Social engineering and security of the information system - The need for prevention

The management of an organization's essential data is becoming increasingly sensitive as the risk of (cyber) attack increases: the Information System (IS) as a whole must be protected against financial, legal, reputational and other damage. Interconnections with other organizations, the increasingly widespread use of the Internet of Things (IoT –Internet des Objets) and the heterogeneity of different IS, are widening the attack surface usable by cybercrime, encouraging its growth:

• 74% of cyber attacks have a human component and are based on social engineering methods;

• 50% are phishing business emails.

The use of technologies such as generative AI and Machine Learning (ML) is increasing the quality and quantity of cyberattacks.

Social engineering is the use of human manipulation and deception techniques through digital tools, and is used against organizations as well as individuals. Social engineering attacks reveal the human element as the "weak link" in an organization's cyber defense. Depending on the cybersecurity prevention methods employed, results in terms of resistance to social engineering vary widely.

In this context, it is important to review the various factors that make it possible to design and, ultimately, prevent cyber-attacks early and effectively, in particular through collaboration between technical and human know-how.