Human Factor in Cybersecurity Overview

Human Factor in Cybersecurity

Brief Overview

This note covering cybersecurity was created from a 49‑minute audio recording. It walks you through social‑engineering tricks, the CIA triad fundamentals, penetration‑testing steps, legal and governance considerations, plus a real‑world FDIC case study.

Key Points

• Why people are the weakest link and how curiosity, trust, and authority are exploited.

• Core social‑engineering tactics demonstrated in class (QR‑code phishing, disguised URLs, pretexting).

• Overview of the CIA triad and its relevance to both technical and human controls.

• Phases of a penetration test, from planning to reporting, with emphasis on the human element.

Human Factor – The Weakest Link in Cybersecurity

Definition: “Humans are the weakest link in cybersecurity, not cryptographic algorithms.”

• Primary Target: People (students, staff, anyone with access) are the primary target for attackers.

• Mechanism of Attack: Attacks that exploit curiosity, trust, or authority succeed because the human element is part of the overall system.

Key Points

1. Human behavior cannot be separated from the technical system.

2. Security controls (password policies, encryption choices) are only effective when people enforce them.

Social Engineering Techniques Demonstrated

Definition: Social engineering = “leveraging human weaknesses (curiosity, trust, authority) to obtain unauthorized access or information.”

Technical vs. Human Weaknesses

• Technical controls (encryption, firewalls) must be configured and maintained by knowledgeable humans.

• Human errors often create the openings for attackers before any technical flaw can be exploited.

Common Human Weaknesses

Responsibility, Laws, and Social Norms

• Quote: “People who are hired to know technological controls are also responsible for knowing the relevant laws.”

• Decision Makers: Who decides security settings? → The people (administrators, security officers).

Legal Considerations

• Data residency (Europe vs. Asia) impacts compliance.

• Privacy expectations may exceed what law explicitly requires.

Penetration Testing & Educational Exercise

• Objective: Students act as social engineers to discover which phishing tactics succeed.

• Scenario: Two‑person team designs phishing emails to test first‑semester students’ vulnerability.

Steps Emulated

1. Identify target group (e.g., first‑semester students).

2. Craft deceptive content (QR code, disguised link).

3. Deploy (send emails, display QR codes).

4. Observe which users click or scan.

5. Outcome guides improvements: train students to recognize fake emails and malicious links.

Network Analogies Used in Lecture

• Road network → computer network (paths = data routes).

• Postal Service → analogy for packet delivery (addressing, routing).

• These analogies help visualize how data moves and where human-controlled entry points (e.g., opening a suspicious email) can compromise the whole system.

The CIA Triad

• Elements of the CIA Triad:

  1. Confidentiality

  2. Integrity

  3. Availability

Importance of the CIA Triad

• The CIA triad is a mnemonic used throughout cybersecurity culture.

• Order of the letters is not critical; the concepts are what matter.

Offensive Security & Penetration Testing

• Definition: Offensive security – activities that simulate adversary behavior to discover weaknesses before real attackers do.

• Definition: Penetration testing (or “pen-test”) is a structured, simulated attack on an organization’s assets.

• Two primary approaches mentioned:

  1. Technical penetration – picking locks, exploiting software, etc.

  2. Social-engineering penetration – manipulating people who hold the keys (e.g., security guards, employees).

Social Engineering Definition

• Definition: Social engineering is the practice of exploiting human trust or error to gain unauthorized access.

• Example Platforms for Learning: Hack The Box (hackabox.com) offers free material and active community support.

Phases of a Penetration Test

Steps in a Penetration Test

1. Planning & Scoping:

   • Define goal: what is the client trying to achieve?

   • Determine allowed actions (what you can and cannot do).

   • Set boundaries: which locations, systems, or personnel are in‑scope vs. out‑of‑scope.

2. Reconnaissance (Research):

   • Gather intelligence on the target (people, systems, physical layout).

   • Understand the enemy as well as the defender; better knowledge improves attack design.

3. Target Identification:

   • Identify the weakest link in the security chain (e.g., a specific employee, security guard, or process).

   • This phase often resembles online stalking to learn habits and biases.

