Social Engineering
debt(d9/e7/b7/t7)
Closest to 'silent in production until users hit it' (d9). The detection_hints explicitly state 'automated: no' — there is no tool that catches social engineering in progress. The code_pattern notes are indirect signals (no training, no MFA, no verification processes) that are only visible through audits, not automated scanning. Attacks succeed silently until a breach is discovered.
Closest to 'cross-cutting refactor across the codebase' (e7), applied to organisational scope. The quick_fix requires training all developers, enforcing hardware 2FA for admin accounts, and redesigning verification processes — these are people, policy, and infrastructure changes that span the entire organisation rather than a single codebase component. It cannot be a one-line patch; it requires sustained, organisation-wide remediation.
Closest to 'strong gravitational pull' (b7). The term applies_to 'any' context, meaning every team, every role, every process is in scope. Maintaining defences requires ongoing training, process enforcement, and vigilance across all employees and support workflows — every future hire, every process change, every new channel is shaped by the need to account for social engineering risk.
Closest to 'serious trap' (t7). The misconception field directly states the canonical wrong belief: developers and organisations assume 'technical security controls prevent social engineering.' This contradicts the mental model most developers hold — that hardening systems is sufficient — when in reality the attack surface is human, not technical. This is a documented, persistent, and serious cognitive trap that causes real breaches.
Also Known As
TL;DR
Explanation
Social engineering bypasses technical controls by exploiting human psychology — authority, urgency, fear, and trust. Common forms include phishing emails, vishing (phone-based impersonation), pretexting (fabricated scenarios), and baiting. Technical defences such as 2FA, privileged access management, and email authentication (SPF, DKIM, DMARC) reduce exposure, but security awareness training remains the most effective countermeasure because the human is always part of the attack surface.
Common Misconception
Why It Matters
Common Mistakes
- No security awareness training — employees are the primary attack surface for social engineering.
- Overly helpful support staff who bypass verification procedures for 'urgent' requests.
- No verification process for password resets or access grants via phone or email.
- Sensitive information in email signatures or LinkedIn profiles that feeds pretexting attacks.
Code Examples
// Social engineering attack script (awareness example):
// Attacker: 'Hi, I'm from IT. We're pushing an urgent security update.
// I need your password to apply it remotely.'
// Victim: [provides password]
//
// Defence: IT never asks for passwords.
// Verify caller identity through a separate channel before complying.# Technical controls that raise the cost of social engineering:
# 1. MFA — stolen password alone is not enough
# 2. Out-of-band verification for sensitive actions
# Policy: 'We will never ask for your password by phone or email'
# 3. Suspicious login alerts
$this->mailer->send(new SuspiciousLoginAlert($user, $ip, $country));
# 4. Privileged action confirmation with second factor
# 'You are about to transfer £5,000. Confirm via authenticator app.'
# 5. Access request process — use ticketing system, not Slack DMs
# Verify requester identity before resetting credentials
# 6. Security awareness training — phishing simulations, pretexting drills