Network Security · Topic 5 of 7
Social Engineering and Malware
Learn social engineering such as phishing, tailgating, shoulder surfing and dumpster diving, plus malware types and how to limit their impact.
- 4 min
- Phishing uses email, vishing uses voice calls, smishing uses text messages, and spear phishing targets a person.
- Tailgating means following someone in. Piggybacking means being let in.
- Shoulder surfing is watching a screen or keypad. Dumpster diving searches discarded material.
What it is
Not every attack uses a technical flaw. Social engineering tricks people into giving access or information, and malware is software built to cause harm once it runs on a device.
Both attacks often meet in one incident. A phishing email tricks a user into opening a file, and the file installs malware that spreads across the network.
How it works
Social engineering
Social engineering manipulates trust, urgency or fear. The attacker may pretend to be an employee, a supplier or technical support.
| Attack | How it works |
|---|---|
| Phishing | Fraudulent email that tricks users into clicking a link, opening a file or giving credentials |
| Spear phishing | A phishing message aimed at a specific person or group, with personal details |
| Vishing | Phishing by voice call |
| Smishing | Phishing by text message |
| Tailgating | Following an authorized person through a secured door without permission |
| Piggybacking | Entering with the knowledge or help of the authorized person |
| Shoulder surfing | Watching someone type a password or read a screen |
| Dumpster diving | Searching discarded paper and media for useful information |
Tailgating and piggybacking are close, and some sources use them as one term. A common distinction is that a tailgater slips in unnoticed, while with piggybacking the authorized person lets the attacker in, often politely.
Defending against social engineering
Training is the main control. Users should know how to spot suspicious messages, verify unusual requests by another channel and report incidents quickly.
Physical controls help too. Access badges, mantraps (a small space with two doors), cameras and guards stop tailgating.
Privacy screens deter shoulder surfing. Shredding documents and wiping media defeat dumpster diving.
Email filtering and multifactor authentication (MFA) reduce the harm when a user is fooled, because a stolen password alone is not enough.
Malware
Malware is a broad term for malicious software. Several types are named on the exam.
| Type | Behavior |
|---|---|
| Virus | Attaches to a file and spreads when the file is run |
| Worm | Spreads across the network by itself, with no user action |
| Trojan | Looks like legitimate software but carries a hidden harmful function |
| Ransomware | Encrypts data and demands payment for the key |
| Spyware | Secretly collects information |
| Rootkit | Hides deep in the system and conceals other malware |
| Botnet agent | Turns the device into a remote controlled bot for attacks such as a distributed denial of service (DDoS) attack |
A worm is especially dangerous for networks because it moves from host to host on its own, using up bandwidth and infecting machines in minutes.
Reducing malware impact
| Control | Effect |
|---|---|
| Patching | Closes the vulnerabilities that malware uses to spread |
| Endpoint protection | Detects and blocks known and suspicious programs |
| Network segmentation | Limits how far malware can travel |
| Backups kept offline | Allow recovery from ransomware without paying |
| Email and web filtering | Blocks malicious attachments and sites |
If an infected device is found, isolate it from the network first so the infection cannot spread, then investigate and clean it.
Password and insider threats
Brute force attacks try many passwords until one works, and a dictionary attack tries common words. Account lockouts, long passphrases and MFA lower the risk. An insider threat comes from a person who already has legitimate access and misuses it, so least privilege and logging matter.
What to remember for the exam
- Phishing uses email, vishing uses voice calls, smishing uses text messages, and spear phishing targets a person.
- Tailgating means following someone in. Piggybacking means being let in.
- Shoulder surfing is watching a screen or keypad. Dumpster diving searches discarded material.
- Training and physical controls are the main defenses against social engineering.
- A worm spreads on its own. A virus needs a file to be run. A trojan is disguised software.
- Ransomware encrypts data for payment. Offline backups are the best recovery.
- Isolate infected devices first to stop the spread.
- MFA reduces the harm of stolen passwords.
When a question says malware spreads without user action across the network, the answer is a worm. If it hides a harmful function in useful looking software, it is a trojan.
Common mistakes
Blaming only technology. Many breaches begin with a person being persuaded to act.
Mixing up tailgating and piggybacking. One is unnoticed entry, the other is entry with the help of an authorized person.
Treating all malware as a virus. The exam separates viruses, worms, trojans and ransomware by behavior.
Keeping backups on the same network. Ransomware can encrypt connected backups too.
Disconnecting too late. Leaving an infected device online lets the infection spread while you investigate.
Do not pay ransom as a first step. Payment gives no guarantee of recovery, so rely on tested offline backups and an incident response plan.
Check yourself
Answer these three.
What is the difference between tailgating and piggybacking?
Tailgating is following someone in without their notice, and piggybacking is entering with the help of the authorized person.
Which malware type spreads across the network on its own?
A worm.
What is the first step when a device is found infected?
Isolate it from the network to stop the spread.
Topic 5 of 7 in Network Security
Test yourself on Network Security
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.