4. Exploitation:

   • Execute the chosen attack vector (technical or social) against the identified weak point.

   • No guarantee of success; the aim is to demonstrate risk, not to guarantee compromise.

5. Reporting & Remediation:

   • Document findings, including which controls failed and recommendations for improvement.

   • The goal of a penetration test is not to guarantee success, but to provide the client with actionable insight into their security posture.

Real‑World Example: FDIC Scenario

Context

• FDIC moved operations to a larger Arlington campus, tripling daily foot traffic and hiring new security personnel.

• Changes Introduced:

  1. New databases for student records.

  2. New software and hardware assets.

  3. Expanded physical security (more guards).

Engagement

• The security team was hired to assess the environment using both technical and social‑engineering methods.

• Key Considerations:

  1. New employees (lawyers) and guards introduce fresh human‑factor risks.

  2. Increased traffic raises the probability of successful social attacks (e.g., “call from Mom” scenario).

  3. The team needed to align their testing scope with the new building, remote sites, and the expanded staff roster.

Key Takeaways

• Understanding the target—both technology and people—is essential for effective offensive security.

• Scope definition prevents legal/ethical violations and focuses effort.

• Research informs tool selection and attack planning.

• Social engineering often targets the human weakest link rather than technical defenses.

• Continuous change (new systems, staff, locations) requires regular reassessment of security posture.

Social Engineering Attack Success Factors

Creating Rushed Scenarios

• Put the target under pressure (e.g., hurry, fatigue) to increase mistake likelihood.

• Example from Lecture: The instructor pretended to be out of breath, rushed to log in, and deliberately forgot his password to simulate a hurried user.

Observation & Target Selection

• Definition: Shoulder surfing – watching victims’ screens or inputs while they are distracted.

• Identify “good targets” by noting who looks distracted or frequently looks away.

• The lecturer scanned the room, noting students in the back as potential targets.

Pretexting & Trust Building

• Definition: Pretexting involves crafting a believable story or identity to gain the target’s trust.

• Strategy: Establish an online footprint (fake LinkedIn profile, blog, or news articles) so the victim can verify the attacker’s identity.

• Communication Style: Sculpt communication style to match the victim’s expectations (e.g., professional tone on LinkedIn).

• The instructor highlighted that an attacker must ensure the victim can “look me up online” and find consistent, credible information.

Practice, Pivoting, & Adaptability

Practice

• Repeated rehearsal of the entire attack scenario, from entry to exploitation.

• Emphasis: “practice, practice, practice” is crucial.

Real Attacks Require Pivoting

• Adjusting tactics in real-time based on the environment and target reactions.

• Humans are unpredictable; unlike machines, they may change behavior unexpectedly, demanding flexibility.

Benefits of Practice

1. Enhances confidence during execution.

2. Allows identification of weak points in the plan before a real engagement.

3. Reduces the chance of a failed one‑shot execution.

Documentation & Reporting

• Importance: Documentation provides a detailed written account of every step taken during the attack, from preparation to outcome.

• Critical for knowledge transfer and for clients to understand vulnerabilities.

Components of a Clear Report

1. Pre‑engagement reconnaissance (e.g., target list, observed habits).

2. Attack timeline (entry, social engineering steps, pivot points).

3. Observations of target behavior and any deviations.

4. Recommendations for remediation.

Attack vs. Exploitation

Definitions

• Attack: The act of gaining unauthorized access or influence (e.g., guessing a password, persuading a target to open a door).

• Exploitation: Using the access obtained from the attack to steal, modify, or leverage assets.

Teaching Insight

• The lecturer stressed that attack precedes exploitation; you cannot exploit what you haven’t first attacked.

• Exploitation is often the most financially rewarding phase for attackers, but its success hinges on the quality of the initial attack.

Key Takeaways (Blockquote Summary)

• Rushed environments increase victim error rates.

• Observation (shoulder surfing) helps pinpoint vulnerable targets.

• Pretexting relies on a believable online persona.

• Continuous practice and the ability to pivot are essential for real‑world success.

• Thorough documentation is as valuable as the attack itself.

• Attack must come before exploitation; they are distinct but sequential phases.