Phishing

Question 1

Phishing

Answer 1

The process of attempting to acquire sensitive information (such as usernames, passwords, or credit card details). It is a form of criminally fraudulent social engineering.

It’s done by masquerading as a trustworthy entity on bulk email, which tries to evade spam filters. Emails claiming to be from popular social websites, banks, auction sites, or IT administrators are commonly used to lure the unsuspecting public.

Question 2

Spear phishing

Answer 2

A small, focused, targeted phishing attack on a specific person or organization, with the goal to penetrate their defenses.

The attack is done after research has been done on the target, and has a specific personalized component designed to make the target do something against their own interest.

Question 3

Phishing attack surface

Answer 3

The quantity of email addresses exposed on the internet. The more email addresses exposed, the bigger the attack footprint is and the higher the risk for phishing attacks.

Question 4

Phish-prone percentage

Answer 4

A term coined by KnowBe4 that indicates the percentage of employees that are prone to click on phishing links.

The customer starts with a baseline percentage, which is the percentage of users who click on phishing links before being trained. Once trained, the test is done again 12 months later, to see the improvement.

Question 5

Social engineering

Answer 5

The act of manipulating people into performing actions or divulging confidential information.

The term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access.

Question 6

CEO fraud

Answer 6

A spear phishing attack that targets high-risk users—people in Accounting, HR, or executive assistants—in which the hacker claims to be the CEO (or another executive) and urges an employee to do something that would not be authorized by the legitimate sender.

Question 7

Vishing

Answer 7

Voice phishing

A phishing attack conducted by telephone. Vishing is the phone equivalent of a phishing attack.

There are two forms of this: human and automated.
Human example - A scam artist uses the anonymity of a phone call and pretends to be a representative of their target’s bank or credit card company, etc.

Question 8

Smishing

Answer 8

Phishing conducted via Short Message Service (SMS), a telephone-based text messaging service.

Question 9

Email spoofing

Answer 9

Spoofing (tricking or deceiving) computer systems or other computer users. It involves sending messages from a bogus email address or faking the email address of another user.