2.4 Common Social-Engineering Attacks, Threats, & Vulnerabilities Flashcards
Social Engineering - Phishing
Imitating someone you may know
Social Engineering - Vishing
Phishing over the phone
Social Engineering - Shoulder surfing
Visually looking at someone else’s device and screen by accident or intentionally
Social Engineering - Whaling
Specifically targeting a high level personal to gain higher level information
Social Engineering - Tailgating
Someone walking in behind someone else with access
Social Engineering - Impersonation
Pretend to be someone else
Social Engineering - Dumpster diving
Obtaining valuable information from the trash can
Social Engineering - Evil twin
Wireless access point with identical characteristics to fool the user
Threats - Distributed denial of service (DDoS)
Use many devices to bring down a service
Threats - Denial of service (DoS)
Takes advantage of a flaw in a system
Threats - Zero-day attack
Vulnerabilities that have not been identified yet
Threats - Spoofing
A person or program identifies as another by falsifying data
Threats - On-path attack
Attacker watches traffic to and from the user
Threats - Brute-force attack
Try every possible password combination
Threats - Dictionary attack
Try every possible password combination using the words found in a dictionary
Threats - Insider threat
Gain access to a organization on the inside
Threats - Structured Query Language (SQL) injection
Modifying one line of SQL can allow you to obtain access you shouldn’t have
Threats - Cross-site scripting (XSS)
Information from one site can be shared with another
Vulnerabilities - Non-compliant systems
Need to perform latest updated and configurations
Vulnerabilities - Unpatched systems
Updates performs patch updates
Vulnerabilities - Unprotected systems (missing antivirus/missing firewall)
Antivirus & firewalls need to be disabled when troubleshooting, but need to enable again
Vulnerabilities - EOL OSs
Time when they stop selling an OS
Vulnerabilities - Bring your own device (BYOD)
Personal device that needs to meet the companies security requirements
