Prevención de ataques de Ingeniería social

And [Music] Hello, thank you very much for another year, and this is the third year, also the third edition of La Tomatina, in which Sophos participates. Last year I gave a talk about spam, where it comes from, etc., and we're going to look at social engineering. The idea of ​​the talk is how you can

prevent it, by knowing how a social engineer operates, that is, what techniques they use, so that when they try to manipulate you, you can realize, "Hey, this sounds familiar," or "This sounds familiar," so it seems like I 'm under the influence or they're trying to launch a social engineering attack on me. As I

mentioned, I 'm Alberto Ruiz, I work for Sophos, I'm a pre-sales engineer, and I've been working here for about thirteen years, always dealing with security issues, from support and implementation roles to development, etc. And now I'm here, so we're going to give you this introduction to social engineering, to understand what these techniques—what the

bad guys call them—will use on us, to identify them. Ultimately, what is social engineering? It's about manipulating us, manipulating people, to achieve some kind of goal. It can't, for example, be a scam, the old "stamp scam" we could say today is social engineering. The vast majority of email scams also try to use these

social engineering techniques. So, many times, as we've said, these scams that come by email, etc. In fact, last year I mentioned it in the talk about spam, etc., when I talked about Spanish letters and all the techniques that have been used for over 200 years until now. Many times, face-to-face interaction doesn't happen;

many times we receive an email, and if it's well done enough, they'll get us to click. They've succeeded; they've managed to interact with us so that in the end we take an action: click on that email, fill out a form, do something we shouldn't have done, etc. For example, a few months ago the "fish" attack was famous.