe.