Key takeaway
Endpoint protection may help detect malicious files and processes, but it cannot remove the attempt to manipulate a person. Pair technical controls with reliable work procedures and a clear reporting path.
Three stages of an attack
Research, pretext preparation and contact are a useful model for a targeted attack; not every attack follows this sequence. An attacker first gathers public information about a target, their role and the services they use. Then the attacker builds a pretext suited to that context, such as a request supposedly from a supplier or employee portal, and makes contact by email, phone, social platform or fake site. Recognizing this sequence helps people assess who is being approached and why, not just look for spelling errors.
Social engineering techniques to recognize
Phishing may persuade someone to disclose information, visit a fake page or open a malicious file. Spear phishing is tailored to a person; whaling targets senior executives. Pretexting uses a false identity and story. Baiting offers an attractive file or device, while quid pro quo offers help or a service in exchange for information. A watering-hole attack compromises a site that targets visit, putting visitors and their devices at risk; it does not automatically compromise visitors’ own websites.
Where endpoint controls can help
Email and web filters may identify a dangerous link or attachment before it reaches a user. Depending on the product and configuration, Endpoint Protection and EDR may restrict a malicious file, alert on suspicious process activity and provide investigation data. These controls do not automatically prevent a mistaken payment, voluntary password disclosure or trust in a deceptive call. Financial approval, identity checks and employee reporting need their own procedures.
Pair technical controls with work procedures
Create a known-channel verification process for unexpected access and payment requests. Show staff where to report suspicious email, messages and calls. Keep devices and browsers updated, limit application permissions and use approved software. In an exercise, check both how someone reports a lure and what the technical team does for the affected device and account.