Getting Started 

Social Engineering Categories

Social engineering is an attack that exploits human nature by convincing someone to disclose information or perform an activity. There are two forms of social engineering. "Active and Passive"

​

Shoulder Surfing - Shoulder surfing involves looking over the shoulder of someone working on a computer to gain information.

Eavesdropping - Eavesdropping refers to an unauthorized person listening to employees or other authorized personnel as they discuss sensitive topics.

Dumpster diving - Dumpster diving is the process of looking in the trash for sensitive information that has not been properly disposed of.

Tailgating and piggybacking - Piggybacking and tailgating refer to an attacker entering a secured building by following an authorized person through a secure door without providing identification. Piggybacking usually implies consent from the authorized person. Tailgating implies no consent from the authorized person.

Phishing - A phishing scam is an email pretending to be from a trusted person or organization, asking to verify personal information or send money. In a phishing attack:

• A fraudulent message (that appears to be legitimate) is sent to a target.

• The message requests that the target visit a fraudulent website (which also appears to be legitimate). Graphics, links, and websites look almost identical to the legitimate requests and websites they are trying to represent.

• The fraudulent website requests that the target provide sensitive information such as the account number and password.

​​

Common phishing scams include the following features.

• A Rock Phish kit is a fake website that imitates a real website (such as banks, PayPal ® , eBay ® , and Amazon ®). Phishing emails direct you to the fake website to enter account information. A single server can host multiple fake sites using multiple registered DNS names. These sites can be set up and taken down rapidly to avoid detection.

• A Nigerian scam, also known as a 419 scam, involves emails that request a small amount of money to help transfer funds from a foreign country. In return, the target is to receive a reward for a much larger amount of money that will be sent at a later date.

• In spear phishing, an attacker gathers information about individual targets, such as identifying each target's online bank. The attacker then sends phishing emails that appear to be from the target's bank.

• Whaling is another form of phishing that targets senior executives and high-profile individuals.

• Vishing is similar to phishing. Instead of an email, the attacker uses a phone call to gain sensitive information. The term is a combination of voice and phishing.

​​

To protect against phishing:

• Check the link destination within emails to verify that the link is the correct URL, not a spoofed one.

• Do not click links in emails. Instead, type the valid URL into the browser.

• Verify that HTTPS is used on e-commerce sites. HTTPS requires a certificate (verified by a trusted CA) that matches the server name in the URL. You can also look for the lock icon to verify that HTTPS is used.

Implement phishing protections within browsers.

​

Pretexting - Pretexting is the use of a fictitious scenario to persuade someone to perform an action or give information for which the person is not authorized. Pretexting usually requires the attacker to perform research to create a believable scenario.

Caller ID spoofing - Caller ID spoofing causes the telephone network to display a number on the recipient's caller ID display that implies that a call is coming from a legitimate source.