Call Centers - A Gateway for Social Engineers to Access Your Company’s Most Sensitive Information

| April 26, 2016

article image
"While companies commit huge budgets and resources on complex technology to fortify their network perimeters, their own employees may be giving dangerous cybercriminals the keys to the front door.

This paper explores the rationale as to why customer support centers – most notably the call center – is such an attractive target to social engineers. The paper not only analyzes the fundamental causes for most security weaknesses within call center environments, but also provides reliable strategies for mitigating risk and reducing exposure.

Plus, it exposes the common methods of attack used by cybercriminals, explains why they work, and offers expert insight on what organizations can do to identify and combat malicious social engineering tactics."

Spotlight

Cyber Security Services

Cyber Security Services is a cyber security consulting firm and security operations center (SOC) headquartered out of Columbus, Ohio. We help customers meet cyber security challenges through consulting engagements, Virtual CISO Services, security monitoring, and cyber security product expertise. We want to be an extension of your security team.

OTHER ARTICLES

Information Security Management System to Protect Information Confidentiality, Integrity, and Availability

Article | June 18, 2021

In this modern world of technology, ensuring information security is very important for the smooth running of any organization. Unfortunately, there are many information/cyber security threats, including malware, ransom ware, emotet, denial of service, man in the middle, phishing, SQL injection, and password attacks. Whatever your business is, no doubt, it can collapse your business and your dreams. However, the severity of its after-effects depends upon the type of business you do. As information security threat has become a hurdle for all organizations, companies must implement an effective information security management system. In 2019 alone, the total number of breaches was 1473. It is increasing every year as businesses are doing digital transformation widely. Phishing is the most damaging and widespread threat to businesses, accounting for 90% of organizations' breaches. This article lets you understand what ISMS is and how it can be effectively implemented in your organization. Information Security Management System (ISMS) According to ISO/IEC 27001, Information Security Management System (ISMS) refers to various procedures, policies, and guidelines to manage and protect organizations' information assets. In addition, the system also comprises various other associated resources and activities frameworks for information security management. Organizations are jointly responsible for maintaining information security. People responsible for security in an organization ensure that all employees diligently meet all policies, guidelines, and other objectives regarding protecting information. Also, they safeguard all assets of the organization from external cyber threats and attacks. The goal and objective of the system are to protect the confidentiality, integrity, and availability of assets from all threats and vulnerabilities. Effectively implementing an information security management system in your organization avoids the possibility of leaking personal, sensitive, and confidential data and getting exposed to harmful hands. The step-by-step implementation of ISMS includes the process of designing, implementing, managing, and maintaining it. Implementing ISMS in Organizations The standard for establishing and maintaining an information security management system in any organization is ISO 27001. However, as the standard has broad building blocks in designing and implementing ISMS, organizations can shape it according to their requirements. Effectively implementing ISMS in organizations in compliance with ISO 27001 lets you enjoy significant benefits. However, an in-depth implementation and training process has to be ensured to realize these benefits comprehensively. Therefore, let us look into how an information security management system can be successfully implemented in your organization. Identification The first step in implementing ISMS is identifying the assets vulnerable to security threats and determining their value to your organization. In this process, devices and various types of data are listed according to their relative importance. Assets can be divided across three dimensions: confidentiality, integrity, and availability. It will allow you to give a rating to your assets according to their sensitivity and importance to the company. Confidentiality is ensuring that the assets are accessed by authorized persons only. Integrity means ensuring that the data and information to be secured are complete, correct, and safeguarded thoroughly. Availability is ensuring that the protected information is available to the authorized persons when they require it. Policies and Procedures and Approval from the Management In this step, you will have to create policies and procedures based on the insights you got from the first step. It is said to be the riskiest step as it will enforce new behaviors in your organization. Rules and regulations will be set for all the employees in this step. Therefore, it becomes the riskiest step as people always resist accepting and following the changes. You also should get the management approval once the policies are written. Risk Assessment Risk assessment is an integral part of implementing an Information Security Management System. Risk assessment allows you to provide values to your assets and realize which asset needs utmost care. For example, a competitor, an insider, or a cybercriminal group may want to compromise your information and steal your information. With a simple brainstorming session, you can realize and identify various potential sources of risk and potential damage. A well-documented risk assessment plan and methodology will make the process error-free. Risk Treatment In this step, you will have to implement the risk assessment plan you defined in the previous step. It is a time-consuming process, especially for larger organizations. This process is to get a clear picture of both internal and external dangers that can happen to the information in your organization. The process of risk treatment also will help you to reduce the risks, which are not acceptable. Additionally, you may have to create a detailed report comprising all the steps you took during the risk assessment and treatment phase in this step. Training If you want effectively implement all the policies and procedures, providing training to employees is necessary. To make people perform as expected, educating your personnel about the necessity of implementing an information security management system is crucial. The most common reason for the failure of security management failure is the absence of this program. Implementing ISMS Once policies and procedures are written, and necessary training is provided to all employees, you can get into the actual process of implementing it in your organization. Then, as all the employees follow the new set of rules and regulations, you can start evaluating the system's effectiveness. Monitoring and Auditing Here you check whether the objectives set were being met or not. If not, you may take corrective and preventive actions. In addition, as part of auditing, you also ensure all employees are following what was being implemented in the information security management system. This is because people may likely follow wrong things without the awareness that they are doing something wrong. In that case, disciplinary actions have to be taken to prevent and correct it. Here you make sure and ensure all the controls are working as you expected. Management Review The final step in the process of implementing an information security management system is management review. In this step, you work with the senior management to understand your ISMS is achieving the goals. You also utilize this step to set future goals in terms of your security strategy. Once the implementation and review are completed successfully, the organization can apply for certification to ensure the best information security management practices. Summing UP Organizations benefit from implementing and certifying their information security management system. The organization has defined and implemented a management system by building awareness, training employees, applying the proper security measures, and executing a systematic approach to information security management. Thus implementation has the following benefits: Minimized risk of information loss. The increased trust of customers in the company as the company is ISO/IEC 27001 certified. Developed competencies and awareness about information security among all employees The organization meets various regulatory requirements. Frequently Asked questions What are the three principles of information security? Confidentiality, integrity, and availability (CIA) are the three main principles and objectives of information security. These are the fundamental principles and the heart of information security. How does information security management work? Information security management works on five pillars. The five pillars are assessment, detection, reaction, documentation, and prevention. Effective implementation of these pillars determines the success of the information security management in your company. What are the challenges in information security management? Challenges in information security management in your company can be the following: You can’t identify your most critical data Policies aren’t in place for protecting sensitive information. Employees aren’t trained in company policies. Technology isn’t implemented for your policies. You can’t limit vendor access to sensitive information.

