• Technical measures o Virus Scans – If a virus or key logger was installed on the computer to retrieve user name and password, an updated antivirus should have caught the file and blocked it from installing on the computer. o Intrusion Prevention Systems- Intrusion Prevention systems would also help prevent certain type of files being installed on the computer. These would include .exe and any other files extensions that were set in the system. o No administrative access on computers for users. Any extra access needed will need a separate logon. o 2 factor authentication- User name and password are easy to bypass and hack. A token with a code that changes every x number of minutes along with a user name and password would make it more difficult for an attacker even if they were able to get the users password. o Strong password policy – Minimum 8 characters, 1 Number, 1 Capital, 1 Special character, no repeating characters. Change every 60 days, Cannot use same password more than 1 time every 6 months. A …show more content…
– In this case the email address of the victim. The email address was not supposed to be public information or published. o How social engineering works – What to lookout for, how to react, and when to end the call or discussion. – In this case an attacker was able to use their social skills to trick an employee into giving out private company information. Once a user is trained on what to look for it will make it more difficult for an attack to be successful. o Periodic testing of employees- Every so often email phishing, phone calls, and face to face tests will be conducted randomly so that users stay aware of the situation. This is known as SE Inoculation training. In short inoculation for social engineering should work like inoculations for viruses, little amounts at a time will help people become more resistant to social engineering. (Tipton,