Social Engineering Flashcards

All 9 cards in this deck

What is social engineering?

The art of manipulating people so they give up confidential information, rather than attacking the technology.
e.g. blagging, phishing, shouldering

True or false? The people who use a system are often its weakest point in terms of security.

True. Attackers use social engineering to trick users into revealing passwords or access, bypassing technical security.

True or false? A firewall will stop an employee being tricked by a phishing email.

False. A firewall only filters network traffic; staff training and awareness are needed against social engineering.

An employee receives an email that looks like it is from their bank, asking them to click a link and enter their login details. What form of attack is this?

Phishing: fraudulently obtaining private information, often using email or SMS, by pretending to be a trusted organisation. It aims to steal data such as usernames, passwords or bank details.

What is blagging?

Creating and using an invented scenario (pretexting) to persuade a targeted victim to give up information or act in an unusual way.
e.g. phoning a member of staff while pretending to be from the IT helpdesk

Give two ways an organisation can protect itself against social engineering.

Any two of: train staff to spot suspicious emails, calls and messages; have a rule that staff never reveal passwords, e.g. over the phone; check unusual requests with the person through a known, trusted contact before acting.

What is shouldering (shoulder surfing)?

Observing a person's private information over their shoulder, e.g. watching someone type their PIN at a cashpoint machine.

How can people protect themselves against shouldering?

Cover the keypad or screen when entering a PIN or password, check who is nearby, and use privacy screens on devices used in public.

How does phishing differ from blagging in who it targets?

Phishing is usually sent to large numbers of people at once, hoping some will respond. Blagging targets a particular person with an invented scenario.