Lecture 9: Human Factors and Social Engineering

Question 1

Name the different phases of social engineering

Answer 1

• Research
• Pretexting, build rapport and trust
• Get data (exploit trust)
• Keep connections
• Combine data
• Use it

Question 2

Give some examples of why social engineering is common

Answer 2

• Industrial spying
• Access to resources
• Data theft
• Identity theft

Question 3

Give some examples of techniques used for social engineering

Answer 3

• Trappings of role
• Using credibility
• Forcing the target into a role (altercasting)
• Distracting from systematic thinking
• Momentum of compliance
• Bury questions
• Get pieces from different sources
• Read victim’s openness
• Test with personal information
• Back off, don’t burn the source
• Create then fix a problem

Question 4

Give some examples of human factors that are often exploited in social engineering

Answer 4

• The desire to help
• Attribution
• Liking
• Fear
• Reactance
• Reciprocity
• Dynamics of doing a favor

Question 5

List some countermeasures against social engineering

Answer 5

• Clear concise protocols that are enforced
• Awareness thinking
• Simple rules to define sensitive information
• Simple rule that ID required for restricted action
• Data classification policy
• Resistance training
• Testing by security assessment ¨
• Politeness change, “NO” is OK