3.1.5. Compare and contrast common social engineering attacks, threats, and vulnerabilities. (Obj. 2.5)

💡 First Principle: The human is often the weakest link in security; awareness and vigilance are the best defenses against social engineering.

Social engineering is the art of psychological manipulation. Instead of trying to break through firewalls and exploit software vulnerabilities, an attacker targets the most vulnerable part of any organization: its people. They use deception, persuasion, and intimidation to trick employees into divulging sensitive information or performing actions that compromise security. As a technician, you must recognize these attacks to protect your users and your company.

• Phishing: The most common attack. An attacker sends a broad, generic email to thousands of people, pretending to be from a well-known entity like a bank, a shipping company, or a tech service. The email contains a link to a fake login page designed to steal credentials or an attachment containing malware.
• Spear Phishing: A highly targeted and much more dangerous version of phishing. The attacker does their homework, researching a specific individual or company. The email will be personalized, using the target's name, job title, and other details to appear much more legitimate.
• Whaling: A type of spear phishing aimed specifically at high-value targets like CEOs, CFOs, or other senior executives. The goal is often to trick them into authorizing large wire transfers or revealing strategic company secrets.
• Vishing and Smishing: These are phishing attacks conducted over different mediums. Vishing is voice phishing (via a phone call), and Smishing is SMS phishing (via text message).
• Impersonation: An attacker pretends to be someone they are not, such as a new employee, a vendor, or even an IT help desk technician, to gain physical access or information.
• Shoulder Surfing & Tailgating: These are physical social engineering attacks. Shoulder surfing is simply looking over someone's shoulder to see them enter a password or PIN. Tailgating is following an authorized person through a secure doorway without providing your own credentials.
• Dumpster Diving: Searching through a company's trash to find documents containing sensitive information, like old bills, employee lists, or network diagrams.

The best defense against social engineering is a well-trained and skeptical workforce. Regular security awareness training that teaches users to be suspicious of unsolicited requests, to hover over links to check their true destination, and to independently verify any urgent or unusual requests for money or or data is critical.

Technician's Action Plan: Scenario: A frantic employee from the accounting department calls you. They just received an email from the "CEO," who is on vacation, with the subject "URGENT - Invoice Payment." The email instructs the employee to immediately wire $15,000 to a new international vendor to secure a critical deal. The email address looks correct, but the tone is unusually demanding.

1. Identify the Attack: Immediately recognize the classic signs of a Whaling attack: urgency, a request for a financial transaction, an executive who is conveniently out of contact, and a deviation from normal procedure.
2. Instruct the User to STOP: Tell the employee in a calm but firm voice: "Do not click any links, do not reply to the email, and absolutely do not make that wire transfer."
3. Initiate Out-of-Band Verification: Explain that this is very likely a scam. The next step is to verify the request through a different communication channel (out-of-band). Instruct the employee to call the CEO on their known, trusted phone number or to contact the CEO's executive assistant to confirm if the request is legitimate. Do not use any contact information from the suspicious email itself.
4. Analyze and Report the Threat: Ask the user to forward the email to you (or the security team) as an attachment so you can analyze the email headers to find the true source. The headers will likely show that it originated from a completely different server, even if the "From" address was spoofed. Block the sender's real address at the email gateway.
5. Educate and Disseminate: After confirming it was an attack, use it as a learning opportunity. Thank the user for being vigilant and reporting it. With management's permission, send out a company-wide alert describing the attempted attack and reminding all employees of the official procedure for wire transfers, reinforcing the importance of verbal confirmation for such requests.

Reflection Question: Why is "out-of-band" verification a critical step when dealing with suspicious requests, especially those involving financial transactions or sensitive data?