Social Engineering

Question 1

Define Social Engineering

Answer 1

At its core it is manipulating a person into knowingly or unknowingly giving up information; essentially ‘hacking’ into a person to steal valuable information.
- Psychological manipulation
- Trickery or deception for the purpose of information gathering
It is a way for criminals to gain access to information systems. The purpose of social engineering is usually to secretly install spyware, other malicious software or to trick persons into handing over passwords and/or other sensitive financial or personal information
the most effective routes to stealing confidential data from organizations.

Question 2

List the 6 types of Social Engineering Attacks

Answer 2

1. Phishing
2. Vishing and Smishing
3. Pretexting
4. Baiting
5. Tailgating and Piggybacking
6. Quid Pro Quo

Question 3

List 3 different types of phishing

Answer 3

1. Deceptive Phishing
2. Spear Phishing
3. Whaling

Question 4

Define Deceptive Phishing

Answer 4

• Legitimate Links
• Company Logos & Theme
• Copy of Landing/Login Page
• Shortened URL & Redirects

Question 5

Define Spear Phishing

Answer 5

an email or electronic communications scam targeted towards a specific individual, organization or business. Although often intended to steal data for malicious purposes, cybercriminals may also intend to install malware on a targeted user’s computer.

Question 6

Define Whaling

Answer 6

• Similar to spear phishing
• Aimed at executives of a company
• Goal is to gain access to an administrator account

Question 7

List 5 ways to prevent Phishing

Answer 7

1. Employee awareness !
2. Multistep verification
3. Data protection policies
4. Social media education
5. Anti-phishing tools and organizations

Question 8

Define Vishing

Answer 8

the use of telephony to conduct phishing attacks.

Question 9

Define Smishing (SMS phishing)

Answer 9

the fraudulent practice of sending text messages purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords or credit card numbers.

Question 10

Define Pretexting

Answer 10

cybercriminal stages a scenario that baits victims into providing valuable information they wouldn’t have otherwise

Question 11

Baiting

Answer 11

relies on
- curiosity or greed of the victim
- promise of an item or good that hackers use to entice victims

Question 12

Define Quid Pro Quo

Answer 12

Hacker requesting the exchange of critical data or login credentials in exchange for a service

Question 13

Solution to QPQ

Answer 13

dont give personal account information unless you initiated the exchange

Question 14

What is Google Dorking

Answer 14

A hacking technique that makes use of Google’s advanced search services to locate valuable data or hard-to-find content.
- A search string or custom query that uses advanced search operators to find information not readily available on a website

Question 15

What can Google Dorking be used to retrieve

Answer 15

• usernames and passwords
• email address lists
• sensitive documents
• personally identifiable information
• personally identifiable financial information
• website vulnerabilities

Question 16

What are the NSA recommended steps for secure conversion and redaction of Word Documents

Answer 16

1. Create a copy of the original document.
2. Turn off “Track Changes” on the copy and remove all visible comments.
3. Delete any sensitive information from the document that you wish to redact.
4. Use the Microsoft Office Document Inspector to check for any unwanted metadata. (File -> Info -> Check for issues)
5. Save the new document and convert it to a PDF file.
6. Use the Sanitize Document tool in Acrobat Professional as a second check before releasing the redacted PDF.

Question 17

List some ways to Protect Yourself

Answer 17

-A security aware culture can help employees identify and repel social engineering attacks
- Recognize inappropriate requests for information
- Take ownership for corporate security
- Understand risk and impact of security breeches
- Social engineering attacks are personal
- Password management
- Two factor authentication
- Physical security
- Understand what information you are putting on the - - Web for targeting at social network sites
- Network defenses to repel virus
- Virus protection (McAfee, Norton, Symantec, etc…)
- Email attachment scanning
- Firewalls, etc…
- Organizations must decide what information is sensitive
- Security must be periodically tested
- Contact your security office immediately if you have any concerns at work