Top 10 Secret Tips Of Social Engineering In 2020

Top 10 Secret Tips Of Social Engineering in 2020

Have you ever thought,How hackers steal confidential data like online account credentials or banking details without hacking into your system.This is a very popular way hackers use to steal sensitive information.Hackers are now evolving this technique to trick people.

Almost 62% of companies facing Social Engineering attack.Many companies now working from home.Hackers now trick employees and steal sensitive data using social engineering.In recent times social engineering attack increased so much and hackers now adopting new techniques to trick people.

So What Is Social Engineering?

Social engineering is a technique to manipulate people, to get confidential information. The types of information collected by social engineering can vary, but when individuals are targeted by the criminals are usually trying to trick you into giving them your passwords or bank information, or access your computer to secretly install malicious software–that will give them access to your passwords and bank information as well as giving them control over your computer.This is a non-technical technique used by hackers to collect sensitive data from a person. Hackers use different social engineer techniques and they keep evolving these techniques. They can get to your data without touching your keyboard or physical access to your system.

To protect the personal or company system a Cyber Security Professional must think like hackers. They should understand how hackers use Social Engineering attacks to get sensitive data from a person.

Here are the 10 Social Engineering Tips Hackers Used

1.Email From A Friend :

People hardly check the genuineness of a mail that comes from a friend or looks like it comes from a friend. Hackers take advantage of this and send malicious links in a mail or ask sensitive information from a user. If a criminal manages to hack or socially engineer one person’s email password they can easily get access to that person’s contact list. Most people use one password for almost everywhere, this makes it easy for hackers to have access to that person’s social networking contacts as well.When hackers get the control of the email they send emails to all the person’s contact list. These emails contain malicious links or links to phishing websites to collect more sensitive data from the person contacts. The mail can also contain a download of pictures, music, movie, or document that has malicious software embedded. If you download which you are likely to do since you think it is from your friend, you become infected by malware. The cyber criminal can easily access your machine, email account, social network accounts, and contacts, and the attack spreads to everyone you know. And on, and on.

{{ brizy_dc_image_alt uid='wp-90b0b40b44d75b698af26b3d94b1de67' }}
{{ brizy_dc_image_alt uid='wp-adb5455b5436c78c2db538aab6923e9b' }}

2.Email From A Trusted Source –

Hackers send phishing links using social engineering strategies that imitate a trusted source. Hackers use a compelling story or pretext to get sensitive data from a user. A phisher sends an e-mail, IM, comment, or text message that appears to come from a legitimate, popular, bank, school, or institution. They present a problem that requires you to “verify” your information by clicking on the displayed link and providing information in their form. The link location may look very legitimate with all the right logos, and content. This type of mail looks like it comes from banks or other financial institutions.Hackers sometimes pose like a boss or coworker. It may ask for an update on an important, proprietary project your company is currently working on, for payment information pertaining to a company credit card, or some other inquiry masquerading as a day-to-day business. Hackers basically send this type of mail to employees of a targeted company to steal sensitive information. These mails look legitimate and hackers can easily get the information they need.

3.Mail From A Trusted Person –

In this type of social engineering attack, hackers send mail to the user. The mail looks like it comes from a trusted source and they copy the official mail id. This type of mail contains phishing links that send the user to a phishing website. Hackers copy the original website and trick users to share sensitive information.

{{ brizy_dc_image_alt uid='wp-072e32395a159f19de6aaca83d8a6ba2' }}
{{ brizy_dc_image_alt uid='wp-f4272cf56ebef564d0348fe8de214389' }}

4.Baiting scenarios :

Hackers know what type of things people want and they target people. They offer to download the latest movie links or music. This type of link also found in social networking sites, malicious websites people find through search results, and so on.This scheme may show up as an amazingly great deal on classified sites, auction sites, etc. To allay your suspicion, you can see the seller has a good rating which is already a planned and crafted profile. People who take this bait get infected by malicious software and hackers still sensitive information.

