Which countermeasure is commonly used to deter social engineering?

Which countermeasure is commonly used to deter social engineering?

• A. Policies need to be taught and enforced
• B. Two-factor authentication
• C. Info should be categorized and classified for access privileges
• D. Change management

Answer: (B)

Social engineering hinges on tricking people into giving up credentials or access details. Two-factor authentication is a commonly used defense because it adds a second verification requirement beyond just a password. Even if an attacker successfully pressures someone into revealing their password, they still need the second factor to gain access. This dramatically reduces the chance of a successful breach from social engineering. In practice, the second factor might be a hardware token, a one-time code from an authenticator app, or biometric verification. Note that some methods, like SMS codes, have their own weaknesses, so stronger methods (hardware tokens or authenticator apps) are preferable. Policies, training, and data classification are important for overall security culture and access governance, but they rely on people behaving correctly. Two-factor authentication provides a technical barrier that directly mitigates credential-based social engineering, making it the most effective commonly deployed countermeasure.

Social engineering hinges on tricking people into giving up credentials or access details. Two-factor authentication is a commonly used defense because it adds a second verification requirement beyond just a password. Even if an attacker successfully pressures someone into revealing their password, they still need the second factor to gain access. This dramatically reduces the chance of a successful breach from social engineering.

In practice, the second factor might be a hardware token, a one-time code from an authenticator app, or biometric verification. Note that some methods, like SMS codes, have their own weaknesses, so stronger methods (hardware tokens or authenticator apps) are preferable.

Policies, training, and data classification are important for overall security culture and access governance, but they rely on people behaving correctly. Two-factor authentication provides a technical barrier that directly mitigates credential-based social engineering, making it the most effective commonly deployed countermeasure.