Social Engineering

Observe continuously and resolve conflicts

Keep observing to see how and why your team members respond to change. When you need to handle conflicts in the team, use what you’ve learned about your people to get them to buy into the changes.

What’s in it for them?

Think less about why you want a change and more about what's in it for your team members. Why should they do what you want?

A lot of it comes down to empathy, as you need to be able to see things from another person's perspective.

Let go of your expectations

To observe well, you need to take a step back and really see how your team members interact. Understand what motivates them to do their job well, and how this might change.

A possible issue may be that some people observe something once and assume it will always be like that, regardless of context.

For example, I see John volunteered in a meeting today, so I conclude that he'll always volunteer. Maybe he will, but I should observe him in other settings too. Maybe John volunteers when he's working with immediate team members, but in a larger team, he’s less open to volunteering.

Just imagine, if you’re an attacker and want to get valuable information, you’ll take your time, even if you know a lot about your “target.” This is the key to success in social engineering.

It’s the same for managers who want the best for their teams. This is the most difficult part of the process, because you may feel like you already know everything about your team. There is value in having experience with them, but take your time, take a step back, and let go of your expectations.

Do you have examples for social engineering in a positive context?

Here is one from a previous job.

I used to work in higher education as a learning technologist with online courses for universities. I was on a team with 12 different program directors from areas like accounting and healthcare. I needed all program directors to give me information to get their courses up and running.

I had communication issues

Some directors gave me what I needed right away, but I had to track others down and work hard to get them to give me what I needed. As you might imagine, this resulted in delays, and I had no idea why they made it hard for me.

Then I looked at it from the social engineering perspective. I started thinking about why these different directors would want to give me what I needed.

I tried speaking their language

The director of the accounting program was always difficult. I knew from my experience with her that her mindset was very analytical. Next time, when I needed to follow up with her to get the information I needed, I included a few data points.

I told her we were working with a hundred different course sections, and so on. I was appealing to the way she thought and what she needed. Once I gave her all that data, I was speaking her language, and she gave me what I needed.

If I had done the same with the special education program director, I would have missed the target. She was all about the caring side of education and learning. To appeal to her, I emphasized that getting me the information earlier gives me more time to provide hands-on assistance to the people who need it.

Understanding and appealing to their interests worked like a charm.

It’s the same approach as a cyber attacker.

Attackers think the same way

Let’s say I want to get somebody’s password, and I know they’re into bicycling. Then I can talk about cycling, send them links to cater for them in that regard, but I get their password in the process.

The only way you can cater to your people is by making observations, and realizing that they're different. It takes extra time and effort compared to using the same approach on everyone.

I could send out one email or make one announcement. Some people will do what I ask, but others may not buy into it. So, when you bring in new initiatives, keep in mind what motivates your people, and how you can get them to feel good about a decision.

Show them that your reasons relate to their motivations.

What are the common mistakes when using social engineering tactics in management?

Judging too quickly

Don't make an assumption based on a single observation. Always give your people the benefit of the doubt. You might catch someone on an off-day.

A person may not be as open to sharing feedback when working on their own project  with full focus. If you look at them that day, you may think "They never want to talk to anyone, that's the problem! I need to fix that.” Remember, it's a single day, so keep looking for patterns and trends.

Assuming you have nothing to learn

Another big mistake is assuming you already know everything about your team. Take a step back and look at it from another angle anyway.

How to use social engineering tactics when managing a new team?

When I was going to my teacher training mentor program, it was me, another teacher in training and our mentor. The three of us were teaching classes together.

I really appreciated that my mentor teacher sat all three of us down at the start of the year, and we talked about our preferred working styles and discussed questions like:

• “What do you enjoy most about our team and your role in it?”
• “What motivates you?”
• “How do you prefer to be communicated with?”
• “How do you prefer to handle conflicts?”

These group discussions help to normalize things. Everyone can share what they're comfortable with. 

So, it isn’t just the one person who doesn’t fit who needs to be asked what they need. The benefit of a sit-down conversation like this is that others take notes, and then you have a baseline before your observations.

Here are some examples

For example, “Mary told me that she's motivated by facing technical challenges. I've noticed that the project she's worked on recently has been easy for her, so she may lose interest. What can we do to fix that?”

The key is to do this before you have a conflict, because then the dynamic of the team will be tense. This is a way to build trust and to create psychological safety.

Another example is that if a big change is coming up, I prefer to have a heads up before the meeting, so I can think about it and process it. Others like to learn everything on the meeting, so they don’t add another stress factor to their busy schedule and spend extra time preparing.

The only way to learn these differences early is to ask.

You can't accommodate everyone with every preference, especially if you have a large team. It still helps to create trust and psychological safety for team members to know that their manager cares enough to ask.

Small things like this mean a lot.

What are the common conflicts caused by social engineering?

Problem: Some may think you’re spying on them

If a social engineering approach to team building is not handled well and with good intentions, you can end up making your team members feel like you're spying on them. It’s a fine line to walk, so you may want to include them and establish what you're doing and why.

Solution: Be transparent

Say something like, "Hey, everyone! I just want to let you know, I’ll be looking to see how we interact with each other so I find specific things that we can work on improving.”

When you make your reasons clear, your team will trust you more. If your team sees you scrutinizing their work and micromanaging without taking actions for improvement, you’ll lose trust quickly.

What timeframe do you recommend when trying the social engineering approach?

It depends on what you’re trying to change.

If you want to try social engineering tactics, don't pull issues out of thin air and say, "I want to fix this!" Instead, ask yourself what your gut tells you about what could be improved in your team.

Take a couple of weeks at least

Let’s say you feel like knowledge transmission could be better. Start with an idea in mind and tailor your observations based on that. Take a couple of weeks at minimum to observe and watch, especially if your people work remotely.

For example, someone may be talkative when it comes to being in a chatroom, but when it comes to voice calls, they're quiet. This isn’t right or wrong, but what are you noticing there? In cases like this, give yourself a couple of opportunities to see this happen under different circumstances.