Although it may be tempting to imagine hackers as being shy and socially inept types, whose only human interaction is via their computers, this is an assumption which rarely corresponds to the reality. In fact, in some cases, the social capabilities of hackers have worked greatly in their favor as a method of intrusion.

This technique is called social engineering and consists of tricking and manipulating the victim into committing a human error so as to compromise the security of IT systems.

Social psychology as a method of intrusion

This form of intrusion doesn’t rely on vulnerabilities in the IT system, but rather a social interaction (online, by telephone, or face-to-face) between the attacker and the weak link in the IT security chain – the user. The most successful social engineering techniques are based on the charisma and problem solving capabilities of the hacker, and almost always a deep knowledge of human psychology, of our irrational impulses, and of our feelings of trust, curiosity, attraction, and fear.

For example, the hacker will try to pass itself off as another person (such as a security personnel or a technician) or will pretend to have a role authority so as to coax confidential information from the victim. All of this is done without the victim realizing for one moment they are being duped.

Kevin Mitnick, one of the most notorious hackers in the 1990s, now works as a digital security consultor and says that social engineering is usually based on four fundamental principles:

1. “We all want to help”
2. “The first reaction is to trust in the other person”
3. “We don’t like to say no”
4. “Everyone likes to be praised”

An example is that of Chris Nickerson, the founder of Lares, an American security consultancy firm that used social engineering techniques to test the levels of security in businesses by means of “red team tests”. Armed with only information available to the public on the internet and a technician’s shirt from a known tele-operator, Nickerson tries (and usually succeeds) to access the company’s offices and manipulate the workstations in front of all the employees.

Brief classification of techniques

• Passive – based on observation and behavior analysis, with the aim of reconstructing their daily routine, to create an approximate psychological profile, etc.
• Non-present – based on requests for information via email or over the phone.
• Present but not aggressive – this includes actions such as spying on someone’s house or looking for personal documents in the trash.
• Aggressive and present – Psychological pressure and identity theft.

How do I stop my employees from becoming victims?

In their 2003 book, Hacking Linux Exposed, B. Hatch and J. Lee suggested adopting the following attitudes and they are still relevant today:

• “Train the users” – given that this type of attack is always launched against a person, the best way to avoid it is to ensure that all of your employees are aware of what to look out for when it comes to social engineering tactics.
• “Be paranoid” – the authors recommend “cultivating a healthy paranoia”, as it is normal that the hackers will be wary of using someone who doesn’t seem to trust them. “They look for the easiest objective”, they added.
• “Ask them everything” – it’s advisable to always ask the person you are dealing with why it is that they need the information that they request. “The majority of social engineering attacks fail by asking the attacker questions”.
• “Always check their sources” – if we are suspicious of a request sent my email, we should verify it by calling the person by telephone. If we speak face-to-face with someone we don’t know, we should demand to see some form of ID.
• “Learn to say no” – when a hacker is applying social engineering tactics, it is normal that he or she does it by straying from the norms of the business or tries to get the victim to do it. Keeping within the set rules is a good form of defense in these cases.
• Also recommended is that the business has a good EDR platform (to detect and protect against threats) such as Adaptive Defense 360.

This means that if a user falls for a trap and clicks on a link to download an infected application, it is blocked immediately. It will also inform, in real time, to the company’s security team so that they can act as soon as possible.

The post Social Engineering techniques – What they are and How businesses can avoid them appeared first on MediaCenter Panda Security.

Direct attacks, identity and information theft of all sorts (especially social engineering), persistent advanced threats… the risks associated with information security are continually multiplying in a world which is increasingly more digital, mobile, and multi-device based. With this backdrop it is no surprise that cybersecurity experts are in high demand along with professionals in other sectors such as information analysis, big data technology, and data scientists.

So, which are the most desired profiles in security departments? Which training do these professionals need to have and how much are they paid? To get the answers to all of these questions, and to help security experts and the businesses which are looking for them have a realistic idea of how they fit into the marketplace, we have consulted two HR experts with specific experience in the IT sector. Sára Álvarez, Spring Professional manager at Adecco, is in no doubt – engineers and security technicians, as well as auditors specialized in this area and even pre-sales engineers, are the most sought-after roles in security departments.

María Mosquera, executive manager at Michael Page Technology, adds that Logic Security Managers, IT Security Technicians and Experts, Security Managers, Ethical Hacking Experts, and CISOs (“this is generally a position attained after a promotion from another management role”) are the job profiles that are in demand. They are particularly sought-after by consultancy firms “where there are parts of the business solely dedicated to information security”. The role of CISO, she says, “is generally reserved for larger companies”.

Professionals that are requested more and more

“In recent years we have identified a clear need for these profiles in different customers in different sectors. It is a reality that security is increasingly important in companies because everything is already in the network,” states Alvarez. “In 2014, especially, we saw that the focus of the security companies completely changed. Whereas before these profiles were sought out as needed, nowadays they fill their departments with expert, permanent staff in in order to prevent data leaks and other threats. The demand for security professionals almost doubled last year compared to 2013”.

Mosquera agrees with Adecco’s spokeswoman about the growing relevance that security has taken in all organizations, which she says typically have a specific department or work with external consultants specialized in the field. “Hence the demand for relevant specialists to simulate Ethical Hacking security attacks and be ready to counter them,” she added.

Necessary training

Regarding the training demand for these profiles, it is diverse but always related, obviously, to the world of information technology. “Normally these roles have an extensive background in systems and, over time, have been specializing in security,” said Alvarez, although Mosquera says that besides being IT graduates, many professionals in the field of security are telecommunication engineers.

Of course, both agree on the importance of these experts having a series of certifications: “The most important are those such from ISACA, such as CISA, CISSP, and CISM, others like CEH, CRISC, and SIEM. They should also know how to handle tools with ad hoc security solutions at companies like Panda Security, Palo Alto Networks, Bluecoat Systems, Symantec, etc.,”, explains the spokeswoman from Michael Page Technology.

While the more technical positions require more practical training on certain products, they majority related to the management or security strategy, for example, the auditor, which should develop contingency plans and data protection, need more certifications linked to such development plans, with knowledge of the existing data protection rules (in Spain the LOPD), and the advising on information systems, etc.”, reveals Álvarez.

So, how much are they paid?

And now the big question – what is the salary for profiles related to information security? “The positions from technician to manager and expert, often range between €45,000 and €65,000 gross per year, depending on whether the position is for a consultancy or end company. In consulting, the categories above manager can reach €75,000. For the position of CISO, the salary range depends on the size of the department and consequently of the organization, but may be around between €80,000 and €120,000 gross,” reveals Mosquera.

Alvarez is more conservative regarding the salaries. “The lowest profile, the technician, can start from €30,000 gross per year, but if the professional has certifications, speaks English and relevant experience, the salary may be higher, from €35,000 to €37,000. Security engineers earn between €35,000 and €45,000 euros gross per year, the architects, who are the most powerful on a technical level, earn between €40,000 and €52,000, auditors start out with a salary of €42,000 and security managers start with €50,000″. The Adecco spokewoman also highlights a role that is on the rise in the security sector, that of presale management, whose salary is between €35,000 and €46,000 gross per year.

The trend in salaries of these experts, of course, is increasing. Keep in mind that many times it is not easy to find these profiles and, above all, retain them in companies that literally raffle the best. Therefore, another trend that is beginning to prevail in many companies is addressing HR policies aimed at retaining these profiles by other incentives such as training, and social benefits, etc.

The post The most sought-after professional profiles in the information security sector appeared first on MediaCenter Panda Security.

You have read and reread numerous lists with tips on how to browse online safely, make online purchases, avoid your most intimate photos ending up online, stopping cybercriminals from ruining your vacation, or how to enjoy your favorite games without risking your privacy…

You’ve heard the same basic precautions time and again, but you keep ignoring almost all of them. It could be down to laziness or recklessness, or simply just forgetting them. This, however, could have dire consequences for your online security.

