Section 29 Social Engineering Flashcards
Manipulates a user into revealing confidential information that are detrimental to that user or the security of our systems.
Social Engineering
A person who works for or with your organization but has ulterior motives.
Insider Threat
An attempt to fraudulently obtain information from a user (usually by email).
Phishing
An attempt to fraudulently obtain information from a user, usually by email that targets a specific individual.
Spear phishing
A form of spear phishing that directly targets the CEO, CFO, CIO, CSO, or other high value targets in an organization.
Whaling
Phishing conducted over text messaging (SMS)
Smishing
Phishing conducted over voice and phone calls
Vishing
Phishing attempt to trick a user to access a different or fake website (usually by modifying hosts file).
Pharming
People are more willing to comply with a request when they think it is coming from someone in authority.
Authority
People are usually in a rush these days and urgency takes advantages of this fact.
Urgency
People are more likely to click on a link through social media or based on seeing others have already clicked on it.
Social Proof
Technique that relies on the fear of missing out on a good deal that is only offered in limited quantities or a lmited time.
Scarcity
A technique where the social engineer attempts to find common ground and shared interests with their target.
Likeability
The use of threats or demands to intimidate someone into helping you in the attack.
Fear
When a thief attempts to take responsibility for a shipment of diverting the delivery to a nearby location.
Diversion Theft
When a person uses direct observation to obtain authentication information.
Shoulder Surfing
When an unauthorized person tags along with an authorized user to gain entry to a restricted area.
Piggy Backing
When an attacker figures out where users like to go, and places malware to gain access to your organization.
Watering Hole Attack
The wrongful or criminal deception intended to result in financial or personal gain.
Fraud
The use by one person of another person’s personal information, without authorization, to commit a crime or to deceive or defraud that other person or a third person.
Identity Fraud
A technical method used in social engineering to trick users into entering their username and passwords by adding an invisible string before the weblink they click.
Prepending
Policy where all employees must put away everything from their desk a the end of the day into locked drawers and cabinets.
Clean Desk Policy
