Social Engineering Flashcards
What is a manipulative strategy that exploits human psychology to gain unauthorized access to systems, data, or physical spaces
Social Engineering
What is the best defense to help with Social Engineering?
Provide security awareness training to the users.
What are some motivational triggers for social engineering:
Familiarity and likability
Consensus and Social Proof
Authority and information
Scarcity and Urgency
What are 4 of the most used social engineering techniques used by attackers:
Impersonation - assume identity of another individual
Brand Impersonation - imitating a company or brand
Typo Squatting - create and faking a website name - url
Watering Hole Attacks - where a website or service is compromised that their target attack is known to use.
Another way Social Engineers try to attack is using________ like as a Bank official, IT Support, and Law Enforcement calling and then asking for them to give like printer info and IP address info.
Pre-Texting
What are some of the types of phishing attacks that Social Engineers use:
Phishing - like spray and pray approach
Vishing
Smishing
Spear Phishing - target users
Whaling
Business Email Compromise
Manipulating a situation or creating a distraction to steal valuable items or information is known as__________ _______ attack. An example would be utilizing a DNS spoofing attack that redirects you to a fake website.
Diversion Theft
A Malicious deception that is often spread through social media, email, or other communication channels. they are often paired with phishing and impersonation attacks.
Hoaxes
Looking over someone’s shoulder to gather personal information, you can actually use high-powered cameras or closed-circuit television cameras, is known as:
Shoulder Surfing
Searching through trash trying to find personal information, or if an attacker is able to access your computer and can see your “Trash”folder these attacks are called virtual or digital ___________ _____________.
Dumpster Diving
The process of secretly listening to private messages, like when you’re on the phone or conference call. Maybe wire tapping, or intercepting network traffic. they could take the form of an adversary in the middle or on-path attack. The perp intercepts the communication without the parties knowing.
Eavesdropping
Planting a malware-infected device for a victim to find and unintentionally introduce malware to their org’s system. like leaving a USB drive left somewhere that someone picks up and pops it in their computer.
Baiting
this is when an attacker tricks and authorized employee into using their access badge to grant them entry into the facility because they supposedly lost or left their badge somewhere.
Piggybacking
this is when an attacker attempts to follow an an employee through something like a turnstile, control vestibule or some type of access point without that person knowing.
Tailgating
Six types of motivational triggers are:
Authority - Like claiming to be the IRS
urgency - pushing so you will ignore normal sec procedures
social proof - getting likes on your website so people trust
scarcity - making you believe time is limited / short supply.
likability - trying to be accepted / liked by others
Fear - making you afraid of someone, dangerous, painful
