1.1 Social Engineering

Question 1

Define Phishing

Answer 1

Tricking someone into providing personal or valuable information

Question 2

Smishing

Answer 2

Phishing via text/SMS messages

Question 3

Vishing

Answer 3

Phishing via voice calls

Question 4

Define Spam (2 types)

Answer 4

1. Non-malicious unsolicited advertisements which consume hardware resources and flood users’ inboxes
2. Malicious containing link to launch other attacks, such as phishing or malware downloads

Question 5

Define Spam over Instant Messaging (SPIM)

Answer 5

Spam-like messages delivered via instant messaging

Question 6

Define Spear Phishing

Answer 6

A phishing attack targeting a specific person and crafted using reconnaissance and pretexting to make it more believable

Question 7

Define Dumpster Diving

Answer 7

Obtaining valuable information from documents disposed in the garbage

Question 8

Define Shoulder Surfing

Answer 8

Obtaining valuable information from looking at someone’s screen or monitor

Question 9

Define Pharming

Answer 9

Compromising a DNS server so that users are directed to an alternate malicious site, instead of the valid site for the URL requested

Question 10

Define Tailgating

Answer 10

Gaining unauthorized access to a restricted area by following someone in

Question 11

Define Eliciting information

Answer 11

the subtle extraction of information during an apparently normal and innocent conversation

Question 12

Define Whaling

Answer 12

spear phishing attack targeting an executive, such as getting bank information from the CFO or head of accounting

Question 13

Define Prepending

Answer 13

Creating a malicious URL by adding character(s) to the beginning of it, i.e. wwellsfargo.com, to fool people

Question 14

Define Identity Fraud

Answer 14

Gaining information to setup or access accounts as the identity of another person

Question 15

Define Invoice scams

Answer 15

Sending valid-looking invoices to the accounting department to obtain payment for services not actually rendered

Question 16

Define Credential Harvesting

Answer 16

Using macros or malware to steal credentials saved in other applications, such as Chrome, silently in the background

Question 17

Define Reconnaissance

Answer 17

gathering information, either passively or actively, to prepare an attack
i.e. looking at someone’s social media or running a port scan

Question 18

Define Hoax and provide 2 examples

Answer 18

1. a situation that is not real, but looks real, for malicious intent
2. pop-up to download false virus protection or software updates

Question 19

Define Impersonation

Answer 19

A threat actor pretending to be someone else to facilitate an attack or obtain information

Question 20

Define Watering hole attack

Answer 20

Using a third-party to attack an organization, i.e. infecting the online ordering website of a restaurant nearby that employees regularly order from

Question 21

Define Typosquatting

Answer 21

Using common spelling mistakes of valid URLs to create malicious websites, i.e. weellsfargo.com

Question 22

Define Pretexting

Answer 22

Creating a believable lie to facilitate an attack, such as a phishing attack

Question 23

Influence Campaign - Hybrid warfare & Social Media

Answer 23

Influencing policy changes by creating fake social media accounts to spread a narrative that is then picked up and spread by valid influential sources, can be used instead of military action to change an opposing nation/state

Question 24

Define Strategy - Authority

Answer 24

Invoking a source of authority to elicit information or an action, i.e. calling from the CEO’s office, or IT support

Question 25

Define Strategy - Intimidation

Answer 25

Using intimidation to elicit information or an action, i.e. payroll won’t go out if you don’t….

Question 26

Define Strategy - Consensus

Answer 26

Saying something like “Co-worker Jill did this for me last week so can you …. ?”

Question 27

Define Strategy - Scarcity

Answer 27

Something will go away if you don’t do this for me now

Question 28

Define Strategy - Familiarity

Answer 28

You’re my buddy, we both know Bob, so do this for me as a favor for Bob

Question 29

Define Strategy - Trust

Answer 29

Trick the person into trusting you, hey I’m helping everyone in the company with this

Question 30

Define Strategy - Urgency

Answer 30

Creating a scenario where action needs to be taken now