An attacker, posing as a bank representative, convinced an employee to release certain, financial information that ultimately resulted in fraud. Which of the following best describes this cybersecurity risk?
Social engineering is a psychological manipulation technique used by attackers to trick individuals into divulging sensitive information. Instead of exploiting technical vulnerabilities, it targets human weaknesses such as trust, fear, or urgency.
Manipulates Human Behavior – The attacker impersonates a trusted entity (a bank representative) to deceive the employee.
Leads to Unauthorized Information Disclosure – The employee unknowingly provides sensitive financial data.
Results in Fraud – The stolen information is misused, causing financial loss.
A. Shoulder Surfing – This occurs when an attacker physically observes someone entering sensitive data (e.g., watching a person type a password).
B. Pharming – This involves redirecting users to a fraudulent website to steal their credentials, not direct impersonation.
C. Phishing – This is a broad category of social engineering that typically involves emails or fake websites, whereas this scenario describes a direct impersonation attack.
IIA’s GTAG on Cybersecurity – Discusses social engineering as a key risk for organizations.
NIST SP 800-61 (Incident Handling Guide) – Identifies social engineering as a common attack vector.
Why Social Engineering is the Correct Answer?Why Not the Other Options?IIA References:
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit