In this section of the course,
we're going to discuss social engineering.
So, what exactly is social engineering?
Well, social engineering is a manipulative strategy
that exploits human psychology
to gain unauthorized access to systems, data,
or physical spaces.
Social engineering includes written communication
as well as face-to-face interaction.
Instead of just using technical hacking techniques,
social engineers manipulate people,
revealing confidential information
or performing actions that compromise security.
Techniques can range from phishing emails and pretexting,
where attackers create a false scenario
to obtain information,
to baiting and tailgating, where physical access is gained
through deception or exploiting human courtesy.
As the attacks target the human element,
the best defense against social engineering
is to provide security awareness training to your users.
This kind of regular training
on how to best recognize and respond
to social engineering attacks
is crucial in maintaining the security
of both your digital and physical environment.
For this section on social engineering,
we're going to be covering some objectives
in Domain 2 and Domain 5,
specifically Objectives 2.2 and 5.6.
Objective 2.2 states that you must be able
to "explain common threat vectors and attack services."
Now, in this objective,
we're going to be really focusing on the social engineering
or human-based attack vectors,
like phishing, vishing, smishing,
misinformation and disinformation,
impersonation, business email compromise,
pretexting, water-holing, brand impersonation,
and also typosquatting.
For Objective 5.6, it states,
"Given a scenario,
you must be able to implement security awareness practices,"
such as conducting anti-phishing campaigns and training,
and things like that.
Now, as we kick off this section,
we're going to first discuss
the different motivational triggers
used by social engineers,
like familiarity, likability,
consensus and social proof, authority and intimidation,
and also scarcity and urgency.
Then we will discuss impersonation.
Now, impersonation simply means
pretending to be someone else,
and that is one of the most basic forms
of social engineering techniques used by attackers
when they're trying to conduct
a general impersonation attack,
brand impersonation, typosquatting,
and waterhole-based attacks.
Next, we have pretexting.
Pretexting is a form of social engineering
where attackers create a convincing pretext
or fabricated scenario
to manipulate their targets
into divulging sensitive information
or perform actions that compromise security.
The attacker often impersonates
a trusted individual or an authority figure,
such as a bank official, IT support,
or law enforcement officer to gain trust
and get them to divulge confidential
or sensitive data to the attacker.
After that, we're going to take a deep dive
into the different types of phishing attacks
used by social engineers,
including phishing, vishing, smishing,
spear phishing, whaling,
and business email compromise-based attacks.
Next, we will look
at how you can best prevent phishing attacks
and enhance the security awareness
of your organization's employees
by conducting end user training.
Then we will cover fraud and scams.
Frauds and scams are deceptive practices or schemes
designed to deceive people
into parting with their money or valuable information.
So, we are going to provide you some great ways
to effectively identify these frauds and scams,
as well as how you can train your users
to be vigilant against these type of attacks.
After that, we'll cover influence campaigns.
Influence campaigns are a form of social engineering
and psychological attack
that is used to spread misinformation and disinformation
that can potentially have an effect on politics, economics,
and other key areas of our lives.
Next, we'll cover some
of the other various social engineering attacks out there,
such as diversion theft, hoaxes, shoulder surfing,
dumpster diving, eavesdropping, baiting,
piggybacking, and tailgating,
just to make sure you're well prepared
to encounter any of those attack vectors.
And finally, we will take a short quiz
just to see what you've learned
during this section of the course,
and review each of those quiz questions
to fully ensure that you can explain
why the right answer was right.
So, let's get started
with our coverage of social engineering
in this section of the course.