Protection of Information Assets · Topic 6 of 8
Security Awareness and Attack Methods
Security awareness programs and how to measure them, social engineering and phishing, malware and ransomware, application attacks and fraud methods.
- 3 min
- Awareness is continuous, role-based and measured by behavior.
- Spear phishing targets individuals; whaling targets executives.
- Verify payment detail changes out of band.
What it is
Security awareness training helps people recognize and resist attacks and follow security policies, because many attacks target people rather than technology. Attack methods are the techniques attackers use, from tricking staff to exploiting software flaws. An auditor needs to know them well enough to judge whether controls address them.
How it works
Awareness programs
A good program:
- Starts at hiring and repeats regularly, not once a year only.
- Is tailored by role: finance staff learn payment fraud; developers learn secure coding; executives learn targeted attacks.
- Uses varied methods: short modules, simulated phishing, posters, briefings on current threats.
- Is measured: phishing simulation click and report rates, incident reports from staff, completion rates, trends over time.
- Gives people an easy way to report suspicious messages.
Completion rates alone show attendance, not behavior. Falling click rates and rising report rates show the program is working.
Social engineering
| Attack | Description |
|---|---|
| Phishing | Fraudulent messages that trick people into clicking links, opening attachments or giving credentials |
| Spear phishing | Phishing targeted at specific people using personal details |
| Whaling | Spear phishing aimed at senior executives |
| Business email compromise | Impersonating executives or suppliers to redirect payments |
| Vishing and smishing | Phishing by voice call or text message |
| Pretexting | Inventing a scenario to obtain information, such as posing as IT support |
| Tailgating | Following an authorized person through a secure door |
The control for payment redirection fraud is a process control: verify any change of bank details by calling a known number on file, not one in the request.
Malware
| Type | Behavior |
|---|---|
| Virus | Attaches to files and spreads when they run |
| Worm | Spreads by itself across networks |
| Trojan | Disguised as legitimate software |
| Ransomware | Encrypts data and demands payment |
| Spyware and keyloggers | Steal information and keystrokes |
| Rootkit | Hides itself and keeps privileged access |
| Logic bomb | Triggers on a condition, such as a date or an employee's removal |
Technical and fraud attacks
| Attack | Description |
|---|---|
| Denial of service (DoS) and distributed DoS | Overwhelm a system so legitimate users cannot reach it |
| Man-in-the-middle | Intercept and possibly alter communications |
| SQL injection | Insert database commands through unvalidated input |
| Cross-site scripting (XSS) | Inject scripts into web pages viewed by other users |
| Buffer overflow | Overrun memory to crash a program or run code |
| Password attacks | Brute force, dictionary attacks, credential stuffing with leaked passwords |
| Salami technique | Steal tiny amounts from many transactions |
| Data diddling | Change data before or during input |
Input validation is the root fix for injection attacks. When an option offers validating input or using parameterized queries, it usually beats options that only add monitoring.
How the exam asks about this
- "Which BEST shows awareness training is effective?" Fewer staff clicking on simulated phishing and more reporting it over time.
- "An email from the CEO asks finance to wire money urgently." Business email compromise; verify through a separate known channel.
- "Rounding fractions of cents into one account." The salami technique.
What to remember for the exam
- Awareness is continuous, role-based and measured by behavior.
- Spear phishing targets individuals; whaling targets executives.
- Verify payment detail changes out of band.
- Know worms, trojans, ransomware, rootkits and logic bombs.
- Input validation prevents injection; know salami and data diddling.
Training that ends with a quiz score but no change in reporting or click rates gives management false comfort.
Common mistakes
Measuring awareness by completion only.
Treating phishing as only a technical problem. Process controls such as callback verification stop the fraud.
Confusing viruses and worms. Worms spread without user action.
Check yourself
What is whaling?
A targeted phishing attack aimed at senior executives.
Which malware is triggered by a specific condition such as a date?
A logic bomb.
What is the best control against SQL injection?
Input validation and parameterized queries.
Topic 6 of 8 in Protection of Information Assets
Test yourself on Protection of Information Assets
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.