Module 14 of 20 — Advanced Domains

Social Engineering & The Human Factor

People are the most exploited attack surface. Social engineering manipulates psychological principles to bypass technical controls. Understanding attack methods, psychological triggers, and defense strategies is essential for comprehensive security.

Social Engineering Attack Types

Each attack type leverages different communication channels and psychological triggers. Recognizing patterns helps identify and prevent attacks.

Phishing

Mass emails or messages designed to trick recipients into revealing credentials or downloading malware.

Example: Google Docs sharing scam that redirects to fake login page.
Defense: Security awareness training, DMARC/SPF/DKIM, email filtering.

Spear Phishing

Targeted attacks using personal information to increase credibility.

Example: Business email compromise (BEC) requesting wire transfer.
Defense: Domain monitoring, transaction verification processes, email authentication.

Whaling

Phishing targeting high-value individuals like executives.

Example: Fake legal subpoena sent to CEO from spoofed law firm.
Defense: Executive protection services, domain shadowing detection.

Vishing

Voice phishing using phone calls to extract information.

Example: Tech support scam claiming computer infected, requests remote access.
Defense: Caller verification procedures, employee training.

Smishing

SMS-based phishing with malicious links or requests.

Example: Package delivery notification with fake tracking link.
Defense: SMS filtering, mobile device management policies.

Pretexting

Creating fabricated scenario to obtain information.

Example: Impersonating IT support calling for password reset.
Defense: Password reset procedures, verification of authority.

Psychological Principles Used

Understanding manipulation principles helps identify when they're being used against you.

Authority

People comply with requests from perceived authority figures.

Tactic: Attacker claims to be CEO or law enforcement demanding urgent action.
Counter: Verify authority through independent channels. Challenge unexpected requests.

Urgency

Time pressure reduces critical thinking and leads to hasty decisions.

Tactic: Email claiming account will be closed unless password changed immediately.
Counter: Take time to verify. Legitimate requests allow verification time.

Social Proof

People follow what others appear to be doing.

Tactic: Fake LinkedIn connection requests from compromised accounts.
Counter: Verify independently. Recognize when social proof is manufactured.

Reciprocity

People feel obligated to return favors.

Tactic: Free gift or discount offered before request for sensitive information.
Counter: Recognize manipulation attempts. No obligation for unsolicited offers.

Consistency

People prefer to remain consistent with previous commitments.

Tactic: Small initial commitment leads to larger requests.
Counter: Question whether commitments were made freely.

Recognizing Red Flags

Social engineering attempts often display warning signs. Training these observations builds collective defense.

!Unexpected requests for credentials, payments, or sensitive data
!Urgency combined with unusual payment methods or destinations
!Sender domain differs subtly from legitimate domain (typosquatting)
!Unusual language, grammar errors, or inconsistent branding
!Suspicious attachments or links, especially to cloud storage
!Requests to bypass normal procedures or verify through alternate channels

Security Awareness Program Design

Effective awareness programs engage participants and measure improvement.

Phishing Simulations

Regular controlled phishing exercises to train recognition skills.

Best Practice: Gradual difficulty increase. Immediate education on failures.

Security Champions

Identify enthusiastic employees to promote security culture.

Best Practice: Cross-departmental representation. Recognition and rewards.

Incident Sharing

Share anonymized real attack examples with staff.

Best Practice: Regular newsletters. Highlight new attack patterns.

Gamification

Points, badges, leaderboards for security behaviors.

Best Practice: Meaningful rewards. Avoid punitive scoring.

Key Takeaways

  • Authority and urgency are the most exploited psychological principles.
  • Multi-factor verification stops most social engineering attempts.
  • Regular training and simulations build recognition skills.
  • Security culture starts with leadership modeling behaviors.
Module 14 of 20
Mobile & IoT SecurityNext: Encryption