This is why we wanted to bring together, in a single list, the most basic security measures you should remember and stick to!

1. Opening any attachment that you receive by email

If you receive an email from a suspicious source or you don’t have a good feeling about it, don’t open the attachment. As we’ve said on numerous occasions, documents that look inoffensive (such as a Word document, for example) could be hiding malware and even a simple photo could prove to be dangerous.

2. Clicking on shortened links without thinking

If you use Twitter then you’ll know what we’re talking about – these links, which are becoming increasingly more common, are spread using sites such as bit.ly, the famous ow.ly from Hootsuite or goo.gl by Google. Usually, they lead you to nothing dangerous such as a blog or an online diary, but some links aren’t as inoffensive as they seem. If you want to assure yourself that the links are safe, take a look at these tips.

3. Using public Wi-Fi without taking precautions

There have been many articles written that warn us about the dangers of using public connections such as the ones that we find in cafes, hotels, airports or libraries. Even a 7-year old girl, without any technological know-how, is capable of spying on your online communications. To keep safe, don’t share confidential information (passwords, bank details, etc) and, if you can, use a virtual private network (VPN) and only access pages that use safety protocol (you’ll know it by the http in the address bar).

4. Ignoring security updates

If your operating system tells you that you need to install or update something, you should pay attention and do it. A lot of times it consists of measures to cover up weaknesses that have been recently detected that cybercriminals could use to their advantage. The same goes for your cellphone; always use the latest version of Android or iOS available and keep aware of what apps you have installed.

5. Using the same passwords on different accounts

Even though it’s the easiest way to remember them all, it’s a really bad idea, because if someone gets hold of your password then they have free rein on all of your accounts. Also, any attack on a company’s database (which is also becoming more common) can wind up with your credentials being sold on the black market. When a cybercriminal gets his hands on them, he’ll be able to access every protected account. To avoid this, activate the two-step verification tool such as the ones for Gmail or Facebook.

6. Thinking that an antivirus isn’t important

A good antivirus software is the best barrier you can put between your computer and cybercriminals. New vulnerabilities, different ways of compromising your private information, and ways to raid your bank account are discovered every day. Only security experts at specialized firms are aware of antivirus updates necessary for when a threat emerges. By the way, if you have a Mac, it’s also necessary to have an antivirus. The idea that Apple products don’t have viruses is a myth.

7. Thinking that backing up files is a waste of time

Making a backup of your files is much easier than it sounds, but if you get lazy just thinking about it then remember that you have many tools at your disposal that handle everything. The Panda security solutions, without going any further, allow you to program backups to save your files in the cloud and retrieve them quickly and easily.

8. Not paying attention to your browser when it says the connection isn’t secure

When we surf the net, we tend to act on autopilot and ignore any warnings that we come across. If Chrome says that a web is not safe, we ignore the warning. If Firefox asks for confirmation before downloading a file, we give our approval without thinking. Science says that we have become accustomed to these messages so that we no longer notice them. For you sake, pay attention! Neither Mozilla nor Google show these messages to annoy you.

9. Giving out information on social media

This is especially true for when we go on vacation and share all the details on Facebook or Twitter, but also when we reveal our location without thinking about who could use it for malicious purposes. Sometimes we forget, but all the information we publish on social networks is capable of ending up in the wrong hands.

10. Downloading applications from anywhere

The malware designed for mobile devices is booming and one of its main pathways are the dangerous downloads outside of Google Play and the Apple Store. The official stores have certain security measures to prevent spread malware and you can read reviews from other users before deciding to install an app, in case there was something suspicious. Conversely, if you download from an unofficial page and install it on your own, the likelihood of it containing malware is higher.

The post 10 careless errors that we keep making in IT security appeared first on MediaCenter Panda Security.