Companies should invest in training to help employees ward off social engineering attacks, which use social media, personal profiles, and websites.