Terms Deck 1 Flashcards
social engineering
The process of taking advantage of human behavior to attack a network or gain access to resources that would otherwise be inaccessible. Social engineering emphasizes the well-known fact that poorly or improperly trained individuals can be persuaded, tricked, or coerced into giving up passwords, phone numbers, or other data that can lead to unauthorized system access, even when strong technical security measures can otherwise prevent such access.
phishing
An attempt to acquire sensitive information by masquerading as a trustworthy entity via electronic communication, usually email.
vishing
An attack in which the attacker uses fake caller ID to appear as a trusted organization and attempts to get the individual to enter account details by phone. Also known as voice phishing.
spam
Unsolicited messages typically sent to a large number of recipients.
spam over Internet messaging (SPIM)
A type of unsolicited messaging that is specifically sent over instant messaging platforms.
spear phishing
A targeted version of phishing.
dumpster diving
A technique used by an attacker that involves gathering useful information from discarded data.
shoulder surfing
Looking over someone’s shoulder to obtain information.
pharming
An attack that redirects victims to a bogus website.
tailgating
Following closely behind someone who has authorized physical access in an environment.
eliciting information
The use of varying techniques that can directly or indirectly lead to sensitive data loss or other compromise.
whaling
The use of spear phishing tactics against high-profile targets such as executives within a company.
identity fraud
The use of a person’s personal information without authorization to deceive or commit a crime.
hoax
A situation that seems like it could be legitimate but often results from people seeking to carry out various threats.
impersonation
A method by which someone assumes the character or appearance of someone else.
watering hole attack
An attack in which the attacker focuses on a site frequently visited by the target. Similar to spear phishing but does not use email.
typo squatting
An attack that most commonly relies on typographic errors made by users on the Internet. Also known as URL hijacking.
influence campaign
Coordinated actions that seek to affect the development, actions, and behavior of the targeted population.
malware
Malicious software used to cause damage or gain unauthorized access to systems.
ransomware
A form of malware that attempts to hold a person or company hostage, often for monetary gain.
trojan horse
A form of malware that appears to be useful software but has code hidden inside that attacks a system directly or allows the system to be infiltrated by the originator of the code when it is executed. A Trojan horse is software hidden inside other software. It is commonly used to infect systems with viruses, worms, or remote-control software.
worm
A type of virus designed primarily to reproduce and replicate itself on as many computer systems as possible. A worm does not normally alter files; instead, it remains resident in a computer’s memory. Worms typically rely on access to operating system capabilities that are invisible to users.
potentially unwanted program (PUP)
Software that often is not wanted, although it may not be explicitly malicious.
virus
A piece of malicious code that spreads to other computers by design, although some viruses also damage the systems on which they reside. Viruses can spread immediately upon being received or can implement other unwanted actions, or they can lie dormant until a trigger in their code causes them to become active. The hidden code a virus executes is called its payload.
