Social Engineering Flashcards

Manipulating people into performing actions or revealing information that compromises security. Exploits psychological principles — authority, urgency, scarcity, social proof, familiarity, intimidation — rather than technical vulnerabilities. The human is the attack surface.

Creating a fabricated scenario to gain a target's trust. The attacker invents a plausible context — posing as IT support, an auditor, a vendor, or a colleague — to justify their request. All BEC attacks involve pretexting. The more believable and researched the pretext, the higher the success rate.

Spear phishing uses personal information about the specific victim to increase credibility — their name, employer, role, manager, recent activities. Regular phishing is mass, generic, untargeted. Spear phishing has far higher success rates because the email appears to come from someone who knows the victim. Email filters catch less of it because the content is plausible.

Spear phishing targeting C-suite executives (CEO, CFO, CTO, board members). Higher research investment justified by higher target value — executives can authorize wire transfers, access the most sensitive systems, and sign contracts. Often the impersonation side of a BEC attack — impersonating the CEO to authorize fraudulent wire transfers. The "big fish."

Impersonating executives or trusted business contacts to authorize fraudulent financial transactions. Typically: attacker impersonates CEO, targets CFO or accounting staff, creates urgency around a wire transfer. Annual losses exceed $2 billion globally. Hallmarks: Authority + Urgency + Secrecy in a single request. Combines pretexting, impersonation, and psychological manipulation.

Voice phishing — phone calls impersonating legitimate organizations (IT support, IRS, bank fraud departments) to extract credentials or information. Caller ID spoofing makes the number appear legitimate. Defense: callback verification to a known number — never provide credentials or perform resets based on an incoming call. Hang up; call back at a known number from an independent source.

SMS phishing — text messages containing malicious links or urgent requests impersonating banks, package carriers, or government agencies. Short URL masking hides the true destination. The mobile context and abbreviated message format reduce scrutiny. Often triggers credential harvesting pages or malware downloads. Principles: urgency, scarcity ("your account is being closed").

Gaining unauthorized physical access by following an authorized person through a secured door. Exploits social courtesy — people naturally hold doors and do not challenge confident-looking strangers. Defense: mantraps (two-door security vestibule — both doors cannot open simultaneously), strict badge challenge policy, security culture where everyone is required to badge in individually with no exceptions.

Compromising a website frequently visited by the target group, then waiting for them to visit. The attacker infects the destination instead of sending malicious content to the target. Bypasses email filters completely — no malicious email is ever sent. The attack occurs at the website layer when the victim visits a site they already trust. Named after predators waiting at watering holes for prey.

Offering a service or benefit in exchange for information. Classic: fake IT support calls offering to fix a (nonexistent) computer problem in exchange for login credentials. The target receives apparent value (help) and provides access in return. Exploits the reciprocity principle — humans feel obligated to give back when they receive help, even from strangers.

Observing someone's screen, keyboard, or documents to capture sensitive information — passwords, PINs, credit card numbers, confidential data. Common in public spaces: airports, cafes, open-plan offices, public transit. Defense: screen privacy filters (polarizing film that limits viewing angle), positioning screens away from public sightlines, locking screens when stepping away.

Searching through discarded materials (trash, recycling bins) for useful information — org charts, printed credentials, system documentation, financial documents, network diagrams. Provides reconnaissance data for constructing convincing spear phishing with apparent insider knowledge. Defense: cross-cut shredding of all sensitive documents before disposal, clean desk policy, locked disposal bins.

Urgency disables critical thinking by creating time pressure. When people are rushed, they skip verification steps, bypass procedures, and comply without questioning. Security maxim: any request that requires bypassing normal security procedures "because of urgency" should trigger MORE scrutiny, not less. Urgency is the attacker's most reliable tool — and recognizing it as a manipulation tactic is the primary defense.

Verifying a request through a completely separate communication channel from the one that delivered the suspicious request. Not replying to the email. Not calling a number in the email. Using a contact method already on file (known phone number from the corporate directory). If the CEO emails a wire request, call the CEO's known number independently. A real CEO will understand. An impersonator cannot intercept a call to the real CEO's known number.

Security awareness training combined with process controls. Training: employees recognize attack patterns (urgency + authority + secrecy = red flag), know how to verify, and know how to report without shame. Process: dual authorization for financial transactions, callback verification for credential resets, clear escalation procedures. Neither alone is sufficient — trained employees still need process backstops when training fails.

Human social norms work against security. We are taught to be helpful, not to challenge people, to hold doors for those with full hands, and to assume colleagues' visitors are legitimate. An attacker who looks the part (uniform, badge, confident demeanor) exploits these norms. The defense requires building a security culture where challenging unknown visitors is normalized and rewarded — not seen as rude. This is a culture problem as much as a security problem.