Read More

What is Ransomware and What You Need to Know to Stay Safe?

Article | March 5, 2020

While there may be more than 1 billion pieces of malware prowling the internet for a chance to infect victims, one particular piece of nastiness has been inflicting financial losses and security headaches for years.Known as ransomware, its sole purpose is to block access to computer systems or files until the victim pays a ransom. These ransom demands fluctuate wildly, from the equivalent of a couple of hundred dollars to several hundred thousand. In the simplest terms, ransomware is a piece of malicious software that prevents users from using their devices or accessing their personal or important files, unless a sum of money is paid. Payment is usually demanded in cryptocurrency, such as Monero or Bitcoin. Victims are told to purchase these digital assets and then transfer them to the attackers.

Read More

The Coronavirus is Already Taking Effect on Cyber Security– This is How CISOs Should Prepare

Article | March 18, 2020

Cynet has revealed new data, showing that the Coronavirus now has a significant impact on information security and that the crisis is actively exploited by threat actors. The Coronavirus is hitting hard on the world’s economy, creating a high volume of uncertainty within organizations. Cynet has revealed new data, showing that the Coronavirus now has a significant impact on information security and that the crisis is actively exploited by threat actors. In light of these insights, Cynet has shared a few ways to best prepare for the Coronavirus derived threat landscape and provides a solution (learn more here) to protect employees that are working from home with their personal computers, because of the coronavirus. Cynet identifies two main trends – attacks that aim to steal remote user credentials, and weaponized email attacks:

Read More

Guide to Cloud Security Certification: Which Ones Are the Best of the Best?

Article | April 27, 2021

As your organization looks to move to cloud computing, security certification will become more critical. Cloud solutions have unique security considerations that are different from an on-premise solution. IT professionals that are managing these solutions should be well-versed in multi-layered protection, encryption, monitoring, and more. Not only is certification important for your own IT staff, but it should also be part of your recruiting strategy. Experience combined with certifications can be invaluable foclr protecting your cloud environment. You want to ensure that the data you store in the cloud is protected from security threats.

Read More

Spotlight

Cyber Security Services

Cyber Security Services is a cyber security consulting firm and security operations center (SOC) headquartered out of Columbus, Ohio. We help customers meet cyber security challenges through consulting engagements, Virtual CISO Services, security monitoring, and cyber security product expertise. We want to be an extension of your security team.

Events