Network Defense Management · Topic 2 of 5
Human, Email, Mobile, Cloud, Wireless and Supply Chain Attacks
Recognize social engineering, email, mobile, cloud, wireless and supply chain attacks and the defense that matches each, as CND questions describe them.
- 5 min
- Phishing is broad, spear phishing is targeted and whaling targets executives.
- Vishing is voice and smishing is text message.
- SPF, DKIM and DMARC help detect spoofed email.
What it is
Not every attack hits a port or a bug. Some target people, some target the channels people use (email, phones, wireless), and some target the cloud or the vendors an organization depends on.
This page gives the attack names and their one line signatures for six categories. The exam usually describes a situation and asks you to name the attack or the best defense.
How it works
Social engineering
Social engineering manipulates people into giving up access or information.
| Technique | Description |
|---|---|
| Phishing | Mass fake messages that ask for credentials or clicks |
| Spear phishing | Phishing aimed at one person or group, with personal details |
| Whaling | Spear phishing aimed at executives |
| Vishing | Phishing by voice call |
| Smishing | Phishing by text message |
| Pretexting | An invented story to gain trust |
| Baiting | A tempting item, such as an infected USB drive left in a lobby |
| Tailgating or piggybacking | Following an authorized person through a secured door |
| Shoulder surfing | Watching someone type a password or read a screen |
| Dumpster diving | Searching discarded papers and media |
| Quid pro quo | Offering a service or favor in exchange for access |
The main defense is awareness training plus technical controls such as multifactor authentication and badge access.
Email attacks
- Phishing and spear phishing by email, often with spoofed sender names.
- Business email compromise (BEC): a fake or hijacked executive or vendor account requests a payment or data.
- Malicious attachments and links: macros, scripts or links to credential harvesting pages.
- Email spoofing: forging the From address.
- Spam and mail bombing: flooding a mailbox or server.
- Email account takeover: stolen credentials used to read mail and send more phishing.
Sender checks are SPF, DKIM and DMARC. SPF lists which servers may send for a domain, DKIM signs messages, and DMARC tells receivers what to do when SPF or DKIM checks fail. Add mail filtering, attachment sandboxing and user reporting.
Mobile device attacks
| Attack | Description |
|---|---|
| Malicious apps | Apps from unofficial stores that steal data |
| Jailbreaking or rooting | Removing OS restrictions, which weakens protection |
| Smishing | Text message phishing |
| SIM swapping | Moving a victim's number to an attacker's SIM to catch SMS codes |
| Unsecured Wi-Fi and rogue networks | Traffic captured on public networks |
| Bluetooth attacks | Bluejacking sends unsolicited messages, bluesnarfing steals data |
| Lost or stolen device | Direct data exposure |
| OS and app vulnerabilities | Unpatched mobile software |
Defenses: mobile device management (MDM), device encryption, screen lock, remote wipe, app allow lists and a VPN on untrusted networks.
Cloud attacks
The cloud works on shared responsibility: the provider secures the infrastructure and the customer secures its own data, identities and configuration.
- Misconfiguration: public storage buckets, open security groups.
- Account hijacking: stolen credentials or keys, especially with no multifactor.
- Insecure APIs: weak authentication on cloud interfaces.
- Insider threats: a user with too many rights.
- Data breach and data loss: exposure of stored data.
- DoS and cryptojacking: exhausting resources or using them to mine coins.
- Side channel and cross tenant attacks: one tenant tries to read another's data.
Controls: least privilege, multifactor authentication, key management, configuration monitoring and encryption of data at rest and in transit.
Wireless attacks
| Attack | Description |
|---|---|
| Rogue access point | An unauthorized AP plugged into the network |
| Evil twin | A fake AP copying a real SSID to lure users |
| Deauthentication | Forged frames that disconnect clients |
| Eavesdropping | Capturing wireless frames |
| WEP and weak key cracking | Breaking old or weak encryption |
| WPS PIN attack | Guessing the Wi-Fi Protected Setup PIN |
| Jamming | Radio noise that blocks the signal |
| MAC spoofing | Copying an allowed MAC address |
Use WPA3 (or WPA2 with AES), 802.1X for enterprise networks, turn off WPS and use wireless intrusion detection to find rogue APs.
Supply chain attacks
A supply chain attack compromises a supplier so that the harm reaches its customers. Examples are tampered software updates, a poisoned open source library, hardware with altered firmware and a managed service provider with stolen access.
Defenses include vendor risk assessment, software bills of materials, code signing checks, verifying hashes, restricting vendor access and monitoring third party connections.
A worked example
An accountant receives an email that looks like the chief executive's, asking for an urgent wire transfer to a new vendor. The domain differs by one letter from the real one, and SPF fails.
This is business email compromise built on email spoofing and pretexting. The right response is to verify the request out of band, such as by calling a known number, and for the mail gateway to quarantine messages that fail DMARC.
How the exam asks about this
- "A fake access point uses the same SSID as the corporate network. What is it?" → An evil twin.
- "Which attack targets a high ranking executive with a customized message?" → Whaling.
- "A vendor's signed software update contains hidden malware. What kind of attack is this?" → A supply chain attack.
What to remember for the exam
- Phishing is broad, spear phishing is targeted and whaling targets executives.
- Vishing is voice and smishing is text message.
- SPF, DKIM and DMARC help detect spoofed email.
- In the cloud, the customer owns configuration, identity and data.
- Evil twin copies a real network, and a rogue AP is simply an unauthorized one.
Training alone does not stop social engineering. The best answer usually combines awareness with a technical control such as multifactor authentication or email filtering.
Common mistakes
Mixing evil twin and rogue AP. A rogue AP is any unapproved device on the network. An evil twin impersonates a legitimate SSID.
Blaming the cloud provider for every breach. A public bucket is the customer's configuration error under shared responsibility.
Ignoring trusted vendors. Supply chain attacks work because the update or partner is already trusted, so the usual perimeter checks do not fire.
Check yourself
What does DMARC do?
It tells receiving servers how to handle mail that fails SPF or DKIM checks and gives reporting.
Which attack gets a victim's phone number moved to a new SIM?
SIM swapping, used to intercept SMS codes.
Name one defense against a tampered software update.
Verifying code signatures and hashes, plus vendor risk assessment and monitoring.
Topic 2 of 5 in Network Defense Management
Test yourself on Network Defense Management
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.