Social engineering manipulates people into disclosing confidential information or performing actions that compromise security. Rather than exploiting software, it targets human behavior and can bypass traditional security measures. section 11.2.2
Common social engineering attacks include:
- Phishing uses deceptive emails to induce victims to click malicious links, download malware, or provide sensitive information. section 11.2.2
- Spear phishing targets employees of a particular company; whaling targets high-profile individuals such as executives. section 11.2.2
- Smishing delivers phishing messages through SMS, while vishing performs phishing by telephone. section 11.2.2
- Pretexting invents a plausible scenario, and tailgating or piggybacking follows an authorized person into a restricted physical area. section 11.2.2
Fabricated IT request
An attacker claiming to be from IT asks an employee to visit a URL, log in, and reset a password. This combines pretexting with vishing. section 11.2.2
Effective defenses raise awareness, provide user training, and use physical access controls such as badge readers. Training teaches employees to recognize threats and follow security policies. section 11.6