5.Offering services from trusted

companies :

Hackers offers service like fixing your computers or helping you in banking service.They pick big companies like computer service or banks.They call people and offer free service.They will ask to update software by a link they send to you or install a software so they can fix your computer problem.When user install this software they gives the remote access to the hackers.The hackers also tell user to enter commands or authenticate them.They fthis trick to steal sensitive information and create a backdoor,so they access anytime they want.

{{ brizy_dc_image_alt uid='wp-63518e4689dc4ca46b8c096885a21cfe' }}
{{ brizy_dc_image_alt uid='wp-3d4f964938dd1e55c50595d3b615ec4f' }}

6.Promotional Offers :

Hackers sometimes send promotional mails to users which offer great results on a product.They craft the mail like that people will click on the link.This type of link is also found in search results.People easily click this type of link when they get offers.Hackers uses this Social Engineering method to trick people.

7.Texting Users:

Hackers sometimes trick users by simply sending text messages to users.Here’s how the manipulative scheme works. Hackers send the target a text message instructing them to log in to their online account. Point out that it’s required to accept the new terms of service or confirm that their personal details are up to date.This mail emphasizes that it is an urgent matter and they need to do the task by sending the mail.When the user clicks on the link and types the credentials,hackers can easily get all the information.They can easily hack online accounts.

{{ brizy_dc_image_alt uid='wp-e68ca39f5c3a90d61ef7c88089871e49' }}
{{ brizy_dc_image_alt uid='wp-50727eee81aec19c21ae8cc6f879ffce' }}

8.Using Fake Email :

Hackers first get all the information like the official email id of the company and their employees mail id.Then they send mails to other employees with a copy mail id.In this technique hackers send mail  to employees to get sensitive information from employees,who worked on a targeted company.

9.Lottery Winning Mail :

 In this social engineering attack,hackers send mail to people about lottery winning.This mail trick users to get sensitive information.In order to give you your ’winnings’ you have to provide information about your bank account,so they know how to send it to you or give your address and phone number so they can send the prize, and you may also be asked to prove who you are often including your identification details. These are the ’greed phishes’ where even if the story pretext is thin, people want what is offered and fall for it by giving away their information, then having their bank account emptied, and identity stolen.

10.Creating Phishing Link Of A Keyword :

Hackers create phishing websites for particular keywords.It is really hard to rank for a keyword.But they are so many keywords that are actually easy to rank and have a decent amount of traffic.Hackers take advantage of this and create phishing website to steal sensitive information from users.


How to write a GDPR data privacy notice in 2020

How to write a GDPR data privacy notice in 2020

The  GDPR (General Data Protection Regulation gives individuals more control over how their personal data is used.

If your organisation processes personal data, the Regulation requires you to provide data subjects with certain information. This typically takes the form of a data privacy statement or privacy notice.

But what is a data privacy notice, and what should it contain? This post explains everything you need to know.

GDPR Managed Service Providers in India

What is a privacy notice?


A GDPR privacy notice is an important way to help your customers make informed decisions about the data you collect and use. We’ve brought together some information from the law itself and from the EU’s guidance documents to help you understand the components of a good privacy notice. And at the bottom, we’ve included a privacy notice template that you can adapt to your own organization.

A privacy notice is a document that organisations give to individuals to explain how their personal data is processed.There are two reasons for doing this. First, it ensures that you’re as transparent as possible with data subjects. This prevents any confusion about the way personal data is being used and ensures a level of trust between the organisation and the individual.

Second, it gives individuals more control over the way their data is collected and used. If there’s something the data subject isn’t happy with, they can query it via a DSAR and potentially ask the organisation to suspend that processing activity.

Let us watch the different steps of writing a GDPR Data Privacy Notice through this video:

How to write a privacy notice?


1) Contact details

The first thing to include in your privacy notice is the name, address, email address and telephone number of your organisation.

If you’ve appointed a  DPO(data protection office) or  EU representative, you should also include their contact details.


2) The types of personal data you process

The definition of personal data is a lot broader than you might think.

Ensure you include everything that you’re collecting and do so as specifically as possible.

For example, instead of just saying ‘financial information’, state whether it’s account numbers, credit card numbers, etc.

You should also outline where you obtained the information if it wasn’t provided by the data subject directly.

