Social engineeringexploits human psychology to manipulate individuals into divulging sensitive information, granting access, or performing actions that compromise security. Unlike technical exploits, it targets the "human factor," often bypassing technical defenses. The listed attacks fit this category:
Phishing:Mass, untargeted emails (e.g., fake bank alerts) trick users into entering credentials on spoofed sites. Uses tactics like urgency or trust (e.g., typosquatting domains).
Spear Phishing:Targeted phishing against specific individuals/organizations (e.g., CEO fraud), leveraging reconnaissance (e.g., LinkedIn data) for credibility.
Vishing (Voice Phishing):Phone-based attacks (e.g., fake tech support calls) extract info via verbal manipulation. Often spoofs caller ID.
Scareware:Fake alerts (e.g., “Your PC is infected!” pop-ups) scare users into installing malware or paying for bogus fixes. Exploits fear and urgency.
Watering Hole:Compromises trusted websites frequented by a target group (e.g., industry forums), infecting visitors via drive-by downloads. Relies on habitual trust.
Technical Details:
Delivery: Email (phishing), VoIP (vishing), web (watering hole/scareware).
Payloads: Credential theft, malware (e.g., trojans), or financial fraud.
Mitigation: User training, email filters (e.g., DMARC), endpoint protection.
Security Implications:Social engineering accounts for ~90% of breaches (e.g., Verizon DBIR 2023), as it exploits unpatchable human error. CNSP likely emphasizes awareness (e.g., phishing simulations) and layered defenses (e.g., MFA).
Why other options are incorrect:
A. Probes:Reconnaissance techniques (e.g., port scanning) to identify vulnerabilities, not manipulation-based like these attacks.
B. Insider threats:Malicious actions by authorized users (e.g., data theft by employees), not external human-targeting tactics.
D. Ransomware:A malware type (e.g., WannaCry) that encrypts data for ransom, not a manipulation method—though phishing often delivers it.
Real-World Context:The 2016 DNC hack used spear phishing to steal credentials, showing social engineering’s potency.References:CNSP Official Study Guide (Social Engineering Threats); NIST SP 800-50 (Security Awareness Training).
Submit