Social engineering

The psychological mechanics are well mapped. Robert Cialdini's principles of influence (1984) - reciprocity, commitment and consistency, social proof, authority, liking and scarcity, later extended with unity - describe the levers that almost every lure pulls: an executive's name (authority), a deadline (scarcity), "your colleagues have already signed" (social proof), a small favour before the real request (reciprocity). They work because they trigger fast, heuristic System 1 processing; the attacker's aim is to keep the victim from switching to deliberate System 2 thinking, which is why time pressure and emotional arousal (fear, curiosity, greed, helpfulness) appear in nearly every scenario.

Kevin Mitnick's The Art of Deception (2002) described the attack as a cycle: research, developing rapport and trust, exploiting that trust, and using the information gained, often as input to the next cycle against someone more senior. Reconnaissance draws on OSINT (company sites, LinkedIn, job adverts, public registers, breach dumps), and the output of one conversation - a name, a system, an internal phrase - becomes the credibility of the next. The main technique families are phishing and its channel variants (spear phishing, BEC, smishing, vishing), pretexting, baiting (infected media or tempting downloads), quid pro quo (fake support offering help in exchange for credentials), and physical techniques such as tailgating and impersonating contractors. Tischer et al. (IEEE S&P 2016) dropped about 300 USB sticks on a university campus and found that close to half were plugged in and had files opened.

MITRE ATT&CK does not have a single social-engineering technique; the behaviour is spread across T1566 Phishing and T1598 Phishing for Information, T1204 User Execution, where the victim runs the payload, and T1091 Replication Through Removable Media. High-impact incidents illustrate the range: in July 2020 attackers phone-phished Twitter employees to reach internal admin tools and hijack high-profile accounts, and in 2023 a help-desk call was the reported entry point into MGM Resorts, followed by ransomware.

Because social engineering bypasses technical controls by definition, defence has to change the decision environment rather than only the user. Effective measures are verification procedures that do not depend on judging the caller (call-back to a known number, out-of-band approval, four-eyes rules), phishing-resistant MFA and hardened help-desk identity checks, least privilege so a manipulated user can hand over less, physical access controls such as turnstiles and escort rules, and a reporting culture in which staff who were fooled report quickly without fear. ISO/IEC 27002:2022 addresses the human side through control 6.3 (awareness, education and training) and the physical side through controls 7.1-7.4. Social engineering is the umbrella category; the human factor is the underlying weakness it exploits, and security awareness and security culture are the corresponding defences.