3) Lawful basis for processing personal data

Under the GDPR, organisations can only process personal data if there is awful basic for doing so . Your privacy policy should specify which one you’re relying on for each processing purpose.

Additionally, if you are relying on legitimate interests, you must describe them. If you’re relying on consent, you should state that it can be withdrawn at any time.

4) How you process personal data?

You must explain whether you will be sharing the personal data you collect with any third parties.

We suggest also specifying how you will protect shared data, particularly when the third party is based outside the EU.

5) How long you’ll be keeping their data?

The GDPR states that you can only retain personal data for as long as the legal basis for processing is applicable. In most cases, that will be easy to determine. For example, data processed to fulfill contracts should be stored for as long as the organisation performs the task to which the contract applies.

Likewise, organisations that process data on the grounds of a legal obligation public task or vital interest should hold on to the data while those processing activities are relevant.

Things are trickier with consent and legitimate interests, as there is no clear point at which they’re no longer valid.

As such, we recommend reviewing any processing that involves these lawful bases at least every two years.

6) Data subject rights


The GDPR gives individuals eight data subject right which you should list and explain in your privacy notice:

  • Right of access: individuals have the right to request a copy of the information that an organisation holds on them.


  • Right to object: individuals have the right to challenge certain types of processing, such as direct marketing.


  • Right of portability: individuals can request that organisation transfer any data that it holds on them to another company.


  • Right of rectification: individuals have the right to correct data that is inaccurate or incomplete.


  • Right to be forgotten: in certain circumstances, individuals can ask organisations to erase any personal data that’s stored on them.


  • Right to restrict processing: individuals can request that an organisation limits the way it uses personal data.


  • Right to be informed: organisations must tell individuals what data of theirs is being collected, how it’s being used, how long it will be kept, and whether it will be shared with any third parties.


  • Rights related to automated decision making including profiling: individuals can ask organisations to provide a copy of its automated processing activities if they believe the data is being processed unlawfully. You should also remind individuals that they are free to exercise their rights and explain how they can do this.


Is privacy notice the same as a privacy policy?

A privacy notice is a publicly accessible document produced for data subjects. By contrast, a privacy policy is an internal document that explains the organisation’s obligations and practices for meeting the GDPR’s requirements.

Although they cover many of the same topics, privacy notices aren’t to be confused with privacy policies.



Why you need a privacy notice?

Privacy policies can also help you win business, as they prove that you take information security seriously.

Privacy notices are a legal requirement under the GDPR and ensure that individuals are aware of the way their personal data is processed. However, they can also benefit organisations in several ways.

For one, privacy policies provide documented proof of your data processing activities. This helps you justify your processing if someone lodges a complaint with their supervisory authority.

Privacy policies can also help you win business, as they prove that you take information security seriously.

Writing your privacy notice

In general, privacy policies should be written in the active voice and avoid unnecessary legalese and technical terminology.

This is particularly important when you are processing children’s personal data, as there are many concepts that you’ll have to explain in more detail.

Your privacy policy must be written in clear and simple language that data subjects can easily understand.

Likewise, you should avoid qualifiers such as ‘may’, ‘might’, ‘some’ and ‘often’, as they are purposefully vague. Saying you ‘may’ do something doesn’t help the data subject work out under what circumstances it will happen.

Finally, the policy should be free of charge and easily accessible; don’t hide it in a link at the bottom of a form where few people are likely to see it.

You should instead provide the policy to them in writing or link to it when asking for their personal data.

When should you provide a GDPR privacy notice?

The GDPR explains that data controllers must provide a privacy notice whenever they obtain data subjects’ personal information. The easiest way to provide a privacy notice is to post it on your website and link to it whenever appropriate.

If you don’t have a website, you should make a physical copy of your privacy policy available.

The only times this isn’t necessary are when:

  • The data subject already has the information provided in the privacy notice;
  • It would be impossible or involve a disproportionate effort to provide such information;
  • The organisation is legally obliged to obtain the information; or
  • The personal data must remain confidential, subject to an obligation of professional secrecy.

When an organisation obtains personal information from a third party, it must provide a privacy notice within a month. This should be done the first time the organisation communicates with the data subject or when the personal data is first shared with another recipient.