3.1.5. Compare and contrast common social engineering attacks, threats, and vulnerabilities. (Obj. 2.5)

💡 First Principle: The human is often the weakest link in security; awareness and vigilance are the best defenses against social engineering.

Social engineering is the art of psychological manipulation. Instead of trying to break through firewalls and exploit software vulnerabilities, an attacker targets the most vulnerable part of any organization: its people. They use deception, persuasion, and intimidation to trick employees into divulging sensitive information or performing actions that compromise security. As a technician, you must recognize these attacks to protect your users and your company.

Figure: Example phishing email - note the urgency, generic greeting, and suspicious link

• Phishing: The most common attack. An attacker sends a broad, generic email to thousands of people, pretending to be from a well-known entity like a bank, a shipping company, or a tech service. The email contains a link to a fake login page designed to steal credentials or an attachment containing malware.
• Spear Phishing: A highly targeted and much more dangerous version of phishing. The attacker does their homework, researching a specific individual or company. The email will be personalized, using the target's name, job title, and other details to appear much more legitimate.
• Whaling: A type of spear phishing aimed specifically at high-value targets like CEOs, CFOs, or other senior executives. The goal is often to trick them into authorizing large wire transfers or revealing strategic company secrets.
• Vishing and Smishing: These are phishing attacks conducted over different mediums. Vishing is voice phishing (via a phone call), and Smishing is SMS phishing (via text message).
• Impersonation: An attacker pretends to be someone they are not, such as a new employee, a vendor, or even an IT help desk technician, to gain physical access or information.
• Shoulder Surfing & Tailgating: These are physical social engineering attacks. Shoulder surfing is simply looking over someone's shoulder to see them enter a password or PIN. Tailgating is following an authorized person through a secure doorway without providing your own credentials.
• Dumpster Diving: Searching through a company's trash to find documents containing sensitive information, like old bills, employee lists, or network diagrams.

Technical threats you must be able to tell apart:

• DoS / DDoS: Overwhelming a service so legitimate users can't reach it. A DoS comes from one source; a Distributed DoS comes from many compromised machines (a botnet) at once, so blocking one address doesn't stop it.
• Evil twin: A rogue wireless access point broadcasting the same SSID as a legitimate network, so anyone who joins it sends their traffic through the attacker.
• On-path attack (formerly man-in-the-middle): The attacker secretly sits between two parties, reading or altering traffic as it is relayed. An evil twin is one way to get on-path.
• Spoofing: Faking an identity (an email sender address, caller ID, IP or MAC address, or a look-alike domain) so a message or device appears trustworthy. Spoofing is the disguise; phishing is the scam that uses it.
• Zero-day: An exploit for a flaw the vendor doesn't know about yet, so no patch exists. Contrast an unpatched system, where a fix exists but hasn't been applied.
• Brute-force and dictionary attacks: Password guessing. Brute force tries every possible combination; a dictionary attack tries a list of common words and previously leaked passwords.
• Insider threat: Someone with legitimate access (an employee or contractor) who misuses it, deliberately or carelessly.
• SQL injection (SQLi) and cross-site scripting (XSS): Web application attacks. SQLi slips database commands into an input field to read or change the database; XSS injects malicious script into a web page so it runs in other visitors' browsers.
• Business email compromise (BEC): Using a hijacked or impersonated business mailbox (often an executive's or a supplier's) to trick staff into paying fake invoices or changing payment details.
• Supply chain attack: Compromising a trusted supplier (a software vendor, hardware maker, or managed service provider) so the attack reaches that supplier's customers through a product, update, or connection they already trust.

Vulnerabilities are the weaknesses those threats exploit:

• Unpatched system: a security update exists but hasn't been installed.
• End-of-life (EOL) system: the vendor no longer supports it, so no further patches will ever be released.
• Unprotected system: missing basic defenses such as anti-malware or a firewall.
• Non-compliant system: doesn't meet the organization's required security policies, standards, or regulations.
• BYOD (Bring Your Own Device): personal devices on the network are harder for the company to control and secure.

An attack vector is the specific path an attacker uses to get in (a phishing email, an exposed remote-access port, an infected USB drive); the attack surface is the sum of all the possible vectors.

Credential stuffing is a password attack that guesses nothing: the attacker replays username/password pairs leaked in one site's breach, usually with automated tools, against other unrelated sites. It succeeds only where people reuse passwords, so a unique password for every site (a password manager makes this practical) and MFA defeat it.

The best defense against social engineering is a well-trained and skeptical workforce. Regular security awareness training that teaches users to be suspicious of unsolicited requests, to hover over links to check their true destination, and to independently verify any urgent or unusual requests for money or or data is critical.

Training works best when users practice. Simulated phishing campaigns send staff realistic test phishing emails and give immediate feedback to anyone who clicks, which changes behavior more than an annual presentation does. Encourage reporting instead of punishing mistakes, because fear makes people hide them.

Technician's Action Plan: Scenario: A frantic employee from the accounting department calls you. They just received an email from the "CEO," who is on vacation, with the subject "URGENT - Invoice Payment." The email instructs the employee to immediately wire $15,000 to a new international vendor to secure a critical deal. The email address looks correct, but the tone is unusually demanding.

1. Identify the Attack: Immediately recognize the classic signs of a Whaling attack: urgency, a request for a financial transaction, an executive who is conveniently out of contact, and a deviation from normal procedure.
2. Instruct the User to STOP: Tell the employee in a calm but firm voice: "Do not click any links, do not reply to the email, and absolutely do not make that wire transfer."
3. Initiate Out-of-Band Verification: Explain that this is very likely a scam. The next step is to verify the request through a different communication channel (out-of-band). Instruct the employee to call the CEO on their known, trusted phone number or to contact the CEO's executive assistant to confirm if the request is legitimate. Do not use any contact information from the suspicious email itself.
4. Analyze and Report the Threat: Ask the user to forward the email to you (or the security team) as an attachment so you can analyze the email headers to find the true source. The headers will likely show that it originated from a completely different server, even if the "From" address was spoofed. Block the sender's real address at the email gateway.
5. Educate and Disseminate: After confirming it was an attack, use it as a learning opportunity. Thank the user for being vigilant and reporting it. With management's permission, send out a company-wide alert describing the attempted attack and reminding all employees of the official procedure for wire transfers, reinforcing the importance of verbal confirmation for such requests.

Reflection Question: Why is "out-of-band" verification a critical step when dealing with suspicious requests, especially those involving financial transactions or sensitive data?