Social engineering in the service of civil society

[Teacher]

Salute, carders, in the scientific literature, social engineering is understood as a set of approaches of applied social sciences, focused on the purposeful change of organizational structures and institutions.

The experience of carrying out socio-economic reforms in our country and abroad demonstrates the unwillingness (or inability) of individual reformers to be guided in their activities by the principles of scientific management of social processes. At the same time, the lack of competence of the initiators of reforms in the field of social engineering affects. It is still generally accepted that socio-engineering activities are intended to serve specific organizations, to optimize the social parameters of their activities (to increase labor productivity, improve the socio-psychological climate, etc.).

The ideas of P. Sorokin, K. Popper and A. Gouldner on the use of socio-engineering methods for the design of institutions and systems at the societal level were not reflected in the real policy of the official authorities. Meanwhile, the entire course of reforms and the associated social consequences confirms the vital need for the development of macrosocial engineering.

Socio-engineering justification is needed not only for the management of organizations and enterprises, but also for the socio-economic policy of the state and regional management structures.

Effective management of institutional change in civil society requires knowledge of the basic principles of socio-engineering activities.

This is, firstly, the principle of the unity of social, cultural and personal changes that are not identical to each other.

When building institutions of civil society, for example, systems of private business or education, it is necessary to take into account the whole range of changes. They should also be subordinated to the logic of socio-engineering activity, its stages (stages) and functions.

Social engineering, by virtue of its specificity, focuses on typical, repetitive and routine procedures and operations, which, to a greater extent than other processes, lend themselves to technologization.

An analysis of anomie processes and contradictions associated with the course of reforms in our country shows that the main emphasis in the actions of the subjects of government is placed on social changes and innovations. Cultural changes (for example, improving legislation) do not keep pace with developments in the social sphere - the creation of new organizational forms, management systems, etc. Personal changes lag behind social innovations even more, which entails an increase in tension and conflict in society. It follows from this that the principle of the unity of social, cultural and personal changes must be supplemented with another principle.

2. The second principle that establishes the priority development of certain subsystems of civil institutions, as well as the institutions of civil society themselves, is the principled development of culture (cultural subsystem) in relation to social organization. It says: new social systems and institutions can be created only if cultural prerequisites mature and through the selection of the most viable cultural models. At the same time, direct copying and transfer of samples of a different culture to the national soil without their preliminary adaptation and assimilation within the framework of existing institutions is excluded. New social forms are the result not only of purposeful human activity, but also of long-term cultural evolution.

The way to the market and other achievements of world civilization lies, as you know, through the “cultivation” of civil, including entrepreneurial culture. Therefore, the creation of a market economy and liberal democracy in our country must be preceded by certain cultural changes arising from the objective needs of the social system as a whole.

3. The next principle of social engineering that establishes an adequate relationship between various types of institutional changes is the proportional and balanced development of the personal and social spheres of civil society and its institutions.

It assumes, as one of the conditions for successful socioengineering activity, taking into account the mentality or, in the words of E. Fromm, the social character of people involved in transformation processes and, as you know, changing much more slowly than the social institutions themselves and their material environment. Ignoring this principle in the practice of social transformations is, as a rule, one of the main reasons for "inhibition" and "resistance" to changes and innovations.

So, the scheme of the sequence of institutional changes: “social changes - cultural changes - personal changes”, which has developed spontaneously in the course of reforms, should, from our point of view, give way to another scheme: “culture - personality - social organization”.

Purposeful changes in the institutional sphere of civil society should be gradual, local and subsidized. This provision follows from the following principles of social engineering.

4. The principle of gradualness (phasing) and the local nature of changes, first formulated by K. Popper, opposes the utopian approach in social engineering. He denies the possibility of large-scale and radical changes in social systems at both the macro and micro levels. Such actions can lead, if implemented, to destructive consequences, which will be extremely difficult to overcome.

5. According to the principle of subsidiarity, the solution of management problems, including the problems associated with the construction of new institutions and organizations, is taken at the lowest possible level. This is the key to the success of market and democratic reforms.

These are the basic principles and requirements of the socio-engineering approach to the study of the processes of the formation of civil society institutions.

From the point of view of the principles of social engineering, the content of the existing model of the institutional systems of civil society (economic, political, legal, etc.) is changing. helping the population, preserving the best traditions of Russian culture.

 

[Jollier]

Social Engineering: 8 Most Common Techniques​

In recent years, cybercriminals using social engineering techniques have adopted more advanced methods that make it more likely to gain access to the information they need using the modern psychology of enterprise employees and people in general. The first step in countering this kind of trick is to understand the attackers' tactics themselves. Let's look at eight basic approaches to social engineering.

Introduction​

In the 90s, the concept of "social engineering" was coined by Kevin Mitnick, an iconic figure in the field of information security, a former serious hacker. However, attackers used such methods long before the term itself appeared. Experts are convinced that the tactics of modern cybercriminals are tied to the pursuit of two goals: stealing passwords, installing malware. Attackers try to apply social engineering using phone, email, and the Web. Let's get acquainted with the main methods that help criminals get the confidential information they need.

Tactic 1. The ten handshake theory​

The main goal of a social engineering attacker is to convince their victim of one of two things:

1. The victim is called by a company employee;
2. A representative of the authorized body (for example, a law enforcement officer or an auditor) calls.

