Section 27.259 Avoiding Social Engineering

Question 1

Social Engineering

Answer 1

Involves deception to manipulate individuals into breaching security procedures

■ Attacks exploit human psychology and often appear innocent

■ Awareness and vigilance serve as the first line of defense against social engineering attacks

Question 2

Maintaining Situational Awareness

Situational Awareness

Answer 2

Mindfulness about surroundings and actions

■ Essential to avoid social engineering attacks

Question 3

Maintaining Situational Awareness

Examples of social engineering threats

Answer 3

● Shoulder surfing
● Eavesdropping

Question 4

Maintaining Situational Awareness

Measures to counter threats

● Shoulder surfing
● Eavesdropping

Answer 4

● Privacy screen protectors

● Secure discussions

Question 5

Piggybacking and Tailgating

Answer 5

Social engineers may try to enter secured premises by closely following authorised personnel

■ Use access control vestibules to restrict entry to one person at a time

■ Maintain situational awareness to prevent unauthorised access

Question 6

Dumpster Diving

Answer 6

Attackers sift through garbage for discarded information

■ Employees with situational awareness can spot such activities

■ Dispose of sensitive data securely to avoid being a victim of this attack

Question 7

Operational Security (OPSEC)

Answer 7

Protects critical information from being used by adversaries

■ Safeguard sensitive data, daily routines, and internal procedures

■ Discourage sharing seemingly innocuous details on social media or during
personal interactions

Question 8

Technological Social Engineering Attacks

Answer 8

Baiting attacks use removable media devices (e.g., USB thumb drives) and charging cables

■ Picking up or connecting found devices can infect workstations or networks with malware

■ Carry your own charging cables and chargers to avoid untrusted ones

Question 9

Pressure Tactics

Answer 9

Social engineers may use a sense of urgency or fear to manipulate individuals

■ Urgent requests aim to bypass normal security protocols

■ People are more likely to make mistakes when rushed into action

Question 10

Proactive Culture of Security

Answer 10

■ Train employees regardless of their position in the company

■ Educate on recognizing phishing attempts, data privacy, and safe online behavior

■ Encourage employees to report suspicious activities

■ Conduct practical exercises, like simulated phishing attacks, to test and remediate
employees’ responses