Reverse SE: Technology or Human based?

Social Engineering and Reverse social engineering are mainly used in computer security however they can be applied outside this field as well.

Both social and reverse social engineering exploit the non-technical human weakness in security therefor the actual exploitation occurs outside the computer.

One example of social engineering is creating distrust, which in fact can be used in reverse social engineering as well. After creating distrust between two target parties (possibly by falsifying or altering information) he can then introduce himself as a "mediator" for fixing the conflict. The mediator is then able to acquire security information from both parties.

Another example is causing a maintenance problem in a building (power black-out) and then arriving dressed-up as the maintenance repair-man to fix the problem and in doing so, gain access to the building and maybe the sensitive systems inside.

The main reasons that make social engineering attacks successful are:

• Poor Security Awareness: An extremely large percentage of users do not understand the importance of a password for authentication and access to a computer system. They do not realize that their account can be accessed from anywhere in the world, given the proper access point. Users also do not understand the lengths that people will go to obtain the information that the users have access to on a daily basis. They also do not realize that throwing something in the garbage does not mean that the information is destroyed. What is garbage to a user might be extremely valuable to a hacker.
• Human Weaknesses: People give out information for many reasons. In most cases, they just want to be helpful, because that is their job and/or nature. People can also be intimidated to release information, either by being made to believe that a superior wants the information or by just trying to make an annoying person go away.
• Untested Plans and Procedures: Organizational procedures that require an authenticating mechanism must carry with them additional procedures that protect the mechanism. This is where a large number of security plans fail. Many organizations test a specific part of a security plan or procedure, but these plans and procedures must be tested as a whole.

Based on the above, most social and reverse social engineering scenarios are based on technology because the general public is not aware of the security significance of certain information. But social engineering was used long before computers were born (the words "con" and "scam" refer to a more general non-technological form of social engineering). However with the evolution of technology there has been new and intuitive ways to accomplish this procedure.