If a criminal sets himself the task of collecting data about a certain employee, he can first contact his colleagues, trying in every possible way to extract the data he needs.
Remember the old six-handshake theory? So, security experts say that there can be only ten “handshakes” between a cybercriminal and his victim. Experts believe that in modern conditions you always need to have a little paranoia, since it is not known what this or that employee wants from you.
Attackers usually contact a secretary (or a similar person) to collect information about people higher in the hierarchy. Experts note that a friendly tone helps scammers in many ways. Slowly but surely, criminals are picking up a key for you, which soon leads to the fact that you share information that you would never have discovered before.

Tactic 2. Learning the corporate language​

As you know, each industry has its own specific wording. The task of an attacker trying to obtain the necessary information is to study the peculiarities of such a language in order to more skillfully use the techniques of social engineering. All the specificity lies in the study of the corporate language, its terms and features. If a cybercriminal speaks in a familiar, familiar and understandable language for his purposes, he will more easily gain confidence and be able to quickly get the information he needs.

Tactic 3: Borrow music to wait on calls​

To carry out a successful attack, fraudsters need three components: time, persistence, and patience. Cyberattacks using social engineering are often carried out slowly and methodically - collecting not only data about the right people, but also the so-called "social signals". This is done in order to gain trust and circle the target. For example, attackers can convince the person with whom they are communicating that they are colleagues.
One of the features of this approach is the recording of the music that the company uses during calls, while the caller is waiting for an answer. The offender first waits for such music, then records it, and then uses it to his advantage.
Thus, when there is a direct dialogue with the victim, the attackers at some point say: "Wait a minute, the call is on another line." The victim then hears familiar music and has no doubts that the caller represents a certain company. In essence, this is just a clever psychological trick.

Tactic 4. Spoofing (spoofing) a phone number​

Criminals often use phone number spoofing to spoof the caller's number. For example, an attacker can sit in his apartment and call a person of interest, but the caller ID will display the number belonging to the company, which will create the illusion that the fraudster is calling using a corporate number.
Of course, unsuspecting employees in most cases will pass confidential information, including passwords, to the caller if the caller ID belongs to their company. This approach also helps criminals avoid being tracked, because if you call back to this number, you will be redirected to the company's internal line.

Tactic 5. Using the news against you​

Whatever the headlines of the current news, attackers use this information as bait for spam, phishing, and other fraudulent activities. It is not for nothing that experts have recently noted an increase in the number of spam emails, the topics of which relate to presidential campaigns and economic crises.
Examples include a phishing attack against a bank. The email says something like this:
“Another bank [bank name] is acquiring your bank [bank name]. Click on this link to make sure your bank information is up to date before the deal is closed. "
Naturally, this is an attempt to obtain information with which scammers can enter your account, steal your money, or sell your information to a third party.

Tactic 6. Leveraging Trust in Social Platforms​

It's no secret that Facebook, Myspace and LinkedIn are hugely popular social media sites. According to expert research, people tend to trust such platforms. The recent spear phishing incident targeting LinkedIn users supports this theory.
Thus, many users will trust an email if it claims to be from Facebook. A common trick is to claim that the social network is doing maintenance, you have to "click here" to update the information.
That is why experts recommend that corporate employees enter web addresses manually to avoid phishing links. It is also worth keeping in mind that on very rare occasions sites send users a request to change their password or update their account.

Tactic 7. Tipsquatting​

This malicious technique is notable for the fact that cybercriminals exploit the human factor, namely errors when entering a URL into the address bar. Thus, having made a mistake by just one letter, a user can get to a site created specifically for this purpose by cybercriminals.
Cybercriminals carefully prepare the ground for typesquatting, therefore, their site will be like two peas in a pod similar to the legitimate one that you originally wanted to visit. Thus, if you make a mistake in the spelling of the web address, you are taken to a copy of a legitimate site, the purpose of which is either to sell something, or to steal data, or to spread malware.

Tactic 8. Using FUD to Influence Stock Markets​

FUD is a psychological manipulation tactic used in marketing and propaganda in general, which consists in presenting information about something (in particular, a product or an organization) in such a way as to sow uncertainty and doubt in its qualities in the audience and thus cause fear of it.
According to the latest research by Avert, the security and vulnerability of products and even entire companies can affect the stock market. For example, researched studied the impact of events such as Microsoft's Patch Tuesday on the company's stock, finding a noticeable fluctuation each month after the vulnerability was released.
You can also recall how attackers in 2008 spread false information about the health of Steve Jobs, which led to a sharp drop in Apple shares. This is the most common malicious use of FUD.
In addition, it is worth noting the use of e-mail for the implementation of the pump-and-dump technique (a scheme for manipulating the exchange rate in the stock market or in the cryptocurrency market, followed by a collapse). In this case, attackers can send out emails describing the tremendous potential of the stocks that they bought in advance.
Thus, many will try to buy these shares as soon as possible, and they will increase in value.

Conclusions​

Cybercriminals are often extremely resourceful in their use of social engineering. After reviewing their, we can conclude that various psychological tricks are very helpful for attackers to achieve their goals. Based on this, it is worth paying attention to any little thing that can unwittingly give out a fraudster, check and double-check the information about the people who contact you, especially if confidential information is being discussed.