Threats, Vulnerabilities, and Mitigations · Topic 3 of 9
Social Engineering Techniques
Social engineering for Security+: phishing, vishing, smishing, BEC, pretexting, typosquatting, watering holes and physical tricks, with defenses.
- 4 min
- Phishing is by email, vishing by voice and smishing by text message.
- Spear phishing targets specific people, and whaling targets senior executives.
- Business email compromise impersonates a trusted business contact to move money or data.
What it is
Social engineering is the manipulation of people to make them give up information, access or money. It attacks human trust and habit, not software flaws.
It works because attackers rely on traits such as respect for authority, a wish to be helpful and fear of missing a deadline. Technical controls help, but training is the main defense.
How it works
Phishing and its variants
Phishing is a fraudulent message that pretends to come from a trusted source to get a click, a login or a payment. The variants differ in the channel or the target.
| Technique | Channel or twist |
|---|---|
| Phishing | Mass email with a link or attachment |
| Spear phishing | Email aimed at a specific person or group, using personal details |
| Whaling | Spear phishing aimed at senior executives |
| Vishing | Voice phishing, by phone call |
| Smishing | Phishing by Short Message Service (SMS) text |
| Business email compromise (BEC) | A fake or hijacked business email used to trick staff into paying or sending data |
Business email compromise often asks for a payment change or a gift card purchase while posing as an executive or supplier.
Impersonation and pretexting
| Technique | Description |
|---|---|
| Pretexting | Inventing a believable scenario to get information, such as pretending to be from IT support |
| Impersonation | Pretending to be a specific trusted person, such as a manager or a repair technician |
| Brand impersonation | Copying a well known company's look in messages or sites |
| Misinformation and disinformation | False information spread by accident (misinformation) or on purpose (disinformation) |
Web based tricks
| Technique | Description |
|---|---|
| Typosquatting | Registering a domain with a common misspelling, so mistyped addresses reach the attacker |
| Watering hole | Compromising a site that the target group is known to visit, and waiting for them to arrive |
| Pharming | Redirecting users from a real site to a fake one without a click on a bad link |
Typosquatting waits for a mistake, while phishing sends the victim a link. In a watering hole attack, the target is not contacted directly.
Physical social engineering
Tailgating means following an authorized person through a door without using a credential. Shoulder surfing is watching someone type a password or view a screen. Dumpster diving is searching discarded material for useful information.
Defenses
| Defense | What it does |
|---|---|
| Awareness training | Teaches staff to spot and report attempts |
| Email filtering | Blocks known bad senders and links |
| Multifactor authentication (MFA) | Limits damage if a password is given away |
| Verification procedures | Requires a call back to a known number before a payment change |
| Access control vestibule or guard | Stops tailgating |
What to remember for the exam
- Phishing is by email, vishing by voice and smishing by text message.
- Spear phishing targets specific people, and whaling targets senior executives.
- Business email compromise impersonates a trusted business contact to move money or data.
- Pretexting is the invented story, and impersonation is pretending to be a particular person.
- Typosquatting uses misspelled domain names. A watering hole compromises a site the target visits.
- Misinformation is false by mistake. Disinformation is false by intent.
- Tailgating and shoulder surfing are physical social engineering.
- The best defense is training plus verification procedures.
When a payment or data request arrives by email and looks urgent, the correct response is usually to verify through a separate, known channel.
Common mistakes
Mixing up spear phishing and whaling. Both are targeted. Whaling is limited to senior leaders such as executives.
Confusing pharming and phishing. Phishing needs the user to click a lure. Pharming redirects the user, often by tampering with name resolution.
Thinking MFA stops all social engineering. MFA helps, but an attacker can trick a user into approving a prompt or entering a code.
Believing technology alone is enough. Filters miss some messages, and people need to know how to report them.
Treating tailgating as a technical failure. It is a human behavior that is solved by policy, awareness and physical controls.
Do not click links or open attachments to check whether a message is real. Report it through the proper channel instead.
Check yourself
Which attack is phishing carried out through text messages?
Smishing.
How does a watering hole attack work?
The attacker compromises a site that the target group is known to visit and infects visitors when they arrive.
What is the best control against a fake request to change a supplier's bank details?
A verification procedure that confirms the request through a separate known contact.
Topic 3 of 9 in Threats, Vulnerabilities, and Mitigations
Test yourself on Threats, Vulnerabilities, and Mitigations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.