Threat of social engineering and phishing in modern information security

Information is the most important resource of any company in our time, so ensuring its protection is one of the priority business tasks of each organization. Over the years, technical security systems have been increasingly improved through technological developments, the recording of multiple channels of information leakage and the growing need for information security in general. Well-designed technical protection systems will always perform the tasks assigned to them, but one single factor can make them useless – a person. People will remain human, with their weaknesses, prejudices, stereotypes and mistakes, being the weakest link in the security chain. So attacks started to gain popularity, targeting not the system itself, but its users, the so-called social engineering attacks. In this article the issues of threats of social engineering and phishing in modern information security are considered. During the work the history and principle of social engineering were analyzed. As a result, an example of a real phishing attack (penteste) was presented, the analysis of statistical data was made. Conclusions about the phishing threat were presented.