Social Engineering Flashcards
Pretexting
Pretexting is a method of inventing a scenario to convince victims to divulge information they should not divulge.
Insider Threat
A person who works with your organisation but has ulterior motives. -E.g.: Employees who steal information are insider threats.
Phishing
An attempt to fraudulently obtain information from a user (usually by email).
Spear Phishing
An attempt to fraudulently obtain information from a user (usually by email). Spear Phishing targets a specific individual.
Whaling
A form of spear phishing that directly targets the CEO, CFO, CIO, CSO or other high-value target in an organisation.
Smishing
Phising conducted over SMS.
Vishing
Phising that occurs over voice calls.
Pharming
Phising attempt to trick a user to access a different website.
What are the 6 Motivation Factors in Social Engineering
- Authority
- Urgency
- Social Proof
- Scarcity
- Likeability
- Fear
Diversion Theft
When a thief trys to divert a shipment to another location.
Hoax
Deceiving people into believing something is false when it’s true (or vice versa)
Shoulder Surfacing
Someone watches your activities in person to obtain authentication information.
Eavesdropping
When a person uses direct observation to “listen” in to a conversation
Dumpster Diving
When a person scavenges for information in garbage containers.
Baiting
When a malicious individual leaves malware-infected removable media such as a USB drive or optical disk in plain view for a victim.
Piggybacking
When an unauthorised person tags along with an authorized person to gain entry to a restricted area.
Watering Hole Attack
When an attacker figures out where users like to go, and places malware to gain access to your organisation.
Fraud
A wrongful or criminal deception indented to result in financial or personal gain.
Most common within cybersecurity is Identity Theft.
There is a difference between Identity theft and Identity fraud.
Scam
A fraudulent or deceptive act or operation.
Invoice Scam
Where an individual or organisation is tricked into paying a fake invoice for a service or product they didn’t order
Prepending
Adding an invisible string before a weblink that a victim would click.
Influence Campaign (Influence Operations)
The collection of tactical information about an adversary as well as the dissemination of propaganda in pursuit of a competitive advantage over an opponent.
(Take information and use it again someone). CompTIA uses the term Influence Campaign)
Hybrid Warfare
A military strategy which employs political warfare, conventional warfare, irregular warfare and cyberware.
Companies like facebook and twitter have been victims of attempts by foreign threat actors to influence the political and social landscape.
What can you train users to do to prevent a security incident?
- Never give out their authentication information
- Screen emails & calls carefully, train them to make logs of “unusual events”
- Train users how to use encryption
- Train users never to pick up and make use of removal media
- Shred sensitive information
- Comply with data handling and disposal policy
- Teach them good web security
- Implement a clean desk policy
Clean Desk Policy
A policy where all employees must put away everything (files & folders) from their desk at the end of the day into locked drawers and cabinets
