Security · Topic 7 of 13
Social Engineering, Threats and Vulnerabilities
Compare phishing, vishing, smishing, tailgating and impersonation, then recognise DoS, on path and injection attacks, zero days and common weaknesses.
- 4 min
- Phishing is email, vishing is voice, and smishing is text message.
- Spear phishing targets a person. Whaling targets executives.
- Tailgating means following someone through a door without permission.
What it is
Social engineering tricks people into giving access or information. It targets human behaviour, not software flaws, so technical controls alone do not stop it. This page also covers other common attacks (threats) and the weaknesses (vulnerabilities) that they exploit.
How it works
Social engineering attacks
| Attack | Description |
|---|---|
| Phishing | Fake email that tries to trick the reader into clicking a link, opening a file or giving credentials |
| Spear phishing | Phishing aimed at a specific person or group, using personal details |
| Whaling | Spear phishing aimed at senior executives |
| Vishing | Voice phishing by phone call |
| Smishing | Phishing by SMS (Short Message Service) text message |
| QR code phishing | A malicious QR (Quick Response) code that leads to a fake site |
| Business email compromise | Fraud using a hijacked or spoofed business email account, often to redirect payments |
| Shoulder surfing | Watching someone type a password or read a screen |
| Tailgating | Following an authorised person through a secure door without permission |
| Impersonation | Pretending to be a trusted person such as information technology (IT) staff or a delivery worker |
| Dumpster diving | Searching trash for documents or media with sensitive data |
| Evil twin | A rogue wireless access point that copies a real network name |
Some sources use piggybacking for the same situation when the authorised person knowingly lets the other one in. The defences are shredding paper, access control vestibules, locked screens, user awareness and a clear process for reporting.
Other threats
| Threat | Description |
|---|---|
| Denial of service (DoS) | Overloads a system so legitimate users cannot reach it |
| Distributed denial of service (DDoS) | A DoS launched from many devices at once, often a botnet |
| On path attack | Attacker sits between two parties to read or change traffic. Formerly called man in the middle |
| Brute force attack | Tries every possible password until one works |
| Dictionary attack | Tries a list of common words and passwords |
| Zero day attack | Exploits a flaw that the vendor has not yet patched |
| Spoofing | Faking an address or identity such as an email sender |
| Insider threat | Harm from an employee or contractor with legitimate access |
| Structured Query Language (SQL) injection | Inserting database commands into an input field to read or change data |
| Cross site scripting (XSS) | Injecting a script into a web page that runs in other users' browsers |
Strong password length, account lockout after failed attempts and multifactor authentication (MFA) reduce brute force and dictionary attacks. Input validation in web applications addresses injection and XSS. Patching reduces the window for most attacks, but a zero day has no patch yet, so layered defences matter.
Supply chain attack
A supply chain or pipeline attack compromises a trusted vendor, an update or a software build process. The malware then arrives through a channel the victim already trusts, such as a tampered update or a third party library.
Vulnerabilities
A vulnerability is a weakness that a threat can use.
| Vulnerability | Why it matters |
|---|---|
| Non compliant systems | Devices that miss required settings or updates are easy to attack |
| Unpatched systems | Known flaws stay open |
| Unprotected systems | Missing antivirus or firewall protection |
| End of life (EOL) software | No more security fixes |
| Bring your own device (BYOD) | Personal devices may not meet security standards |
When you suspect phishing, do not click the link or open the attachment. Report it using the company process and let security staff investigate.
What to remember for the exam
- Phishing is email, vishing is voice, and smishing is text message.
- Spear phishing targets a person. Whaling targets executives.
- Tailgating means following someone through a door without permission.
- Shoulder surfing is watching a screen or keyboard.
- An evil twin copies a real Wi-Fi network name.
- A DDoS uses many sources to overload a target.
- An on path attack intercepts traffic between two parties.
- A zero day exploits an unpatched flaw.
- SQL injection and XSS are web application attacks.
- EOL, unpatched and unprotected systems are vulnerabilities.
Common mistakes
Confusing DoS and DDoS. The difference is the number of sources: one versus many.
Treating whaling and spear phishing as the same. Whaling targets senior executives specifically.
Assuming patches stop a zero day. By definition no patch exists yet.
Blaming only technology. Social engineering works through people, so training and procedures are the main defence.
Check yourself
What is vishing?
Phishing carried out by voice, usually a phone call.
Which attack follows an authorised person through a secured entrance?
Tailgating.
What makes a zero day attack hard to stop?
The vendor has not released a patch for the flaw yet.
Topic 7 of 13 in Security
Test yourself on Security
The full CompTIA A+ 220-1202 question bank has 835 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.