Section 5.37 Social Engineering Motivation Triggers Flashcards
Objectives 2.2 Explain common threat vectors and attack surfaces Objectives 5.6 Given a scenario, implement security awareness practices
Social Engineering
Manipulative strategy exploiting human psychology for unauthorised access to systems, data, or physical spaces
6 main motivations
Motivational Triggers that social engineers use
A.U.S.S.L.F
- Authority
- Urgency
- Social Proof
- Scarcity
- Likeability
- Fear
Motivations explained
Authority
Most people are willing to comply and do what you tell them to do if they believe it is coming from somebody who is in a position of authority to make that request
e.g attacker states he is an authoriative figure in the company
Motivations explained
Urgency
Compelling sense of immediacy or time-sensitivity that drives individuals to act swiftly or prioritise certain actions
e.g Attacker giving a USB thumb drive to staff stating he has an urgent meeting in 5 mins and needs to print something
Attackers use the sense of urgency to get the organisations employeess to ignore or bypass their normal procedures
Motivations explained
Social Proof
Psychological phenomenon where individuals look to the behaviors and actions of others to determine their own decisions or actions in similar situations
e.g if I can get likes and shares from my scam website people will begin to believe its legit - knock on effect
Reviews on courses is a great example no reviews vs 1000 positive views
Motivations explained
Scarcity
Psychological pressure people feel when they believe a product, opportunity, or resource is limited or in short supply
e.g Sign up now as places are limited
Motivations explained
Likability
Most people want to interact with people they like, and social engineers realise this
e.g Attractive woman talking to guys at work who would open up about what they are working on
Sexual attraction, Pretending to be a friend, Common intrest.
These scammers tend to seem like very nice people
Motivations explained
Fear
These types of attacks generally are focused on “if you don’t do what I tell you, then this bad thing is going to happen to you”
e.g Your files may have been encrypted and you are being blackmailed
