The Human Side of Cybersecurity

As Cybersecurity Awareness Month continues at Seton Hall, Week 3 focuses on social engineering and the tactics cybercriminals use to convince people to reveal information, provide access or take an action that compromises their security. 

Phishing is a common form of social engineering in which scammers impersonate trusted individuals or organizations to deceive recipients into sharing sensitive information or taking actions that compromise their security. Although phishing is most often associated with email, these attempts can also occur through text messages, phone calls and other communication channels. Scammers may pose as Microsoft, a financial institution or someone within the University to persuade recipients to click a malicious link, open an attachment or disclose account credentials.

Cybercriminals Target Trust 

What makes social engineering effective is that attackers often rely on manipulating trust rather than bypassing technical security measures. Some messages create urgency with warnings such as "Your account will be disabled today." Others appeal to curiosity, fear or excitement with messages such as "Your package could not be delivered" or "You have been selected for a reward." The goal is to prompt an immediate response before the recipient has time to consider whether the request is legitimate.

An unexpected message does not automatically mean it is fraudulent, but it should be examined before any action is taken. Before selecting a link, opening an attachment or responding to a request, consider: 

• Was the message expected? An unexpected notification, document, request or invitation deserves a closer look, even when it appears to come from a familiar source. 

• Is there pressure to act quickly? Social engineering often relies on urgency, fear or another emotional response to discourage careful consideration. 

• Is sensitive information being requested? Be especially cautious of requests for passwords, authentication codes, financial details or other personal information. 

• Does something seem unusual? Review the sender's complete address, the wording of the message and the true destination of links. A familiar display name alone does not establish that a message is legitimate. 

• Can the request be verified independently? When a message appears to come from someone familiar, confirm the request using a phone number, email address or other method already known to be legitimate rather than contact information provided in the message.

Report Suspicious Messages 

Slowing down is one of the most effective ways to interrupt a social engineering attempt. A message may insist that immediate action is necessary, but taking a few moments to examine the request can reveal warning signs that are easy to overlook when responding quickly. If those warning signs raise concerns, avoid interacting with the message and report it using the Report Phish button in Outlook.  

Reporting is also important when someone has already interacted with a suspicious message. Anyone who has selected a questionable link, opened an attachment, provided information or otherwise responded to a potential phishing attempt should report the incident promptly so IT Security can investigate and take appropriate action. 

Stop. Think. Verify 

Cybersecurity Awareness Month is a reminder that protecting accounts and information depends on both technology and the decisions people make when something does not look right. Building the habit of stopping to examine an unexpected request, thinking about whether it makes sense and verifying it through a trusted source can help prevent that moment from becoming a widespread security incident. 

Categories: Science and Technology