Social-Engineering
psychologically manipulating victims into performing the desired actions for malicious purposes
ENTITY
1 - Human
INTENT
1 - Intentional
TIMING
2 - Post-deployment
Risk ID
mit495
Domain lineage
4. Malicious Actors & Misuse
4.3 > Fraud, scams, and targeted manipulation
Mitigation strategy
1. Prioritized Mitigation: Continuous Human-Centric Resilience Enhancement - Action: Implement a mandatory and dynamic security awareness program incorporating frequent, realistic simulation exercises (e.g., AI-enhanced phishing/deepfake scenarios) to continuously test and reinforce employees' critical vigilance and skepticism toward manipulative communication tactics. - Cultural Protocol: Establish a non-punitive, open reporting culture wherein employees are explicitly empowered to challenge any anomalous or urgent request—including those from executive leadership—and report suspicious activity without fear of professional repercussion.2. Prioritized Mitigation: Robust Identity and Access Control Fortification - Action: Enforce the organization-wide deployment of Multi-Factor Authentication (MFA), favoring phishing-resistant standards (e.g., FIDO2/passkeys), across all enterprise applications and privileged accounts to ensure that compromised credentials obtained via social engineering do not grant unauthorized systemic access.3. Prioritized Mitigation: Transactional Integrity and Policy Enforcement - Action: Define and strictly enforce stringent, multi-channel verification protocols for all high-value or operationally sensitive actions (e.g., financial transfers, data access changes). This protocol must necessitate out-of-band confirmation via a trusted, secondary communication medium to validate the authenticity of the requestor and prevent the execution of fraud facilitated by impersonation.
ADDITIONAL EVIDENCE
Unlike propagandistic misuse which usually targets celebrities (or even non-people, e.g. events and ideas) and the motive can be arbitrary, social-engineering attacks usually target a specific individual (who does not need to be a celebrity) often with a financial or security-compromising motive and usually involves impersonation, i.e. pretending to be someone that the victim is familiar with